Incident Response Tip ⚡
When you need to open a file in a text editor to inspect its raw data during an investigation, here are 4 useful #VScode plugins to inspect different non-binary file types.
A thread 🧵
e.g. Emotet uses Word documents so you can extend the rule to include detection of cmd processes that execute Word, Excel, and PowerPoint. This way the detection will cover other variants of the threat.
A good example of a rule that covers more variants of shell execution by Office software from Sigma's repo is called proc_creation_win_office_shell.yml github.com/SigmaHQ/sigma/…