CSEC_PUBLIC/WELA
1
0
Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2025-12-06 17:22:50 +01:00
Code Issues Packages Projects Releases Wiki Activity

Sigma Rule Update (2025-11-01 20:13:20) (#137)

Browse Source 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
This commit is contained in:
github-actions[bot]
2025-11-01 20:13:26 +00:00
committed by GitHub
parent 9997d976d4
commit 84e21e43cd
1 changed files with 106 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files

212
config/security_rules.json
View File

@@ -344,8 +344,8 @@
"T1059.001", "T1059.001",
"TA0008", "TA0008",
"T1021.003", "T1021.003",
"T1059", "T1021",
"T1021" "T1059"
], ],
"title": "Suspicious Non PowerShell WSMAN COM Provider" "title": "Suspicious Non PowerShell WSMAN COM Provider"
}, },
@@ -424,8 +424,8 @@
"T1059.001", "T1059.001",
"TA0008", "TA0008",
"T1021.006", "T1021.006",
"T1021", "T1059",
"T1059" "T1021"
], ],
"title": "Remote PowerShell Session (PS Classic)" "title": "Remote PowerShell Session (PS Classic)"
}, },
@@ -1149,8 +1149,8 @@
"T1529", "T1529",
"attack.g0091", "attack.g0091",
"attack.s0363", "attack.s0363",
"T1071", "T1059",
"T1059" "T1071"
], ],
"title": "Silence.EDA Detection" "title": "Silence.EDA Detection"
}, },
@@ -2637,8 +2637,8 @@
"T1564.004", "T1564.004",
"TA0002", "TA0002",
"T1059.001", "T1059.001",
"T1059", "T1564",
"T1564" "T1059"
], ],
"title": "NTFS Alternate Data Stream" "title": "NTFS Alternate Data Stream"
}, },
@@ -4350,8 +4350,8 @@
"T1059.001", "T1059.001",
"TA0008", "TA0008",
"T1021.006", "T1021.006",
"T1021", "T1059",
"T1059" "T1021"
], ],
"title": "Remote PowerShell Session (PS Module)" "title": "Remote PowerShell Session (PS Module)"
}, },
@@ -4962,8 +4962,8 @@
"T1552.001", "T1552.001",
"T1555", "T1555",
"T1555.003", "T1555.003",
"T1552", "T1548",
"T1548" "T1552"
], ],
"title": "HackTool - WinPwn Execution" "title": "HackTool - WinPwn Execution"
}, },
@@ -5531,9 +5531,9 @@
"T1218.007", "T1218.007",
"TA0002", "TA0002",
"T1059.001", "T1059.001",
"T1027",
"T1218", "T1218",
"T1059" "T1059",
"T1027"
], ],
"title": "Obfuscated PowerShell MSI Install via WindowsInstaller COM" "title": "Obfuscated PowerShell MSI Install via WindowsInstaller COM"
}, },
@@ -7322,8 +7322,8 @@
"T1482", "T1482",
"T1069.002", "T1069.002",
"stp.1u", "stp.1u",
"T1087", "T1069",
"T1069" "T1087"
], ],
"title": "PUA - AdFind Suspicious Execution" "title": "PUA - AdFind Suspicious Execution"
}, },
@@ -8558,8 +8558,8 @@
"TA0003", "TA0003",
"T1053.005", "T1053.005",
"T1059.001", "T1059.001",
"T1059", "T1053",
"T1053" "T1059"
], ],
"title": "Suspicious Schtasks Execution AppData Folder" "title": "Suspicious Schtasks Execution AppData Folder"
}, },
@@ -10033,8 +10033,8 @@
"T1087.002", "T1087.002",
"T1069.002", "T1069.002",
"T1482", "T1482",
"T1087", "T1069",
"T1069" "T1087"
], ],
"title": "Suspicious Active Directory Database Snapshot Via ADExplorer" "title": "Suspicious Active Directory Database Snapshot Via ADExplorer"
}, },
@@ -11189,8 +11189,8 @@
"TA0011", "TA0011",
