mirror of
https://github.com/socfortress/Wazuh-Rules.git
synced 2025-10-23 00:02:11 +00:00
24 lines
638 B
XML
24 lines
638 B
XML
<group name="windows,">
|
|
<rule id="100060" level="10">
|
|
<decoded_as>json</decoded_as>
|
|
<field name="Path">\.+</field>
|
|
<field name="Verified">\.+</field>
|
|
<description>Windows Sigcheck - VirusTotal Hit</description>
|
|
<mitre>
|
|
<id>T1036</id>
|
|
</mitre>
|
|
<options>no_full_log</options>
|
|
<group>windows_sigcheck,</group>
|
|
</rule>
|
|
<rule id="100061" level="12">
|
|
<if_sid>100060</if_sid>
|
|
<field name="VTdetection">^\d\d\|</field>
|
|
<description>Windows Sigcheck - VirusTotal Hit Above 10 Matches</description>
|
|
<mitre>
|
|
<id>T1036</id>
|
|
</mitre>
|
|
<options>no_full_log</options>
|
|
<group>windows_sigcheck,</group>
|
|
</rule>
|
|
</group>
|