Extended the Slingshot APT rule

SigmaHQ · Mar 10, 2018 · 74c2f91 · 74c2f91
1 parent 66d52cf
commit 74c2f91
Showing 1 changed file with 21 additions and 4 deletions.
diff --git a/rules/apt/apt_slingshot.yml b/rules/apt/apt_slingshot.yml
@@ -1,3 +1,5 @@
+---
+action: global
 title: Defrag Deactivation
 description: Detects the deactivation of the Scheduled defragmentation task as seen by Slingshot APT group
 references:
@@ -9,10 +11,25 @@ logsource:
     service: security
     description: 'Requirements: Audit Policy : Audit Other Object Access Events > Success'       
 detection:
-    selection:
-        EventID: 4701
-        TaskName: '\Microsoft\Windows\Defrag\ScheduledDefrag'
     condition: selection
 falsepositives:
     - Unknown
-level: medium
+level: medium
+---
+logsource:
+    product: windows
+    service: sysmon
+detection:
+    selection:
+        EventID: 1
+        CommandLine: 
+            - '*schtasks* /delete *Defrag\ScheduledDefrag*'
+---
+logsource:
+    product: windows
+    service: security
+    description: 'Requirements: Audit Policy : Audit Other Object Access Events > Success'       
+detection:
+    selection:
+        EventID: 4701
+        TaskName: '\Microsoft\Windows\Defrag\ScheduledDefrag'