"T1071.004", "T1071.004",
"T1132.001", "T1132.001",
"T1048",
"T1132", "T1132",
"T1048",
"T1071" "T1071"
], ],
"title": "DNS Exfiltration and Tunneling Tools Execution" "title": "DNS Exfiltration and Tunneling Tools Execution"
@@ -11532,8 +11532,8 @@
"car.2013-08-001", "car.2013-08-001",
"T1053.005", "T1053.005",
"T1059.001", "T1059.001",
"T1053", "T1059",
"T1059" "T1053"
], ],
"title": "HackTool - Default PowerSploit/Empire Scheduled Task Creation" "title": "HackTool - Default PowerSploit/Empire Scheduled Task Creation"
}, },
@@ -11737,8 +11737,8 @@
"T1047", "T1047",
"T1204.002", "T1204.002",
"T1218.010", "T1218.010",
"T1218", "T1204",
"T1204" "T1218"
], ],
"title": "Suspicious WmiPrvSE Child Process" "title": "Suspicious WmiPrvSE Child Process"
}, },
@@ -13318,8 +13318,8 @@
"T1087.002", "T1087.002",
"T1482", "T1482",
"T1069.002", "T1069.002",
"T1087", "T1069",
"T1069" "T1087"
], ],
"title": "Renamed AdFind Execution" "title": "Renamed AdFind Execution"
}, },
@@ -13636,8 +13636,8 @@
"T1587.001", "T1587.001",
"TA0002", "TA0002",
"T1569.002", "T1569.002",
"T1587", "T1569",
"T1569" "T1587"
], ],
"title": "PUA - CsExec Execution" "title": "PUA - CsExec Execution"
}, },
@@ -15721,8 +15721,8 @@
"T1203", "T1203",
"T1059.003", "T1059.003",
"attack.g0032", "attack.g0032",
"T1566", "T1059",
"T1059" "T1566"
], ],
"title": "Suspicious HWP Sub Processes" "title": "Suspicious HWP Sub Processes"
}, },
@@ -16590,8 +16590,8 @@
"T1087.002", "T1087.002",
"T1069.002", "T1069.002",
"T1482", "T1482",
"T1069", "T1087",
"T1087" "T1069"
], ],
"title": "Active Directory Database Snapshot Via ADExplorer" "title": "Active Directory Database Snapshot Via ADExplorer"
}, },
@@ -17963,8 +17963,8 @@
"TA0002", "TA0002",
"T1552.004", "T1552.004",
"T1059.001", "T1059.001",
"T1552", "T1059",
"T1059" "T1552"
], ],
"title": "Certificate Exported Via PowerShell" "title": "Certificate Exported Via PowerShell"
}, },
@@ -18216,8 +18216,8 @@
"TA0003", "TA0003",
"T1543.003", "T1543.003",
"T1574.011", "T1574.011",
"T1543", "T1574",
"T1574" "T1543"
], ],
"title": "Potential Persistence Attempt Via Existing Service Tampering" "title": "Potential Persistence Attempt Via Existing Service Tampering"
}, },
@@ -19836,8 +19836,8 @@
"TA0008", "TA0008",
"T1021.002", "T1021.002",
"T1218.011", "T1218.011",
"T1021", "T1218",
"T1218" "T1021"
], ],
"title": "Rundll32 UNC Path Execution" "title": "Rundll32 UNC Path Execution"
}, },
@@ -20861,9 +20861,9 @@
"TA0005", "TA0005",
"T1218.014", "T1218.014",
"T1036.002", "T1036.002",
"T1036",
"T1204", "T1204",
"T1218", "T1218"
"T1036"
], ],
"title": "MMC Executing Files with Reversed Extensions Using RTLO Abuse" "title": "MMC Executing Files with Reversed Extensions Using RTLO Abuse"
}, },
@@ -20992,8 +20992,8 @@
"TA0005", "TA0005",
"T1219.002", "T1219.002",
"T1036.003", "T1036.003",
"T1036", "T1219",
"T1219" "T1036"
], ],
"title": "Remote Access Tool - Renamed MeshAgent Execution - Windows" "title": "Remote Access Tool - Renamed MeshAgent Execution - Windows"
