Rule Library
Sigma Rules
2 rules found for "Tom Ueltschi"
3,707Total
3,116Detection
451Emerging
137Hunting
Emerging Threathightest
Adwind RAT / JRAT
Detects javaw.exe in AppData folder as used by Adwind / JRAT
WindowsProcess Creation
TA0002 · ExecutionT1059.005 · Visual BasicT1059.007 · JavaScriptdetection.emerging-threats
Florian Roth (Nextron Systems)+3Fri Nov 102017
Emerging Threatcriticaltest
NotPetya Ransomware Activity
Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil
WindowsProcess Creation
TA0005 · Defense EvasionT1218.011 · Rundll32T1070.001 · Clear Windows Event LogsTA0006 · Credential Access+3
Florian Roth (Nextron Systems)+1Wed Jan 162017