CSEC_PUBLIC/WELA
1
0
Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-05-09 04:42:35 +02:00
Code Issues Packages Projects Releases Wiki Activity

Sigma Rule Update (2026-04-28 21:01:56)

Browse Source
This commit is contained in:
YamatoSecurity
2026-04-28 21:01:56 +00:00
committed by GitHub
parent 0028fce0a9
commit a4fde6a90f
1 changed files with 208 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/security_rules.json
+208 -139
View File
@@ -210,8 +210,8 @@
"car.2013-09-005",
"T1543.003",
"T1569.002",
"T1543",
"T1569"
"T1569",
"T1543"
],
"title": "Malicious Service Installations"
},
@@ -503,8 +503,8 @@
"T1570",
"TA0002",
"T1569.002",
"T1021",
"T1569"
"T1569",
"T1021"
],
"title": "Metasploit Or Impacket Service Installation Via SMB PsExec"
},
@@ -920,8 +920,8 @@
"TA0005",
"T1562.001",
"T1070.001",
"T1070",
"T1562"
"T1562",
"T1070"
],
"title": "Suspicious Windows Trace ETW Session Tamper Via Logman.EXE"
},
@@ -987,9 +987,9 @@
"TA0005",
"T1218.014",
"T1036.002",
"T1218",
"T1204",
"T1036",
"T1204"
"T1218"
],
"title": "MMC Executing Files with Reversed Extensions Using RTLO Abuse"
},
@@ -1835,8 +1835,8 @@
"T1218.010",
"TA0002",
"TA0005",
"T1204",
"T1218"
"T1218",
"T1204"
],
"title": "Suspicious WMIC Execution Via Office Process"
},
@@ -2666,8 +2666,8 @@
"TA0002",
"T1059.007",
"cve.2020-1599",
"T1059",
"T1218"
"T1218",
"T1059"
],
"title": "MSHTA Execution with Suspicious File Extensions"
},
@@ -3996,8 +3996,8 @@
"TA0004",
"T1055.001",
"T1218.013",
"T1055",
"T1218"
"T1218",
"T1055"
],
"title": "Mavinject Inject DLL Into Running Process"
},
@@ -4582,8 +4582,8 @@
"T1047",
"T1204.002",
"T1218.010",
"T1218",
"T1204"
"T1204",
"T1218"
],
"title": "Suspicious WmiPrvSE Child Process"
},
@@ -5351,8 +5351,8 @@
"T1133",
"T1136.001",
"T1021.001",
"T1136",
"T1021"
"T1021",
"T1136"
],
"title": "User Added to Remote Desktop Users Group"
},
@@ -5500,8 +5500,8 @@
"T1563.002",
"T1021.001",
"car.2013-07-002",
"T1563",
"T1021"
"T1021",
"T1563"
],
"title": "Suspicious RDP Redirect Using TSCON"
},
@@ -7485,8 +7485,8 @@
"TA0004",
"T1543.003",
"T1562.001",
"T1543",
"T1562"
"T1562",
"T1543"
],
"title": "Devcon Execution Disabling VMware VMCI Device"
},
@@ -7562,8 +7562,8 @@
"car.2013-08-001",
"T1053.005",
"T1059.001",
"T1053",
"T1059"
"T1059",
"T1053"
],
"title": "HackTool - Default PowerSploit/Empire Scheduled Task Creation"
},
@@ -8017,8 +8017,8 @@
"T1558.003",
"TA0008",
"T1550.003",
"T1558",
"T1550"
"T1550",
"T1558"
],
"title": "HackTool - KrbRelayUp Execution"
},
@@ -8629,9 +8629,9 @@
"TA0005",
"T1218.005",
"T1027.004",
"T1027",
"T1059",
"T1218"
"T1218",
"T1027"
],
"title": "Csc.EXE Execution Form Potentially Suspicious Parent"
},
@@ -8773,8 +8773,8 @@
"TA0002",
"T1059.001",
"T1218",
"T1059",
"T1027"
"T1027",
"T1059"
],
