From 41f5d6f33b9a7d536c373da215a7dff08d00068e Mon Sep 17 00:00:00 2001 From: securepeacock <92804416+securepeacock@users.noreply.github.com> Date: Thu, 29 Dec 2022 00:15:31 -0500 Subject: [PATCH] Update VisualUiaVerifyNative.yml with Sigma (#224) * Update VisualUiaVerifyNative.yml * Update acknowledgement * Update VisualUiaVerifyNative.yml * fix line feed issue after conflict * fix line feed issue after conflict * fix line feed issue after conflict * fix line feed issue after conflict Co-authored-by: bohops --- yml/OtherMSBinaries/VisualUiaVerifyNative.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/yml/OtherMSBinaries/VisualUiaVerifyNative.yml b/yml/OtherMSBinaries/VisualUiaVerifyNative.yml index b2d3380..fd6d7ac 100644 --- a/yml/OtherMSBinaries/VisualUiaVerifyNative.yml +++ b/yml/OtherMSBinaries/VisualUiaVerifyNative.yml @@ -1,4 +1,3 @@ ---- Name: VisualUiaVerifyNative.exe Description: A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls. Author: Jimmy (@bohops) @@ -19,6 +18,7 @@ Code_Sample: - Code: Detection: - BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules + - Sigma: https://github.com/SigmaHQ/sigma/blob/6b34764215b0e97e32cbc4c6325fc933d2695c3a/rules/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml - IOC: As a Windows SDK binary, execution on a system may be suspicious Resources: - Link: https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/