Jump to content

Combining process and registry detection


Recommended Posts

Hello, 

i was trying to create a rule which detects registry changes made by powershell that was generated from excel. Below is my rule sets. it passed the syntax check. The activity was re-produced by creating the registry HKCU:\Software\myEEIEx on endpoints with EEI agent installed.

Detecting of registry key change worked, but when adding the logic of detecting process changes, it doesnt seem to trigger...

    <definition>
        <Process>
            <operator type="OR">
                <Condition component="FileItem" condition="is" property="FileNameWithoutExtension" value="powershell" />
                <Condition component="FileItem" condition="is" property="FileNameWithoutExtension" value="cscript" />
                <Condition component="FileItem" condition="is" property="FileNameWithoutExtension" value="wscript" />
                <Condition component="FileItem" condition="is" property="FileNameWithoutExtension" value="cmd" />
            </operator>
        </Process>
        <operations>
            <operation type="RegSetValue">
                <operator type="OR">
                    <condition component="RegistryItem" condition="starts" property="Key" value="HKCU:\Software\myEEIEx" />
                </operator>
            </operation>
        </operations>
    </definition>

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...