"title": "Obfuscated PowerShell MSI Install via WindowsInstaller COM"
},
@@ -10517,9 +10517,9 @@
"TA0011",
"T1071.004",
"T1132.001",
"T1048",
"T1071",
"T1132",
"T1071"
"T1048"
],
"title": "DNS Exfiltration and Tunneling Tools Execution"
},
@@ -11050,8 +11050,8 @@
"T1564.004",
"T1552.001",
"T1105",
"T1564",
"T1552"
"T1552",
"T1564"
],
"title": "Insensitive Subfolder Search Via Findstr.EXE"
},
@@ -11776,6 +11776,27 @@
],
"title": "Sysmon Configuration Update"
},
{
"category": "process_creation",
"channel": [
"sec"
],
"description": "Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter.\nThreat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.\n",
"event_ids": [
"4688"
],
"id": "68c735c2-b61f-e870-2049-07bb43817230",
"level": "medium",
"service": "",
"subcategory_guids": [
"0CCE922B-69AE-11D9-BED3-505054503030"
],
"tags": [
"TA0005",
"T1202"
],
"title": "Indirect Command Execution via SFTP ProxyCommand"
},
{
"category": "process_creation",
"channel": [
@@ -12381,8 +12402,8 @@
"T1587.001",
"TA0002",
"T1569.002",
"T1587",
"T1569"
"T1569",
"T1587"
],
"title": "PUA - CsExec Execution"
},
@@ -12647,8 +12668,8 @@
"T1218.011",
"TA0006",
"T1003.001",
"T1218",
"T1003"
"T1003",
"T1218"
],
"title": "Process Access via TrolleyExpress Exclusion"
},
@@ -13395,8 +13416,8 @@
"TA0002",
"T1552.004",
"T1059.001",
"T1059",
"T1552"
"T1552",
"T1059"
],
"title": "Certificate Exported Via PowerShell"
},
@@ -14422,8 +14443,8 @@
"T1059.001",
"T1059.003",
"T1564.003",
"T1059",
"T1564"
"T1564",
"T1059"
],
"title": "Powershell Executed From Headless ConHost Process"
},
@@ -15140,8 +15161,8 @@
"TA0004",
"T1036.003",
"T1053.005",
"T1053",
"T1036"
"T1036",
"T1053"
],
"title": "Renamed Schtasks Execution"
},
@@ -15907,8 +15928,8 @@
"TA0002",
"T1059.001",
"T1562.001",
"T1562",
"T1059"
"T1059",
"T1562"
],
"title": "Obfuscated PowerShell OneLiner Execution"
},
@@ -16400,8 +16421,8 @@
"T1570",
"TA0002",
"T1569.002",
"T1021",
"T1569"
"T1569",
"T1021"
],
"title": "Rundll32 Execution Without Parameters"
},
@@ -16855,8 +16876,8 @@
"T1069.002",
"TA0002",
"T1059.001",
"T1087",
"T1069",
"T1087",
"T1059"
],
"title": "HackTool - Bloodhound/Sharphound Execution"
@@ -18461,6 +18482,30 @@
],
"title": "Potential Arbitrary DLL Load Using Winword"
},
{
"category": "process_creation",
"channel": [
"sec"
],
"description": "Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.\n",
"event_ids": [
"4688"
],
"id": "64fa414d-b58f-a5a5-82e1-4ec381a95b01",
"level": "medium",
"service": "",
"subcategory_guids": [
"0CCE922B-69AE-11D9-BED3-505054503030"
],
"tags": [
"TA0002",
"T1047",
"TA0005",
"T1562.001",
"T1562"
],
"title": "Service Startup Type Change Via Wmic.EXE"
},
{
"category": "process_creation",
"channel": [
@@ -18964,8 +19009,8 @@
"T1021.004",
"TA0011",
"T1219",
"T1021",
"T1059"
