Detection rules › Sigma
Suspicious Application Installed
Detects suspicious application installed by looking at the added shortcut to the app resolver cache
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Shell-Core | 28115 | Shortcut for application Name with ID AppID and flags Flags is added to app resolver cache. |
Stages and Predicates
Stage 1: 1 of selection_name
or:
Name|contains: AnyDesk
Name|contains: Zenmap
Name|contains: openvpn
Name|contains: wireshark
Stage 2: 1 of selection_packageid
or:
AppID|contains: openvpn
AppID|contains: 'prokzult ad'
AppID|contains: wireshark
AppID|contains: zenmap.exe
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
AppID | match |
|
Name | match |
|