Added suspicious image and paths to reduce fps

SigmaHQ · Mar 12, 2024 · d145f9a · d145f9a
1 parent f17f699
commit d145f9a
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/...-emerging-threats/2024/Malware/Raspberry-Robin/registry_set_internet_settings_zonemap.yml b/...-emerging-threats/2024/Malware/Raspberry-Robin/registry_set_internet_settings_zonemap.yml
@@ -17,6 +17,13 @@ logsource:
     product: windows
     definition: 'Requirements: The registry key "\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" and its subkey must be monitored'
 detection:
+    selection_suspicious_image:
+        - Image|contains:
+              - '\AppData\Local\Temp\'
+              - '\Downloads\'
+              - '\Windows\Temp\'
+              - '\Users\Public\'
+        - Image|endswith: '\control.exe'
     selection_registry_object:
         TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\'
     selection_enable: