sigma icon indicating copy to clipboard operation
sigma copied to clipboard
verified publisher icon SigmaHQ

Regasm Without CommandLine

Open frack113 opened this issue 1 year ago • 0 comments

Summary of the Pull Request

See many RegAsm without commandline in sandboxes As you can put spaces to the end to bypass the detection , I check if there is no "dll" parameter.

Changelog

new: RegAsm.exe Without Commandline

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

  • If your PR adds new rules, please consider following and applying these conventions

frack113 avatar Jul 05 '24 17:07 frack113