Typo fix in detection

SigmaHQ · Mar 12, 2024 · 5b50dc0 · 5b50dc0
1 parent d145f9a
commit 5b50dc0
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/...-emerging-threats/2024/Malware/Raspberry-Robin/registry_set_internet_settings_zonemap.yml b/...-emerging-threats/2024/Malware/Raspberry-Robin/registry_set_internet_settings_zonemap.yml
@@ -24,18 +24,18 @@ detection:
               - '\Windows\Temp\'
               - '\Users\Public\'
         - Image|endswith: '\control.exe'
-    selection_registry_object:
+    selection_suspicious_registry_object:
         TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\'
-    selection_enable:
+    selection_registry_enable:
         TargetObject|endswith:
             - 'ProxyBypass'
             - 'IntranetName'
             - 'UNCAsIntranet'
         Details|contains: 'DWORD (0x00000001)'
-    selection_disable:
+    selection_registry_disable:
         TargetObject|endswith: 'AutoDetect'
         Details|contains: 'DWORD (0x00000000)'
-    condition: 1 of selection_*
+    condition: (all of selection_suspicious_*) and 1 of selection_registry_*
 falsepositives:
     - Unknown
 # Note: can be upgraded to medium after an initial baseline