CSEC_PUBLIC/WELA
1
0
Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2025-12-06 09:12:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Sigma Rule Update (2025-06-13 20:15:14) (#80)

Browse Source 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
This commit is contained in:
github-actions[bot]
2025-06-13 20:15:21 +00:00
committed by GitHub
parent 715122f78e
commit b01c018634
1 changed files with 34 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
config/security_rules.json
View File

@@ -5652,6 +5652,23 @@
],
"title": "Suspicious Spool Service Child Process"
},
{
"category": "process_creation",
"channel": [
"sec"
],
"description": "Detects attempts to query system information directly from the Windows Registry.",
"event_ids": [
"4688"
],
"id": "62c2be2f-ba0e-142b-7bf8-cf4b2b8a6bf5",
"level": "low",
"service": "",
"subcategory_guids": [
"0CCE922B-69AE-11D9-BED3-505054503030"
],
"title": "System Information Discovery via Registry Queries"
},
{
"category": "process_creation",
"channel": [
@@ -17212,6 +17229,23 @@
],
"title": "Verclsid.exe Runs COM Object"
},
{
"category": "process_creation",
"channel": [
"sec"
],
"description": "Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments.\nSuccessful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.\n",
"event_ids": [
"4688"
],
"id": "b0559eb5-33e0-09c4-c9bb-88007b5981ca",
"level": "high",
"service": "",
"subcategory_guids": [
"0CCE922B-69AE-11D9-BED3-505054503030"
],
"title": "HKTL - SharpSuccessor Privilege Escalation Tool Execution"
},
{
"category": "process_creation",
"channel": [