Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Python DLL sideloading #5031

Merged
merged 7 commits into from
Oct 6, 2024
Merged

Python DLL sideloading #5031

merged 7 commits into from
Oct 6, 2024
+43 −0

Conversation

swachchhanda000
Copy link
Contributor

@swachchhanda000 swachchhanda000 commented Oct 2, 2024 •
edited by nasbench
Loading

Summary of the Pull Request

Add Potential Python DLL SideLoading

Changelog

new: Potential Python DLL SideLoading

Example Log Event

N/A

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

  • If your PR adds new rules, please consider following and applying these conventions

@github-actions github-actions bot added Rules Windows Pull request add/update windows related rules labels Oct 2, 2024
@swachchhanda000 swachchhanda000 force-pushed the masqueraded-python branch 2 times, most recently from 66ad654 to a82002d Compare October 2, 2024 08:32
nasbench
nasbench approved these changes Oct 6, 2024
View reviewed changes
Copy link
Member

@nasbench nasbench left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I made some changes to the logic and metadata,

  • Reduced the level to "medium" as Python is often times installed in non default locations. So a lot of FP will be generated without a good baseline
  • Added some other known (optional) locations

@nasbench nasbench merged commit d1f1fc7 into SigmaHQ:master Oct 6, 2024
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@frack113 frack113 frack113 left review comments

@nasbench nasbench nasbench approved these changes

Assignees
No one assigned
Labels
Rules Windows Pull request add/update windows related rules
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@swachchhanda000 @nasbench @frack113