Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
4 contributors

Users who have contributed to this file

@thomaspatzke @SherifEldeeb @yazgoo @mrblacyk
28 lines (28 sloc) 794 Bytes
title: Microsoft Binary Github Communication
id: 635dbb88-67b3-4b41-9ea5-a3af2dd88153
status: experimental
description: Detects an executable in the Windows folder accessing github.com
references:
- https://twitter.com/M_haggis/status/900741347035889665
- https://twitter.com/M_haggis/status/1032799638213066752
author: Michael Haag (idea), Florian Roth (rule)
date: 2017/08/24
tags:
- attack.lateral_movement
- attack.t1105
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 3
Initiated: 'true'
DestinationHostname:
- '*.github.com'
- '*.githubusercontent.com'
Image: 'C:\Windows\\*'
condition: selection
falsepositives:
- 'Unknown'
- '@subTee in your network'
level: high
You can’t perform that action at this time.