Add OriginalFileName to Name regex search for better hunting (#2895)

Added OriginalFileName OR EntryName into filter to improve hunting results on renamed binaries.
Velocidex · Aug 16, 2023 · 1bcea3c · 1bcea3c
1 parent c7d4cfb
commit 1bcea3c
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/artifacts/definitions/Windows/Detection/Amcache.yaml b/artifacts/definitions/Windows/Detection/Amcache.yaml
@@ -13,7 +13,7 @@ description: |
 
       - SHA1regex - regex entries to filter by SHA1.
       - PathRegex - filter on path if available.
-      - NameRegex - filter on EntryName / binary.
+      - NameRegex - filter on EntryName OR OriginalFileName.
 
     NOTE:
 
@@ -109,9 +109,9 @@ sources:
                     WHERE SHA1
                         AND SHA1 =~ SHA1Regex
                         AND if(condition= NameRegex,
-                            then= EntryName =~ NameRegex,
-                            else= True)
+                                then= EntryName =~ NameRegex OR OriginalFileName =~ NameRegex,
+                                else= True)
                         AND if(condition= PathRegex,
                             then= EntryPath =~ PathRegex,
                             else= True)
-            })
+            })