"T1059",
"T1021"
],
"title": "OpenEDR Spawning Command Shell"
},
@@ -19413,8 +19458,8 @@
"TA0003",
"T1543.003",
"T1574.011",
"T1543",
"T1574"
"T1574",
"T1543"
],
"title": "Potential Persistence Attempt Via Existing Service Tampering"
},
@@ -19617,11 +19662,11 @@
"T1557",
"T1082",
"T1574",
"T1564",
"T1546",
"T1556",
"T1505",
"T1547",
"T1564"
"T1556"
],
"title": "Potential Suspicious Activity Using SeCEdit"
},
@@ -20087,8 +20132,8 @@
"T1615",
"T1569.002",
"T1574.005",
"T1569",
"T1574"
"T1574",
"T1569"
],
"title": "HackTool - SharpUp PrivEsc Tool Execution"
},
@@ -20429,8 +20474,8 @@
"T1059.001",
"TA0005",
"T1027.005",
"T1027",
"T1059"
"T1059",
"T1027"
],
"title": "HackTool - CrackMapExec PowerShell Obfuscation"
},
@@ -20983,8 +21028,8 @@
"T1558.003",
"TA0008",
"T1550.003",
"T1550",
"T1558"
"T1558",
"T1550"
],
"title": "HackTool - Rubeus Execution"
},
@@ -23023,6 +23068,30 @@
],
"title": "Regedit as Trusted Installer"
},
{
"category": "process_creation",
"channel": [
"sec"
],
"description": "Detects execution of MemProcFS a memory forensics tool with the '-device' parameter.\nMemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.\nThreat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.\nMemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.\n",
"event_ids": [
"4688"
],
"id": "b917462b-c064-bd73-d45d-334fc43567be",
"level": "high",
"service": "",
"subcategory_guids": [
"0CCE922B-69AE-11D9-BED3-505054503030"
],
"tags": [
"TA0006",
"T1003",
"T1003.001",
"T1003.004",
"T1003.002"
],
"title": "PUA - Memory Dump Mount Via MemProcFS"
},
{
"category": "process_creation",
"channel": [
@@ -27544,8 +27613,8 @@
"T1059.005",
"T1105",
"detection.emerging-threats",
"T1059",
"T1195"
"T1195",
"T1059"
],
"title": "Axios NPM Compromise Indicators - Windows"
},
@@ -27976,8 +28045,8 @@
"T1059.001",
"attack.s0183",
"detection.emerging-threats",
"T1059",
"T1071"
"T1071",
"T1059"
],
"title": "Kalambur Backdoor Curl TOR SOCKS Proxy Execution"
},
@@ -28437,8 +28506,8 @@
"T1552.001",
"T1003.003",
"detection.emerging-threats",
"T1003",
"T1552"
"T1552",
"T1003"
],
"title": "Potential Russian APT Credential Theft Activity"
},
@@ -28516,8 +28585,8 @@
"T1053.005",
"T1059.001",
"detection.emerging-threats",
"T1053",
"T1036",
"T1053",
"T1059"
],
"title": "Operation Wocao Activity"
@@ -28549,9 +28618,9 @@
"T1053.005",
"T1059.001",
"detection.emerging-threats",
"T1059",
"T1053",
"T1036",
"T1053"
"T1059"
],
"title": "Operation Wocao Activity - Security"
},
@@ -28606,8 +28675,8 @@
"T1566.001",
"cve.2017-11882",
"detection.emerging-threats",
"T1566",
"T1204"
"T1204",
"T1566"
],
"title": "Droppers Exploiting CVE-2017-11882"
},
@@ -28661,8 +28730,8 @@
"T1543.003",
"T1569.002",
"detection.emerging-threats",
"T1543",
"T1569"
"T1569",
"T1543"
],
