Add: sigma rules (#175)

rules/sigma/windows/dns_query/dns_query_hybridconnectionmgr_servicebus.yml

@@ -0,0 +1,27 @@
+
+title: DNS HybridConnectionManager Service Bus
+author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
+date: 2021/04/12
+description: Detects Azure Hybrid Connection Manager services querying the Azure service
+  bus service
+detection:
+  SELECTION_1:
+    EventID: 22
+  SELECTION_2:
+    QueryName: '*servicebus.windows.net*'
+  SELECTION_3:
+    Image: '*HybridConnectionManager*'
+  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
+falsepositives:
+- Legitimate use of Azure Hybrid Connection Manager and the Azure Service Bus service
+id: 7bd3902d-8b8b-4dd4-838a-c6862d40150d
+level: high
+logsource:
+  category: dns_query
+  product: windows
+modified: 2021/06/10
+references:
+- https://twitter.com/Cyb3rWard0g/status/1381642789369286662
+status: experimental
+tags:
+- attack.persistence

rules/sigma/windows/dns_query/dns_query_mega_nz.yml

@@ -0,0 +1,24 @@
+
+title: DNS Query for MEGA.io Upload Domain
+author: Aaron Greetham (@beardofbinary) - NCC Group
+date: 2021/05/26
+description: Detects DNS queries for subdomains used for upload to MEGA.io
+detection:
+  SELECTION_1:
+    EventID: 22
+  SELECTION_2:
+    QueryName: '*userstorage.mega.co.nz*'
+  condition: (SELECTION_1 and SELECTION_2)
+falsepositives:
+- Legitimate Mega upload
+id: 613c03ba-0779-4a53-8a1f-47f914a4ded3
+level: high
+logsource:
+  category: dns_query
+  product: windows
+references:
+- https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
+status: experimental
+tags:
+- attack.exfiltration
+- attack.t1567.002

rules/sigma/windows/dns_query/dns_query_possible_dns_rebinding.yml

@@ -0,0 +1,75 @@
+
+title: Possible DNS Rebinding
+author: Ilyas Ochkov, oscd.community
+date: 2019/10/25
+description: Detects several different DNS-answers by one domain with IPs from internal
+  and external networks. Normally, DNS-answer contain TTL >100. (DNS-record will saved
+  in host cache for a while TTL).
+detection:
+  SELECTION_1:
+    EventID: 22
+  SELECTION_2:
+    QueryName: '*'
+  SELECTION_3:
+    QueryStatus: '0'
+  SELECTION_4:
+    QueryResults:
+    - (::ffff:)?10.*
+    - (::ffff:)?192.168.*
+    - (::ffff:)?172.16.*
+    - (::ffff:)?172.17.*
+    - (::ffff:)?172.18.*
+    - (::ffff:)?172.19.*
+    - (::ffff:)?172.20.*
+    - (::ffff:)?172.21.*
+    - (::ffff:)?172.22.*
+    - (::ffff:)?172.23.*
+    - (::ffff:)?172.24.*
+    - (::ffff:)?172.25.*
+    - (::ffff:)?172.26.*
+    - (::ffff:)?172.27.*
+    - (::ffff:)?172.28.*
+    - (::ffff:)?172.29.*
+    - (::ffff:)?172.30.*
+    - (::ffff:)?172.31.*
+    - (::ffff:)?127.*
+  SELECTION_5:
+    QueryName: '*'
+  SELECTION_6:
+    QueryStatus: '0'
+  SELECTION_7:
+    QueryResults:
+    - (::ffff:)?10.*
+    - (::ffff:)?192.168.*
+    - (::ffff:)?172.16.*
+    - (::ffff:)?172.17.*
+    - (::ffff:)?172.18.*
+    - (::ffff:)?172.19.*
+    - (::ffff:)?172.20.*
+    - (::ffff:)?172.21.*
+    - (::ffff:)?172.22.*
+    - (::ffff:)?172.23.*
+    - (::ffff:)?172.24.*
+    - (::ffff:)?172.25.*
+    - (::ffff:)?172.26.*
+    - (::ffff:)?172.27.*
+    - (::ffff:)?172.28.*
+    - (::ffff:)?172.29.*
+    - (::ffff:)?172.30.*
+    - (::ffff:)?172.31.*
+    - (::ffff:)?127.*
+  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4 and (SELECTION_5
+    and SELECTION_6) and  not (SELECTION_7)) | count(QueryName) by ComputerName >
+    3
+id: eb07e747-2552-44cd-af36-b659ae0958e4
+level: medium
+logsource:
+  category: dns_query
+  product: windows
+modified: 2020/08/28
+references:
+- https://medium.com/@brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325
+status: experimental
+tags:
+- attack.initial_access
+- attack.t1189

rules/sigma/windows/dns_query/dns_query_regsvr32_network_activity.yml

@@ -0,0 +1,40 @@
+
+title: Regsvr32 Network Activity
+author: Dmitriy Lifanov, oscd.community
+date: 2019/10/25
+description: Detects network connections and DNS queries initiated by Regsvr32.exe
+detection:
+  SELECTION_1:
+    EventID: 22
+  SELECTION_2:
+    Image: '*\regsvr32.exe'
+  condition: (SELECTION_1 and SELECTION_2)
+falsepositives:
+- unknown
+fields:
+- ComputerName
+- User
+- Image
+- DestinationIp
+- DestinationPort
+id: 36e037c4-c228-4866-b6a3-48eb292b9955
+level: high
+logsource:
+  category: dns_query
+  product: windows
+modified: 2021/09/21
+references:
+- https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/
+- https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1117/T1117.md
+related:
+- id: c7e91a02-d771-4a6d-a700-42587e0b1095
+  type: derived
+status: experimental
+tags:
+- attack.execution
+- attack.t1559.001
+- attack.t1175
+- attack.defense_evasion
+- attack.t1218.010
+- attack.t1117