CSEC_PUBLIC/WELA
1
0
Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2025-12-22 00:43:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

Sigma Rule Update (2025-08-15 20:15:15) (#92)

Browse Source 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
This commit is contained in:
github-actions[bot]
2025-08-15 20:15:21 +00:00
committed by GitHub
parent 811aee9bae
commit bf52184176
1 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
config/security_rules.json
View File

@@ -5420,7 +5420,7 @@
"subcategory_guids": [ "subcategory_guids": [
"0CCE922B-69AE-11D9-BED3-505054503030" "0CCE922B-69AE-11D9-BED3-505054503030"
], ],
"title": "Detect Virtualbox Driver Installation OR Starting Of VMs" "title": "Virtualbox Driver Installation or Starting of VMs"
}, },
{ {
"category": "process_creation", "category": "process_creation",
@@ -9706,6 +9706,23 @@
], ],
"title": "Python Function Execution Security Warning Disabled In Excel" "title": "Python Function Execution Security Warning Disabled In Excel"
}, },
{
"category": "process_creation",
"channel": [
"sec"
],
"description": "Detects attempts to disable windows recovery environment using Reagentc.\nReAgentc.exe is a command-line tool in Windows used to manage the Windows Recovery Environment (WinRE).\nIt allows users to enable, disable, and configure WinRE, which is used for troubleshooting and repairing common boot issues.\n",
"event_ids": [
"4688"
],
"id": "7e941643-69fc-290f-3b49-eee5d24adde8",
"level": "medium",
"service": "",
"subcategory_guids": [
"0CCE922B-69AE-11D9-BED3-505054503030"
],
"title": "Windows Recovery Environment Disabled Via Reagentc"
},
{ {
"category": "process_creation", "category": "process_creation",
"channel": [ "channel": [