Skip to content

Update WannaCry Ransomware Activity #5131

Open
@nasbench

Description

@nasbench

Update https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.yml to remove the following section

- CommandLine|contains|all:
              - 'icacls'
              - '/grant'
              - 'Everyone:F'
              - '/T'
              - '/C'
              - '/Q'
        - CommandLine|contains|all:
              - 'bcdedit'
              - '/set'
              - '{default}'
              - 'recoveryenabled'
              - 'no'
        - CommandLine|contains|all:
              - 'wbadmin'
              - 'delete'
              - 'catalog'
              - '-quiet'

This section isn't specific to WannaCry and we already have generic coverage for it. See https://x.com/nas_bench/status/1868639048484425963

Metadata

Metadata

Assignees

Labels

Create Pull-Requestissues that should be provided as a pull request

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions