From 8e24e6aa8226a2bb12abbefb3aac67167b26fe5a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 17 Aug 2025 20:15:15 +0000 Subject: [PATCH] Sigma Rule Update (2025-08-17 20:15:09) (#93) Co-authored-by: YamatoSecurity --- config/security_rules.json | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/config/security_rules.json b/config/security_rules.json index e19b2d60..f0827005 100644 --- a/config/security_rules.json +++ b/config/security_rules.json @@ -33964,6 +33964,23 @@ ], "title": "Potential Exploitation of RCE Vulnerability CVE-2025-33053" }, + { + "category": "process_creation", + "channel": [ + "sec" + ], + "description": "Detects potential exploitation of CVE-2025-53770 by identifying indicators such as suspicious command lines discovered in Post-Exploitation activities.\nCVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.\n", + "event_ids": [ + "4688" + ], + "id": "acecfe24-cf2a-2635-dded-a45c357eea3f", + "level": "high", + "service": "", + "subcategory_guids": [ + "0CCE922B-69AE-11D9-BED3-505054503030" + ], + "title": "Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators" + }, { "category": "process_creation", "channel": [