}, },
@@ -21418,12 +21418,12 @@
"T1547.002", "T1547.002",
"T1557", "T1557",
"T1082", "T1082",
"T1556",
"T1546",
"T1547", "T1547",
"T1574", "T1546",
"T1564",
"T1556",
"T1505", "T1505",
"T1564" "T1574"
], ],
"title": "Potential Suspicious Activity Using SeCEdit" "title": "Potential Suspicious Activity Using SeCEdit"
}, },
@@ -22275,8 +22275,8 @@
"TA0008", "TA0008",
"T1059.001", "T1059.001",
"T1021.006", "T1021.006",
"T1059", "T1021",
"T1021" "T1059"
], ],
"title": "Remote PowerShell Session Host Process (WinRM)" "title": "Remote PowerShell Session Host Process (WinRM)"
}, },
@@ -24022,8 +24022,8 @@
"T1558.003", "T1558.003",
"TA0008", "TA0008",
"T1550.003", "T1550.003",
"T1558", "T1550",
"T1550" "T1558"
], ],
"title": "HackTool - KrbRelayUp Execution" "title": "HackTool - KrbRelayUp Execution"
}, },
@@ -26171,9 +26171,9 @@
"T1069.002", "T1069.002",
"TA0002", "TA0002",
"T1059.001", "T1059.001",
"T1059",
"T1087", "T1087",
"T1069" "T1069",
"T1059"
], ],
"title": "HackTool - Bloodhound/Sharphound Execution" "title": "HackTool - Bloodhound/Sharphound Execution"
}, },
@@ -27260,8 +27260,8 @@
"T1106", "T1106",
"T1059.003", "T1059.003",
"T1218.011", "T1218.011",
"T1218", "T1059",
"T1059" "T1218"
], ],
"title": "HackTool - RedMimicry Winnti Playbook Execution" "title": "HackTool - RedMimicry Winnti Playbook Execution"
}, },
@@ -30134,8 +30134,8 @@
"T1559.001", "T1559.001",
"TA0005", "TA0005",
"T1218.010", "T1218.010",
"T1218", "T1559",
"T1559" "T1218"
], ],
"title": "Network Connection Initiated By Regsvr32.EXE" "title": "Network Connection Initiated By Regsvr32.EXE"
}, },
@@ -31492,8 +31492,8 @@
"attack.s0039", "attack.s0039",
"detection.threat-hunting", "detection.threat-hunting",
"T1069", "T1069",
"T1021", "T1087",
"T1087" "T1021"
], ],
"title": "Net.EXE Execution" "title": "Net.EXE Execution"
}, },
@@ -32273,9 +32273,9 @@
"T1027.010", "T1027.010",
"T1547.001", "T1547.001",
"detection.threat-hunting", "detection.threat-hunting",
"T1027",
"T1547", "T1547",
"T1059", "T1059"
"T1027"
], ],
"title": "Registry Set With Crypto-Classes From The \"Cryptography\" PowerShell Namespace" "title": "Registry Set With Crypto-Classes From The \"Cryptography\" PowerShell Namespace"
}, },
@@ -36671,9 +36671,9 @@
"T1021.002", "T1021.002",
"T1543.003", "T1543.003",
"T1569.002", "T1569.002",
"T1569",
"T1021", "T1021",
"T1543" "T1543",
"T1569"
], ],
"title": "Potential CobaltStrike Service Installations - Registry" "title": "Potential CobaltStrike Service Installations - Registry"
}, },
@@ -37248,8 +37248,8 @@
"TA0003", "TA0003",
"T1547.001", "T1547.001",
"T1546.009", "T1546.009",
"T1546", "T1547",
"T1547" "T1546"
], ],
"title": "Session Manager Autorun Keys Modification" "title": "Session Manager Autorun Keys Modification"
}, },
@@ -38125,8 +38125,8 @@
"T1566.001", "T1566.001",
"cve.2017-8759", "cve.2017-8759",
"detection.emerging-threats", "detection.emerging-threats",
"T1204", "T1566",
"T1566" "T1204"
], ],
"title": "Exploit for CVE-2017-8759" "title": "Exploit for CVE-2017-8759"
