[Emerging-Sigs] Interesting Lateral Movement Sigs (not mine)

Kevin Ross kevross33 at googlemail.com
Mon Aug 5 02:20:53 HDT 2019


I found these and they seem to work well
https://github.com/MrAnde7son/Snort/blob/master/local.rules. It might be
worth with necessary permission seeing if some can be adapted for ET

Some already exist but there is things like WMI remote code execution,
remote at jobs, registry etc. that would be great to have in standard
ruleset if possible.

Kind Regards,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20190805/b3b57339/attachment.html>

More information about the Emerging-sigs mailing list