CSEC_PUBLIC/WELA
1
0
Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2025-12-08 10:12:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

Sigma Rule Update (2025-11-05 20:16:13) (#142)

Browse Source 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
This commit is contained in:
github-actions[bot]
2025-11-05 20:16:20 +00:00
committed by GitHub
parent 4aacbbf5cb
commit c983c5355c
1 changed files with 188 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files

301
config/security_rules.json
View File

@@ -287,8 +287,8 @@
"TA0005",
"T1059.001",
"T1036.003",
"T1036",
"T1059"
"T1059",
"T1036"
],
"title": "Renamed Powershell Under Powershell Channel"
},
@@ -1149,8 +1149,8 @@
"T1529",
"attack.g0091",
"attack.s0363",
"T1071",
"T1059"
"T1059",
"T1071"
],
"title": "Silence.EDA Detection"
},
@@ -1902,8 +1902,8 @@
"T1059.001",
"TA0003",
"T1136.001",
"T1136",
"T1059"
"T1059",
"T1136"
],
"title": "PowerShell Create Local User"
},
@@ -2637,8 +2637,8 @@
"T1564.004",
"TA0002",
"T1059.001",
"T1564",
"T1059"
"T1059",
"T1564"
],
"title": "NTFS Alternate Data Stream"
},
@@ -4838,8 +4838,8 @@
"T1059.005",
"T1059.006",
"T1059.007",
"T1204",
"T1059"
"T1059",
"T1204"
],
"title": "File Was Not Allowed To Run"
},
@@ -4991,8 +4991,8 @@
"T1615",
"T1569.002",
"T1574.005",
"T1569",
"T1574"
"T1574",
"T1569"
],
"title": "HackTool - SharpUp PrivEsc Tool Execution"
},
@@ -6179,8 +6179,8 @@
"TA0002",
"T1059.007",
"cve.2020-1599",
"T1218",
"T1059"
"T1059",
"T1218"
],
"title": "MSHTA Execution with Suspicious File Extensions"
},
@@ -6514,8 +6514,8 @@
"T1563.002",
"T1021.001",
"car.2013-07-002",
"T1021",
"T1563"
"T1563",
"T1021"
],
"title": "Suspicious RDP Redirect Using TSCON"
},
@@ -7322,8 +7322,8 @@
"T1482",
"T1069.002",
"stp.1u",
"T1069",
"T1087"
"T1087",
"T1069"
],
"title": "PUA - AdFind Suspicious Execution"
},
@@ -8558,8 +8558,8 @@
"TA0003",
"T1053.005",
"T1059.001",
"T1059",
"T1053"
"T1053",
"T1059"
],
"title": "Suspicious Schtasks Execution AppData Folder"
},
@@ -9416,8 +9416,8 @@
"T1564.004",
"T1552.001",
"T1105",
"T1552",
"T1564"
"T1564",
"T1552"
],
"title": "Remote File Download Via Findstr.EXE"
},
@@ -10033,8 +10033,8 @@
"T1087.002",
"T1069.002",
"T1482",
"T1087",
"T1069"
"T1069",
"T1087"
],
"title": "Suspicious Active Directory Database Snapshot Via ADExplorer"
},
@@ -10777,8 +10777,8 @@
"TA0005",
"T1548.002",
"T1218.003",
"T1548",
"T1218"
"T1218",
"T1548"
],
"title": "Bypass UAC via CMSTP"
},
@@ -11189,9 +11189,9 @@
"TA0011",
"T1071.004",
"T1132.001",
"T1071",
"T1132",
"T1048",
"T1071"
"T1048"
],
"title": "DNS Exfiltration and Tunneling Tools Execution"
},
@@ -11532,8 +11532,8 @@
"car.2013-08-001",
"T1053.005",
"T1059.001",
"T1053",
"T1059"
"T1059",
"T1053"
],
"title": "HackTool - Default PowerSploit/Empire Scheduled Task Creation"
},
@@ -12201,8 +12201,8 @@
"TA0005",
"T1059.001",
"T1564.003",
"T1059",
"T1564"
"T1564",
"T1059"
],
"title": "HackTool - Covenant PowerShell Launcher"
},
@@ -16279,8 +16279,8 @@
"T1059.001",
"TA0005",
"T1027.005",
"T1027",
"T1059"
"T1059",
"T1027"
],
"title": "HackTool - CrackMapExec PowerShell Obfuscation"
},
@@ -16590,8 +16590,8 @@
"T1087.002",
"T1069.002",
"T1482",
"T1087",
"T1069"
"T1069",
"T1087"
],
"title": "Active Directory Database Snapshot Via ADExplorer"
},
@@ -18031,8 +18031,8 @@
"T1218.011",
"TA0006",
"T1003.001",
"T1218",
"T1003"
"T1003",
"T1218"
],
"title": "Process Access via TrolleyExpress Exclusion"
},
@@ -18216,8 +18216,8 @@
"TA0003",
"T1543.003",
"T1574.011",
"T1543",
"T1574"
"T1574",
"T1543"
],
"title": "Potential Persistence Attempt Via Existing Service Tampering"
},
@@ -19410,8 +19410,8 @@
"T1059.001",
"T1059.003",
"T1564.003",
"T1564",
"T1059"
"T1059",
"T1564"
],
"title": "Powershell Executed From Headless ConHost Process"
},
@@ -20861,8 +20861,8 @@
"TA0005",
"T1218.014",
"T1036.002",
"T1218",
"T1204",
"T1218",
"T1036"
],
"title": "MMC Executing Files with Reversed Extensions Using RTLO Abuse"
@@ -20992,8 +20992,8 @@
"TA0005",
"T1219.002",
"T1036.003",
"T1036",
"T1219"
"T1219",
"T1036"
],
"title": "Remote Access Tool - Renamed MeshAgent Execution - Windows"
},
@@ -21418,12 +21418,12 @@
"T1547.002",
"T1557",
"T1082",
"T1505",
"T1546",
"T1547",
"T1556",
"T1574",
"T1564"
"T1546",
"T1564",
"T1547",
"T1505",
"T1574"
],
"title": "Potential Suspicious Activity Using SeCEdit"
},
@@ -22574,8 +22574,8 @@
"T1218.005",
"T1027.004",
"T1218",
"T1059",
"T1027"
"T1027",
"T1059"
],
"title": "Csc.EXE Execution Form Potentially Suspicious Parent"
},
@@ -23692,6 +23692,31 @@
],
"title": "Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)"
},
{
"category": "process_creation",
"channel": [
"sec"
],
"description": "Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection.\nClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar.\nThe victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.\n",
"event_ids": [
"4688"
],
"id": "ed6d814e-9b25-6213-526d-92e0d4cca625",
"level": "high",
"service": "",
"subcategory_guids": [
"0CCE922B-69AE-11D9-BED3-505054503030"
],
"tags": [
"TA0002",
"T1204.004",
"TA0005",
"T1027.010",
"T1204",
"T1027"
],
"title": "Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix"
},
{
"category": "process_creation",
"channel": [
@@ -24022,8 +24047,8 @@
"T1558.003",
"TA0008",
"T1550.003",
"T1558",
"T1550"
"T1550",
"T1558"
],
"title": "HackTool - KrbRelayUp Execution"
},
@@ -24204,8 +24229,8 @@
"TA0003",
"T1053.005",
"T1059.001",
"T1059",
"T1053"
"T1053",
"T1059"
],
"title": "Scheduled Task Executing Payload from Registry"
},
@@ -30958,8 +30983,8 @@
"T1059.001",
"T1027.010",
"detection.threat-hunting",
"T1059",
"T1027"
"T1027",
"T1059"
],
"title": "Invocation Of Crypto-Classes From The \"Cryptography\" PowerShell Namespace"
},
@@ -31492,8 +31517,8 @@
"attack.s0039",
"detection.threat-hunting",
"T1069",
"T1087",
"T1021"
"T1021",
"T1087"
],
"title": "Net.EXE Execution"
},
@@ -32274,8 +32299,8 @@
"T1547.001",
"detection.threat-hunting",
"T1059",
"T1547",
"T1027"
"T1027",
"T1547"
],
"title": "Registry Set With Crypto-Classes From The \"Cryptography\" PowerShell Namespace"
},
@@ -32801,8 +32826,8 @@
"TA0004",
"T1548.002",
"T1546.001",
"T1546",
"T1548"
"T1548",
"T1546"
],
"title": "Shell Open Registry Keys Manipulation"
},
@@ -33805,6 +33830,31 @@
],
"title": "ETW Logging Disabled In .NET Processes - Sysmon Registry"
},
{
"category": "registry_set",
"channel": [
"sec"
],
"description": "Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.\n",
"event_ids": [
"4657"
],
"id": "44b5abf5-fa3c-d623-20ee-7f8552f3b87c",
"level": "high",
"service": "",
"subcategory_guids": [
"0CCE921E-69AE-11D9-BED3-505054503030"
],
"tags": [
"TA0002",
"T1204.004",
"TA0005",
"T1027.010",
"T1204",
"T1027"
],
"title": "Suspicious Space Characters in RunMRU Registry Path - ClickFix"
},
{
"category": "registry_set",
"channel": [
@@ -35583,6 +35633,31 @@
],
"title": "Potential Persistence Via Scrobj.dll COM Hijacking"
},
{
"category": "registry_set",
"channel": [
"sec"
],
"description": "Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands.\n",
"event_ids": [
"4657"
],
"id": "8d0dc35f-6c19-c320-3d86-8bd087469dbe",
"level": "high",
"service": "",
"subcategory_guids": [
"0CCE921E-69AE-11D9-BED3-505054503030"
],
"tags": [
"TA0002",
"T1204.004",
"TA0005",
"T1027.010",
"T1204",
"T1027"
],
"title": "Suspicious Space Characters in TypedPaths Registry Path - FileFix"
},
{
"category": "registry_set",
"channel": [
@@ -36671,9 +36746,9 @@
"T1021.002",
"T1543.003",
"T1569.002",
"T1569",
"T1021",
"T1543"
"T1543",
"T1569"
],
"title": "Potential CobaltStrike Service Installations - Registry"
},
@@ -37248,8 +37323,8 @@
"TA0003",
"T1547.001",
"T1546.009",
"T1546",
"T1547"
"T1547",
"T1546"
],
"title": "Session Manager Autorun Keys Modification"
},
@@ -38181,8 +38256,8 @@
"T1566.001",
"cve.2017-0261",
"detection.emerging-threats",
"T1566",
"T1204"
"T1204",
"T1566"
],
"title": "Exploit for CVE-2017-0261"
},
@@ -38239,9 +38314,9 @@
"T1003.001",
"car.2016-04-002",
"detection.emerging-threats",
"T1218",
"T1070",
"T1003"
"T1003",
"T1218"
],
"title": "NotPetya Ransomware Activity"
},
@@ -38267,8 +38342,8 @@
"T1543.003",
"T1569.002",
"detection.emerging-threats",
"T1569",
"T1543"
"T1543",
"T1569"
],
"title": "CosmicDuke Service Installation"
},
@@ -38543,8 +38618,8 @@
"T1071.004",
"detection.emerging-threats",
"T1053",
"T1071",
"T1543"
"T1543",
"T1071"
],
"title": "OilRig APT Schedule Task Persistence - Security"
},
@@ -38576,9 +38651,9 @@
"TA0011",
"T1071.004",
"detection.emerging-threats",
"T1543",
"T1053",
"T1071",
"T1053"
"T1543"
],
"title": "OilRig APT Registry Persistence"
},
@@ -38610,9 +38685,9 @@
"TA0011",
"T1071.004",
"detection.emerging-threats",
"T1071",
"T1053",
"T1543",
"T1053"
"T1071"
],
"title": "OilRig APT Activity"
},
@@ -38642,8 +38717,8 @@
"TA0011",
"T1071.004",
"detection.emerging-threats",
"T1071",
"T1053",
"T1071",
"T1543"
],
"title": "OilRig APT Schedule Task Persistence - System"
@@ -39822,8 +39897,8 @@
"attack.s0412",
"attack.g0001",
"detection.emerging-threats",
"T1218",
"T1059"
"T1059",
"T1218"
],
"title": "ZxShell Malware"
},
@@ -40716,8 +40791,8 @@
"T1059.001",
"T1218.005",
"detection.emerging-threats",
"T1218",
"T1059"
"T1059",
"T1218"
],
"title": "Potential Baby Shark Malware Activity"
},
@@ -41022,8 +41097,8 @@
"T1552.001",
"T1003.003",
"detection.emerging-threats",
"T1552",
"T1003"
"T1003",
"T1552"
],
"title": "Potential Russian APT Credential Theft Activity"
},
@@ -41050,8 +41125,8 @@
"T1003.001",
"T1560.001",
"detection.emerging-threats",
"T1003",
"T1560"
"T1560",
"T1003"
],
"title": "APT31 Judgement Panda Activity"
},
@@ -41082,9 +41157,9 @@
"T1053.005",
"T1059.001",
"detection.emerging-threats",
"T1053",
"T1036",
"T1059",
"T1053"
"T1059"
],
"title": "Operation Wocao Activity"
},
@@ -46392,9 +46467,9 @@
"T1485",
"T1553.002",
"attack.s0195",
"T1070",
"T1027",
"T1553"
"T1553",
"T1070"
],
"title": "Potential Secure Deletion with SDelete"
},
@@ -46442,8 +46517,8 @@
"T1087.002",
"T1069.002",
"attack.s0039",
"T1087",
"T1069"
"T1069",
"T1087"
],
"title": "Reconnaissance Activity"
},
@@ -47350,8 +47425,8 @@
"T1218.010",
"TA0002",
"TA0005",
"T1218",
"T1204"
"T1204",
"T1218"
],
"title": "Excel Proxy Executing Regsvr32 With Payload Alternate"
},
@@ -47510,8 +47585,8 @@
"T1218.010",
"TA0002",
"TA0005",
"T1218",
"T1204"
"T1204",
"T1218"
],
"title": "Office Applications Spawning Wmi Cli Alternate"
},
@@ -47914,8 +47989,8 @@
"T1218.010",
"TA0002",
"TA0005",
"T1218",
"T1204"
"T1204",
"T1218"
],
"title": "WMI Execution Via Office Process"
},
@@ -49615,8 +49690,8 @@
"TA0004",
"T1543.003",
"T1569.002",
"T1543",
"T1569"
"T1569",
"T1543"
],
"title": "Sliver C2 Default Service Installation"
},
@@ -50185,9 +50260,9 @@
"T1021.002",
"T1543.003",
"T1569.002",
"T1569",
"T1543",
"T1021"
"T1021",
"T1569"
],
"title": "CobaltStrike Service Installations - System"
},
@@ -50272,8 +50347,8 @@
"TA0004",
"T1543.003",
"T1569.002",
"T1543",
"T1569"
"T1569",
"T1543"
],
"title": "ProcessHacker Privilege Elevation"
},
@@ -50356,8 +50431,8 @@
"TA0002",
"T1021.002",
"T1569.002",
"T1569",
"T1021"
"T1021",
"T1569"
],
"title": "smbexec.py Service Installation"
},
@@ -52050,8 +52125,8 @@
"TA0008",
"T1563.002",
"T1021.001",
"T1563",
"T1021"
"T1021",
"T1563"
],
"title": "Possible RDP Hijacking"
},
@@ -53609,9 +53684,9 @@
"T1021.002",
"T1569.002",
"T1021",
"T1569",
"T1543",
"T1136",
"T1569"
"T1136"
],
"title": "PSExec Lateral Movement"
},