Merge pull request #84 from jangeisbauer/patch-11

Create apt sofacy.txt
microsoft · Apr 22, 2020 · 0228849 · 0228849
2 parents 09d03d1 + d0386b0
commit 0228849
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/Campaigns/apt sofacy.txt b/Campaigns/apt sofacy.txt
@@ -0,0 +1,7 @@
+// Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_sofacy.yml
+// Questions via Twitter: @janvonkirchheim
+DeviceProcessEvents
+| where Timestamp > ago(7d)
+| where ProcessCommandLine matches regex @'rundll32\.exe %APPDATA%.*\.dat",'
+     or ProcessCommandLine matches regex @'rundll32\.exe %APPDATA%.*\.dll",#1'
+| top 100 by Timestamp desc