add sdbinst.exe to shimming rule

mandiant · Nov 13, 2024 · d95d7b6 · d95d7b6
1 parent f23aaa7
commit d95d7b6
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/nursery/persist-via-application-shimming.yml b/nursery/persist-via-application-shimming.yml
@@ -23,3 +23,6 @@ rule:
           - match: move file
           - match: host-interaction/file-system/write
         - string: /.sdb/i
+      - and:
+        - match: host-interaction/process/create
+        - string: /sdbinst(|\.exe) /i