"title": "CosmicDuke Service Installation"
},
@@ -28742,9 +28811,9 @@
"T1003.001",
"car.2016-04-002",
"detection.emerging-threats",
"T1070",
"T1003",
"T1218",
"T1003"
"T1070"
],
"title": "NotPetya Ransomware Activity"
},
@@ -29165,8 +29234,8 @@
"T1053.005",
"T1059.006",
"detection.emerging-threats",
"T1053",
"T1059"
"T1059",
"T1053"
],
"title": "Serpent Backdoor Payload Execution Via Scheduled Task"
},
@@ -29795,8 +29864,8 @@
"TA0005",
"T1036.005",
"detection.emerging-threats",
"T1036",
"T1059"
"T1059",
"T1036"
],
"title": "Greenbug Espionage Group Indicators"
},
@@ -30125,9 +30194,9 @@
"TA0011",
"T1071.004",
"detection.emerging-threats",
"T1543",
"T1071",
"T1053"
"T1053",
"T1543"
],
"title": "OilRig APT Activity"
},
@@ -30160,9 +30229,9 @@
"TA0011",
"T1071.004",
"detection.emerging-threats",
"T1543",
"T1071",
"T1053",
"T1543"
"T1053"
],
"title": "OilRig APT Schedule Task Persistence - Security"
},
@@ -30194,9 +30263,9 @@
"TA0011",
"T1071.004",
"detection.emerging-threats",
"T1071",
"T1053",
"T1543",
"T1071"
"T1543"
],
"title": "OilRig APT Registry Persistence"
},
@@ -30226,8 +30295,8 @@
"TA0011",
"T1071.004",
"detection.emerging-threats",
"T1543",
"T1053",
"T1543",
"T1071"
],
"title": "OilRig APT Schedule Task Persistence - System"
@@ -34208,9 +34277,9 @@
"T1021.002",
"T1543.003",
"T1569.002",
"T1021",
"T1543",
"T1569"
"T1569",
"T1021"
],
"title": "Potential CobaltStrike Service Installations - Registry"
},
@@ -34565,8 +34634,8 @@
"T1204.004",
"TA0005",
"T1027.010",
"T1027",
"T1204"
"T1204",
"T1027"
],
"title": "Suspicious Space Characters in TypedPaths Registry Path - FileFix"
},
@@ -35406,8 +35475,8 @@
"TA0003",
"T1547.001",
"T1546.009",
"T1546",
"T1547"
"T1547",
"T1546"
],
"title": "Session Manager Autorun Keys Modification"
},
@@ -40404,8 +40473,8 @@
"T1059.001",
"TA0008",
"T1021.006",
"T1021",
"T1059"
"T1059",
"T1021"
],
"title": "Remote PowerShell Session (PS Module)"
},
@@ -41387,8 +41456,8 @@
"T1059.005",
"T1059.006",
"T1059.007",
"T1059",
"T1204"
"T1204",
"T1059"
],
"title": "AppLocker Prevented Application or Script from Running"
},
@@ -42857,8 +42926,8 @@
"T1021.002",
"T1543.003",
"T1569.002",
"T1569",
"T1543",
"T1569",
"T1021"
],
"title": "CobaltStrike Service Installations - System"
@@ -42906,8 +42975,8 @@
"T1003.006",
"T1569.002",
"attack.s0005",
"T1003",
"T1569"
"T1569",
"T1003"
],
"title": "Credential Dumping Tools Service Execution - System"
},
@@ -43249,8 +43318,8 @@
"TA0004",
"T1543.003",
"T1569.002",
"T1569",
"T1543"
"T1543",
"T1569"
],
"title": "Sliver C2 Default Service Installation"
},
@@ -44841,8 +44910,8 @@
"T1071.004",
"TA0002",
"T1059.003",
"T1059",
"T1071"
"T1071",
"T1059"
],
"title": "Network Connection Initiated via Finger.EXE"
},
@@ -44909,8 +44978,8 @@
"T1559.001",
"TA0005",
"T1218.010",
"T1218",
