security_content
security_content copied to clipboard
Agent with tesla 1
Modified Detections to include Agent Tesla story line
- [x] detect_html_help_spawn_child_process.yml
- [x] excessive_usage_of_taskkill.yml
- [x] executables_or_script_creation_in_suspicious_path.yml
- [x] non_chrome_process_accessing_chrome_default_dir.yml
- [x] non_firefox_process_access_firefox_profile_dir.yml
- [x] office_application_drop_executable.yml
- [x] office_application_spawn_rundll32_process.yml
- [x] office_document_executing_macro_code.yml
- [x] powershell___connect_to_internet_with_hidden_window.yml
- [x] scheduled_task_deleted_or_created_via_cmd.yml
- [x] suspicious_process_file_path.yml
- [x] detect_html_help_spawn_child_process.yml
story
- [x] stories/agenttesla.yml
What does this PR have in it? Screenshots are worth 1000 words 😄
Checklist
- [ ] Validate name matches
<platform>_<mitre att&ck technique>_<short description>nomenclature - [ ] CI/CD jobs passed ✔️
- [ ] Validated SPL logic.
- [ ] Validated tags, description, and how to implement.
- [ ] Verified references match analytic.