sigma
sigma copied to clipboard
Update proc_creation_win_reg_windows_defender_tamper.yml
Summary of the Pull Request
Add new values which used by the attacker to disable windows defender
Changelog
update: Suspicious Windows Defender Registry Key Tampering Via Reg.EXE
Example Log Event
Fixed Issues
SigmaHQ Rule Creation Conventions
- If your PR adds new rules, please consider following and applying these conventions