}, },
@@ -38181,8 +38181,8 @@
"T1566.001", "T1566.001",
"cve.2017-0261", "cve.2017-0261",
"detection.emerging-threats", "detection.emerging-threats",
"T1566", "T1204",
"T1204" "T1566"
], ],
"title": "Exploit for CVE-2017-0261" "title": "Exploit for CVE-2017-0261"
}, },
@@ -38239,8 +38239,8 @@
"T1003.001", "T1003.001",
"car.2016-04-002", "car.2016-04-002",
"detection.emerging-threats", "detection.emerging-threats",
"T1218",
"T1003", "T1003",
"T1218",
"T1070" "T1070"
], ],
"title": "NotPetya Ransomware Activity" "title": "NotPetya Ransomware Activity"
@@ -38542,8 +38542,8 @@
"TA0011", "TA0011",
"T1071.004", "T1071.004",
"detection.emerging-threats", "detection.emerging-threats",
"T1071",
"T1543", "T1543",
"T1071",
"T1053" "T1053"
], ],
"title": "OilRig APT Schedule Task Persistence - Security" "title": "OilRig APT Schedule Task Persistence - Security"
@@ -38576,9 +38576,9 @@
"TA0011", "TA0011",
"T1071.004", "T1071.004",
"detection.emerging-threats", "detection.emerging-threats",
"T1053", "T1543",
"T1071", "T1071",
"T1543" "T1053"
], ],
"title": "OilRig APT Registry Persistence" "title": "OilRig APT Registry Persistence"
}, },
@@ -38610,8 +38610,8 @@
"TA0011", "TA0011",
"T1071.004", "T1071.004",
"detection.emerging-threats", "detection.emerging-threats",
"T1543",
"T1053", "T1053",
"T1543",
"T1071" "T1071"
], ],
"title": "OilRig APT Activity" "title": "OilRig APT Activity"
@@ -38642,9 +38642,9 @@
"TA0011", "TA0011",
"T1071.004", "T1071.004",
"detection.emerging-threats", "detection.emerging-threats",
"T1071",
"T1543", "T1543",
"T1053", "T1053"
"T1071"
], ],
"title": "OilRig APT Schedule Task Persistence - System" "title": "OilRig APT Schedule Task Persistence - System"
}, },
@@ -39822,8 +39822,8 @@
"attack.s0412", "attack.s0412",
"attack.g0001", "attack.g0001",
"detection.emerging-threats", "detection.emerging-threats",
"T1059", "T1218",
"T1218" "T1059"
], ],
"title": "ZxShell Malware" "title": "ZxShell Malware"
}, },
@@ -41022,8 +41022,8 @@
"T1552.001", "T1552.001",
"T1003.003", "T1003.003",
"detection.emerging-threats", "detection.emerging-threats",
"T1003", "T1552",
"T1552" "T1003"
], ],
"title": "Potential Russian APT Credential Theft Activity" "title": "Potential Russian APT Credential Theft Activity"
}, },
@@ -41082,8 +41082,8 @@
"T1053.005", "T1053.005",
"T1059.001", "T1059.001",
"detection.emerging-threats", "detection.emerging-threats",
"T1053",
"T1036", "T1036",
"T1053",
"T1059" "T1059"
], ],
"title": "Operation Wocao Activity" "title": "Operation Wocao Activity"
@@ -41115,9 +41115,9 @@
"T1053.005", "T1053.005",
"T1059.001", "T1059.001",
"detection.emerging-threats", "detection.emerging-threats",
"T1036",
"T1053", "T1053",
"T1059" "T1059",
"T1036"
], ],
"title": "Operation Wocao Activity - Security" "title": "Operation Wocao Activity - Security"
}, },
@@ -44490,8 +44490,8 @@
"TA0002", "TA0002",
"T1543.003", "T1543.003",
"T1569.002", "T1569.002",
"T1569", "T1543",
"T1543" "T1569"
], ],
