Skip to content

Commit 4f22b79

Browse files
author
Florian Martin
committed
Some rule names with a technique_id did not have the prefix tehcnique_id
1 parent 13599dd commit 4f22b79

2 files changed

Lines changed: 7 additions & 7 deletions

File tree

‎12_13_14_registry_event/include_office_dde.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44
<RegistryEvent onmatch="include">
55
<!--Microsoft:Office:Security _features-->
66
<!--https://msrc.microsoft.com/update-guide/vulnerability/ADV170021-->
7-
<TargetObject name="T1559.002,office" condition="end with">\Word\Security\AllowDDE</TargetObject>
8-
<TargetObject name="T1559.002,office" condition="end with">\Excel\Security\DisableDDEServerLaunch</TargetObject>
9-
<TargetObject name="T1559.002,office" condition="end with">\Excel\Security\DisableDDEServerLookup</TargetObject>
7+
<TargetObject name="technique_id=T1559.002,office" condition="end with">\Word\Security\AllowDDE</TargetObject>
8+
<TargetObject name="technique_id=T1559.002,office" condition="end with">\Excel\Security\DisableDDEServerLaunch</TargetObject>
9+
<TargetObject name="technique_id=T1559.002,office" condition="end with">\Excel\Security\DisableDDEServerLookup</TargetObject>
1010
</RegistryEvent>
1111
</RuleGroup>
1212
</EventFiltering>

‎12_13_14_registry_event/include_office_security_features.xml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@
44
<RegistryEvent onmatch="include">
55
<!--Microsoft:Office:Security _features-->
66
<!--https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_disable_microsoft_office_security_features.yml-->
7-
<TargetObject name="T1562,office" condition="end with">\VBAWarnings</TargetObject>
8-
<TargetObject name="T1562,office" condition="end with">\DisableInternetFilesInPV</TargetObject>
9-
<TargetObject name="T1562,office" condition="end with">\DisableUnsafeLocationsInPV</TargetObject>
10-
<TargetObject name="T1562,office" condition="end with">\DisableAttachementsInPV</TargetObject>
7+
<TargetObject name="technique_id=T1562,office" condition="end with">\VBAWarnings</TargetObject>
8+
<TargetObject name="technique_id=T1562,office" condition="end with">\DisableInternetFilesInPV</TargetObject>
9+
<TargetObject name="technique_id=T1562,office" condition="end with">\DisableUnsafeLocationsInPV</TargetObject>
10+
<TargetObject name="technique_id=T1562,office" condition="end with">\DisableAttachementsInPV</TargetObject>
1111
</RegistryEvent>
1212
</RuleGroup>
1313
</EventFiltering>

0 commit comments

Comments
 (0)