Paste sharing url in reverse order
Paste sharing url in reverse order
Sigma rule (View on GitHub)
1title: Paste sharing url in reverse order
2status: experimental
3description: Paste sharing url in reverse order
4author: Joe Security
5date: 2024-11-04
6id: 200119
7threatname:
8behaviorgroup: 12
9classification: 1
10mitreattack:
11
12logsource:
13 category: process_creation
14 product: windows
15detection:
16 selection:
17 CommandLine:
18 - '*moc.nibetsap//:sptth*'
19 - '*moc.nibetsah//:sptth*'
20 - '*moc.buhtig.tsig//:sptth*'
21 - '*ten.nibetavirp//:sptth*'
22 - '*ten.nib0//:sptth*'
23 - '*gro.etsapd//:sptth*'
24 - '*ti.etsaptusj//:sptth*'
25 - '*moc.nibtsohg//:sptth*'
26 - '*ee.etsap//:sptth*'
27 - '*oc.yrtner//:sptth*'
28
29 condition: selection
30level: critical```