"title": "Remote Access Tool Services Have Been Installed - Security" "title": "Remote Access Tool Services Have Been Installed - Security"
}, },
@@ -44659,8 +44659,8 @@
"T1021.002", "T1021.002",
"T1543.003", "T1543.003",
"T1569.002", "T1569.002",
"T1021",
"T1543", "T1543",
"T1021",
"T1569" "T1569"
], ],
"title": "CobaltStrike Service Installations - Security" "title": "CobaltStrike Service Installations - Security"
@@ -45165,8 +45165,8 @@
"T1570", "T1570",
"TA0002", "TA0002",
"T1569.002", "T1569.002",
"T1021", "T1569",
"T1569" "T1021"
], ],
"title": "Metasploit Or Impacket Service Installation Via SMB PsExec" "title": "Metasploit Or Impacket Service Installation Via SMB PsExec"
}, },
@@ -45295,8 +45295,8 @@
"T1003.006", "T1003.006",
"T1569.002", "T1569.002",
"attack.s0005", "attack.s0005",
"T1003", "T1569",
"T1569" "T1003"
], ],
"title": "Credential Dumping Tools Service Execution - Security" "title": "Credential Dumping Tools Service Execution - Security"
}, },
@@ -46344,9 +46344,9 @@
"T1485", "T1485",
"T1553.002", "T1553.002",
"attack.s0195", "attack.s0195",
"T1070",
"T1027", "T1027",
"T1553" "T1553",
"T1070"
], ],
"title": "Potential Secure Deletion with SDelete" "title": "Potential Secure Deletion with SDelete"
}, },
@@ -46840,8 +46840,8 @@
"T1564.004", "T1564.004",
"T1552.001", "T1552.001",
"T1105", "T1105",
"T1564", "T1552",
"T1552" "T1564"
], ],
"title": "Abusing Findstr for Defense Evasion" "title": "Abusing Findstr for Defense Evasion"
}, },
@@ -46889,8 +46889,8 @@
"T1218.010", "T1218.010",
"TA0002", "TA0002",
"TA0005", "TA0005",
"T1204", "T1218",
"T1218" "T1204"
], ],
"title": "Excel Proxy Executing Regsvr32 With Payload" "title": "Excel Proxy Executing Regsvr32 With Payload"
}, },
@@ -47646,8 +47646,8 @@
"T1218.010", "T1218.010",
"TA0002", "TA0002",
"TA0005", "TA0005",
"T1204", "T1218",
"T1218" "T1204"
], ],
"title": "New Lolbin Process by Office Applications" "title": "New Lolbin Process by Office Applications"
}, },
@@ -49856,8 +49856,8 @@
"TA0002", "TA0002",
"T1543.003", "T1543.003",
"T1569.002", "T1569.002",
"T1543", "T1569",
"T1569" "T1543"
], ],
"title": "Remote Access Tool Services Have Been Installed - System" "title": "Remote Access Tool Services Have Been Installed - System"
}, },
@@ -50072,8 +50072,8 @@
"T1003.006", "T1003.006",
"T1569.002", "T1569.002",
"attack.s0005", "attack.s0005",
"T1569", "T1003",
"T1003" "T1569"
], ],
"title": "Credential Dumping Tools Service Execution - System" "title": "Credential Dumping Tools Service Execution - System"
}, },
@@ -51283,8 +51283,8 @@
"T1570", "T1570",
"TA0002", "TA0002",
"T1569.002", "T1569.002",
"T1569", "T1021",
"T1021" "T1569"
], ],
"title": "Metasploit Or Impacket Service Installation Via SMB PsExec" "title": "Metasploit Or Impacket Service Installation Via SMB PsExec"
}, },
@@ -53560,10 +53560,10 @@
"T1570", "T1570",
"T1021.002", "T1021.002",
"T1569.002", "T1569.002",
"T1569",
"T1136", "T1136",
"T1543", "T1543",
"T1021" "T1021",
"T1569"
], ],
"title": "PSExec Lateral Movement" "title": "PSExec Lateral Movement"
}, },