"T1559"
"T1559",
"T1218"
],
"title": "Network Connection Initiated By Regsvr32.EXE"
},
@@ -45093,8 +45162,8 @@
"TA0001",
"TA0043",
"detection.threat-hunting",
"T1566",
"T1598"
"T1598",
"T1566"
],
"title": "HTML File Opened From Download Folder"
},
@@ -45479,8 +45548,8 @@
"T1059.001",
"T1027.010",
"detection.threat-hunting",
"T1059",
"T1027"
"T1027",
"T1059"
],
"title": "Invocation Of Crypto-Classes From The \"Cryptography\" PowerShell Namespace"
},
@@ -45808,8 +45877,8 @@
"attack.s0039",
"detection.threat-hunting",
"T1087",
"T1021",
"T1069"
"T1069",
"T1021"
],
"title": "Net.EXE Execution"
},
@@ -46383,9 +46452,9 @@
"T1027.010",
"T1547.001",
"detection.threat-hunting",
"T1027",
"T1547",
"T1059",
"T1547"
"T1027"
],
"title": "Registry Set With Crypto-Classes From The \"Cryptography\" PowerShell Namespace"
},
@@ -46585,8 +46654,8 @@
"TA0009",
"T1114.003",
"detection.threat-hunting",
"T1564",
"T1114"
"T1114",
"T1564"
],
"title": "Inbox Rules Creation Or Update Activity Via ExchangePowerShell Cmdlet"
},
@@ -46612,8 +46681,8 @@
"TA0010",
"T1020",
"detection.threat-hunting",
"T1114",
"T1564"
"T1564",
"T1114"
],
"title": "Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdlet"
},
@@ -47069,8 +47138,8 @@
"T1087.002",
"T1069.002",
"attack.s0039",
"T1087",
"T1069"
"T1069",
"T1087"
],
"title": "Reconnaissance Activity"
},
@@ -47388,8 +47457,8 @@
"T1003.006",
"T1569.002",
"attack.s0005",
"T1003",
"T1569"
"T1569",
"T1003"
],
"title": "Credential Dumping Tools Service Execution - Security"
},
@@ -47553,8 +47622,8 @@
"TA0002",
"T1543.003",
"T1569.002",
"T1569",
"T1543"
"T1543",
"T1569"
],
"title": "Remote Access Tool Services Have Been Installed - Security"
},
@@ -48055,8 +48124,8 @@
"T1090.002",
"T1021.001",
"car.2013-07-002",
"T1021",
"T1090"
"T1090",
"T1021"
],
"title": "RDP over Reverse SSH Tunnel WFP"
},
@@ -48477,8 +48546,8 @@
"T1570",
"TA0002",
"T1569.002",
"T1021",
"T1569"
"T1569",
"T1021"
],
"title": "Metasploit Or Impacket Service Installation Via SMB PsExec"
},
@@ -49421,9 +49490,9 @@
"T1021.002",
"T1543.003",
"T1569.002",
"T1569",
"T1543",
"T1021",
"T1569"
"T1021"
],
"title": "CobaltStrike Service Installations - Security"
},
@@ -50671,8 +50740,8 @@
"T1218.010",
"TA0002",
"TA0005",
"T1218",
"T1204"
"T1204",
"T1218"
],
"title": "Excel Proxy Executing Regsvr32 With Payload"
},
@@ -51161,8 +51230,8 @@
"T1218.010",
"TA0002",
"TA0005",
"T1218",
"T1204"
"T1204",
"T1218"
],
"title": "Office Applications Spawning Wmi Cli Alternate"
},
@@ -55028,8 +55097,8 @@
"TA0008",
"T1563.002",
"T1021.001",
"T1021",
"T1563"
"T1563",
"T1021"
],
"title": "Possible RDP Hijacking"
},
@@ -55275,10 +55344,10 @@
"T1570",
"T1021.002",
"T1569.002",
"T1543",
"T1569",
"T1136",
"T1021",
"T1569"
"T1543",
"T1021"
],
"title": "PSExec Lateral Movement"
},