-
-
Notifications
You must be signed in to change notification settings - Fork 2.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
False Detections with Invoke-Obfuscation and Null Bytes #4875
Comments
Welcome @KDot227 👋 It looks like this is your first issue on the Sigma rules repository! The following repository accepts issues related to If you're reporting an issue related to the pySigma library please consider submitting it here If you're reporting an issue related to the deprecated sigmac library please consider submitting it here Thanks for taking the time to open this issue, and welcome to the Sigma community! 😃 |
Hey, thanks for reporting this.
While its a very "weak" regex its still in the logic of the rule. I would try to look into this more to try and enhance it. In the worst case this would be transferred to the threat hunting folder to set FP appetite correctly. Thanks |
Rule UUID
f3a98ce4-6164-4dd4-867c-4d83de7eca51
Example EventLog
I found this off virus total lol
Description
Script Block is
False code detected is:
Similar code it's meant to detect:
It's looking for obfuscating text but mistaking null bytes as obfuscated text.
The text was updated successfully, but these errors were encountered: