CSEC_PUBLIC/WELA
1
0
Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2025-12-27 19:33:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Sigma Rule Update (2025-10-29 20:15:51) (#132)

Browse Source 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
This commit is contained in:
github-actions[bot]
2025-10-29 20:15:57 +00:00
committed by GitHub
parent 8e9b405696
commit e76d2e9b5e
1 changed files with 175 additions and 127 deletions
Download Patch File Download Diff File Expand all files Collapse all files

302
config/security_rules.json
View File

@@ -287,8 +287,8 @@
"TA0005",
"T1059.001",
"T1036.003",
"T1036",
"T1059"
"T1059",
"T1036"
],
"title": "Renamed Powershell Under Powershell Channel"
},
@@ -344,8 +344,8 @@
"T1059.001",
"TA0008",
"T1021.003",
"T1059",
"T1021"
"T1021",
"T1059"
],
"title": "Suspicious Non PowerShell WSMAN COM Provider"
},
@@ -424,8 +424,8 @@
"T1059.001",
"TA0008",
"T1021.006",
"T1059",
"T1021"
"T1021",
"T1059"
],
"title": "Remote PowerShell Session (PS Classic)"
},
@@ -1149,8 +1149,8 @@
"T1529",
"attack.g0091",
"attack.s0363",
"T1071",
"T1059"
"T1059",
"T1071"
],
"title": "Silence.EDA Detection"
},
@@ -1479,8 +1479,8 @@
"T1552.001",
"T1555",
"T1555.003",
"T1548",
"T1552"
"T1552",
"T1548"
],
"title": "HackTool - WinPwn Execution - ScriptBlock"
},
@@ -2194,8 +2194,8 @@
"T1558.003",
"TA0008",
"T1550.003",
"T1550",
"T1558"
"T1558",
"T1550"
],
"title": "HackTool - Rubeus Execution - ScriptBlock"
},
@@ -2637,8 +2637,8 @@
"T1564.004",
"TA0002",
"T1059.001",
"T1059",
"T1564"
"T1564",
"T1059"
],
"title": "NTFS Alternate Data Stream"
},
@@ -4371,8 +4371,8 @@
"T1059.001",
"TA0008",
"T1021.006",
"T1059",
"T1021"
"T1021",
"T1059"
],
"title": "Remote PowerShell Session (PS Module)"
},
@@ -4859,8 +4859,8 @@
"T1059.005",
"T1059.006",
"T1059.007",
"T1204",
"T1059"
"T1059",
"T1204"
],
"title": "File Was Not Allowed To Run"
},
@@ -4983,8 +4983,8 @@
"T1552.001",
"T1555",
"T1555.003",
"T1552",
"T1548"
"T1548",
"T1552"
],
"title": "HackTool - WinPwn Execution"
},
@@ -5553,8 +5553,8 @@
"TA0002",
"T1059.001",
"T1218",
"T1027",
"T1059"
"T1059",
"T1027"
],
"title": "Obfuscated PowerShell MSI Install via WindowsInstaller COM"
},
@@ -9437,8 +9437,8 @@
"T1564.004",
"T1552.001",
"T1105",
"T1564",
"T1552"
"T1552",
"T1564"
],
"title": "Remote File Download Via Findstr.EXE"
},
@@ -10054,8 +10054,8 @@
"T1087.002",
"T1069.002",
"T1482",
"T1087",
"T1069"
"T1069",
"T1087"
],
"title": "Suspicious Active Directory Database Snapshot Via ADExplorer"
},
@@ -11211,8 +11211,8 @@
"T1071.004",
"T1132.001",
"T1048",
"T1071",
"T1132"
"T1132",
"T1071"
],
"title": "DNS Exfiltration and Tunneling Tools Execution"
},
@@ -11758,8 +11758,8 @@
"T1047",
"T1204.002",
"T1218.010",
"T1204",
"T1218"
"T1218",
"T1204"
],
"title": "Suspicious WmiPrvSE Child Process"
},
@@ -11827,8 +11827,8 @@
"TA0002",
"T1059.001",
"T1562.001",
"T1562",
"T1059"
"T1059",
"T1562"
],
"title": "Obfuscated PowerShell OneLiner Execution"
},
@@ -13657,8 +13657,8 @@
"T1587.001",
"TA0002",
"T1569.002",
"T1587",
"T1569"
"T1569",
"T1587"
],
"title": "PUA - CsExec Execution"
},
@@ -15742,8 +15742,8 @@
"T1203",
"T1059.003",
"attack.g0032",
"T1566",
"T1059"
"T1059",
"T1566"
],
"title": "Suspicious HWP Sub Processes"
},
@@ -17984,8 +17984,8 @@
"TA0002",
"T1552.004",
"T1059.001",
"T1552",
"T1059"
"T1059",
"T1552"
],
"title": "Certificate Exported Via PowerShell"
},
@@ -18052,8 +18052,8 @@
"T1218.011",
"TA0006",
"T1003.001",
"T1218",
"T1003"
"T1003",
"T1218"
],
"title": "Process Access via TrolleyExpress Exclusion"
},
@@ -18237,8 +18237,8 @@
"TA0003",
"T1543.003",
"T1574.011",
"T1574",
"T1543"
"T1543",
"T1574"
],
"title": "Potential Persistence Attempt Via Existing Service Tampering"
},
@@ -18746,8 +18746,8 @@
"TA0005",
"T1562.001",
"T1070.001",
"T1562",
"T1070"
"T1070",
"T1562"
],
"title": "Suspicious Windows Trace ETW Session Tamper Via Logman.EXE"
},
@@ -20882,9 +20882,9 @@
"TA0005",
"T1218.014",
"T1036.002",
"T1218",
"T1204",
"T1036",
"T1204"
"T1218"
],
"title": "MMC Executing Files with Reversed Extensions Using RTLO Abuse"
},
@@ -21013,8 +21013,8 @@
"TA0005",
"T1219.002",
"T1036.003",
"T1219",
"T1036"
"T1036",
"T1219"
],
"title": "Remote Access Tool - Renamed MeshAgent Execution - Windows"
},
@@ -21417,12 +21417,12 @@
"T1547.002",
"T1557",
"T1082",
"T1547",
"T1546",
"T1564",
"T1556",
"T1505",
"T1574"
"T1556",
"T1574",
"T1546",
"T1547",
"T1564"
],
"title": "Potential Suspicious Activity Using SeCEdit"
},
@@ -22548,9 +22548,9 @@
"TA0005",
"T1218.005",
"T1027.004",
"T1027",
"T1218",
"T1059",
"T1218"
"T1027"
],
"title": "Csc.EXE Execution Form Potentially Suspicious Parent"
},
@@ -24179,8 +24179,8 @@
"TA0003",
"T1053.005",
"T1059.001",
"T1053",
"T1059"
"T1059",
"T1053"
],
"title": "Scheduled Task Executing Payload from Registry"
},
@@ -26122,8 +26122,8 @@
"T1069.002",
"TA0002",
"T1059.001",
"T1087",
"T1059",
"T1087",
"T1069"
],
"title": "HackTool - Bloodhound/Sharphound Execution"
@@ -27052,8 +27052,8 @@
"T1070.001",
"T1562.002",
"car.2016-04-002",
"T1562",
"T1070"
"T1070",
"T1562"
],
"title": "Suspicious Eventlog Clearing or Configuration Change Activity"
},
@@ -27211,8 +27211,8 @@
"T1106",
"T1059.003",
"T1218.011",
"T1218",
"T1059"
"T1059",
"T1218"
],
"title": "HackTool - RedMimicry Winnti Playbook Execution"
},
@@ -27603,8 +27603,8 @@
"T1558.003",
"TA0008",
"T1550.003",
"T1550",
"T1558"
"T1558",
"T1550"
],
"title": "HackTool - Rubeus Execution"
},
@@ -28044,8 +28044,8 @@
"TA0003",
"T1036.005",
"T1053.005",
"T1036",
"T1053"
"T1053",
"T1036"
],
"title": "Suspicious Scheduled Task Creation via Masqueraded XML File"
},
@@ -31421,8 +31421,8 @@
"attack.s0039",
"detection.threat-hunting",
"T1069",
"T1087",
"T1021"
"T1021",
"T1087"
],
"title": "Net.EXE Execution"
},
@@ -32179,9 +32179,9 @@
"T1027.010",
"T1547.001",
"detection.threat-hunting",
"T1027",
"T1547",
"T1059"
"T1059",
"T1027"
],
"title": "Registry Set With Crypto-Classes From The \"Cryptography\" PowerShell Namespace"
},
@@ -35399,6 +35399,30 @@
],
"title": "UAC Secure Desktop Prompt Disabled"
},
{
"category": "registry_set",
"channel": [
"sec"
],
"description": "Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.\n",
"event_ids": [
"4657"
],
"id": "c4192251-3d93-add7-246d-df5227e7dcb9",
"level": "medium",
"service": "",
"subcategory_guids": [
"0CCE921E-69AE-11D9-BED3-505054503030"
],
"tags": [
"TA0005",
"TA0002",
"T1562",
"T1569.002",
"T1569"
],
"title": "WFP Filter Added via Registry"
},
{
"category": "registry_set",
"channel": [
@@ -36553,8 +36577,8 @@
"T1021.002",
"T1543.003",
"T1569.002",
"T1569",
"T1543",
"T1569",
"T1021"
],
"title": "Potential CobaltStrike Service Installations - Registry"
@@ -37130,8 +37154,8 @@
"TA0003",
"T1547.001",
"T1546.009",
"T1546",
"T1547"
"T1547",
"T1546"
],
"title": "Session Manager Autorun Keys Modification"
},
@@ -38007,8 +38031,8 @@
"T1566.001",
"cve.2017-8759",
"detection.emerging-threats",
"T1566",
"T1204"
"T1204",
"T1566"
],
"title": "Exploit for CVE-2017-8759"
},
@@ -38035,8 +38059,8 @@
"T1566.001",
"cve.2017-11882",
"detection.emerging-threats",
"T1204",
"T1566"
"T1566",
"T1204"
],
"title": "Droppers Exploiting CVE-2017-11882"
},
@@ -38121,9 +38145,9 @@
"T1003.001",
"car.2016-04-002",
"detection.emerging-threats",
"T1003",
"T1218",
"T1070"
"T1070",
"T1003"
],
"title": "NotPetya Ransomware Activity"
},
@@ -38149,8 +38173,8 @@
"T1543.003",
"T1569.002",
"detection.emerging-threats",
"T1569",
"T1543"
"T1543",
"T1569"
],
"title": "CosmicDuke Service Installation"
},
@@ -38424,8 +38448,8 @@
"TA0011",
"T1071.004",
"detection.emerging-threats",
"T1071",
"T1053",
"T1071",
"T1543"
],
"title": "OilRig APT Schedule Task Persistence - Security"
@@ -38524,9 +38548,9 @@
"TA0011",
"T1071.004",
"detection.emerging-threats",
"T1071",
"T1543",
"T1053",
"T1543"
"T1071"
],
"title": "OilRig APT Schedule Task Persistence - System"
},
@@ -38652,8 +38676,8 @@
"T1218.011",
"car.2013-10-002",
"detection.emerging-threats",
"T1218",
"T1059"
"T1059",
"T1218"
],
"title": "Sofacy Trojan Loader Activity"
},
@@ -39141,8 +39165,8 @@
"TA0005",
"T1036.005",
"detection.emerging-threats",
"T1036",
"T1059"
"T1059",
"T1036"
],
"title": "Greenbug Espionage Group Indicators"
},
@@ -39647,8 +39671,8 @@
"T1053.005",
"T1027",
"detection.emerging-threats",
"T1059",
"T1053"
"T1053",
"T1059"
],
"title": "Turla Group Commands May 2020"
},
@@ -39704,8 +39728,8 @@
"attack.s0412",
"attack.g0001",
"detection.emerging-threats",
"T1059",
"T1218"
"T1218",
"T1059"
],
"title": "ZxShell Malware"
},
@@ -40598,8 +40622,8 @@
"T1059.001",
"T1218.005",
"detection.emerging-threats",
"T1059",
"T1218"
"T1218",
"T1059"
],
"title": "Potential Baby Shark Malware Activity"
},
@@ -40964,9 +40988,9 @@
"T1053.005",
"T1059.001",
"detection.emerging-threats",
"T1036",
"T1053",
"T1059",
"T1036"
"T1059"
],
"title": "Operation Wocao Activity"
},
@@ -41284,8 +41308,8 @@
"T1059.001",
"attack.s0183",
"detection.emerging-threats",
"T1071",
"T1059"
"T1059",
"T1071"
],
"title": "Kalambur Backdoor Curl TOR SOCKS Proxy Execution"
},
@@ -43471,6 +43495,30 @@
],
"title": "Password Change on Directory Service Restore Mode (DSRM) Account"
},
{
"category": "",
"channel": [
"sec"
],
"description": "Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json.\nThe db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data.\nSince the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials.\nCurrently the rule only covers the default Signal installation path in AppData\\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed.\n",
"event_ids": [
"4663"
],
"id": "f8baaa96-980f-9fec-5b6e-2bbc36237bd6",
"level": "medium",
"service": "security",
"subcategory_guids": [
"0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030"
],
"tags": [
"TA0006",
"T1003"
],
"title": "File Access Of Signal Desktop Sensitive Data"
},
{
"category": "",
"channel": [
@@ -44348,8 +44396,8 @@
"TA0002",
"T1543.003",
"T1569.002",
"T1543",
"T1569"
"T1569",
"T1543"
],
"title": "Remote Access Tool Services Have Been Installed - Security"
},
@@ -44517,9 +44565,9 @@
"T1021.002",
"T1543.003",
"T1569.002",
"T1021",
"T1543",
"T1569",
"T1543"
"T1021"
],
"title": "CobaltStrike Service Installations - Security"
},
@@ -45023,8 +45071,8 @@
"T1570",
"TA0002",
"T1569.002",
"T1569",
"T1021"
"T1021",
"T1569"
],
"title": "Metasploit Or Impacket Service Installation Via SMB PsExec"
},
@@ -45075,8 +45123,8 @@
"T1090.002",
"T1021.001",
"car.2013-07-002",
"T1090",
"T1021"
"T1021",
"T1090"
],
"title": "RDP over Reverse SSH Tunnel WFP"
},
@@ -46202,9 +46250,9 @@
"T1485",
"T1553.002",
"attack.s0195",
"T1553",
"T1070",
"T1027",
"T1553"
"T1027"
],
"title": "Potential Secure Deletion with SDelete"
},
@@ -46698,8 +46746,8 @@
"T1564.004",
"T1552.001",
"T1105",
"T1564",
"T1552"
"T1552",
"T1564"
],
"title": "Abusing Findstr for Defense Evasion"
},
@@ -47160,8 +47208,8 @@
"T1218.010",
"TA0002",
"TA0005",
"T1218",
"T1204"
"T1204",
"T1218"
],
"title": "Excel Proxy Executing Regsvr32 With Payload Alternate"
},
@@ -47724,8 +47772,8 @@
"T1218.010",
"TA0002",
"TA0005",
"T1204",
"T1218"
"T1218",
"T1204"
],
"title": "WMI Execution Via Office Process"
},
@@ -49425,8 +49473,8 @@
"TA0004",
"T1543.003",
"T1569.002",
"T1569",
"T1543"
"T1543",
"T1569"
],
"title": "Sliver C2 Default Service Installation"
},
@@ -49930,8 +49978,8 @@
"T1003.006",
"T1569.002",
"attack.s0005",
"T1569",
"T1003"
"T1003",
"T1569"
],
"title": "Credential Dumping Tools Service Execution - System"
},
@@ -49995,9 +50043,9 @@
"T1021.002",
"T1543.003",
"T1569.002",
"T1569",
"T1021",
"T1543"
"T1543",
"T1569"
],
"title": "CobaltStrike Service Installations - System"
},
@@ -50082,8 +50130,8 @@
"TA0004",
"T1543.003",
"T1569.002",
"T1543",
"T1569"
"T1569",
"T1543"
],
"title": "ProcessHacker Privilege Elevation"
},
@@ -51860,8 +51908,8 @@
"TA0008",
"T1563.002",
"T1021.001",
"T1021",
"T1563"
"T1563",
"T1021"
],
"title": "Possible RDP Hijacking"
},
@@ -53418,10 +53466,10 @@
"T1570",
"T1021.002",
"T1569.002",
"T1021",
"T1136",
"T1569",
"T1543"
"T1543",
"T1136",
"T1021"
],
"title": "PSExec Lateral Movement"
},