separate rules to submodule (#304)

* rm: rules * Add: hayabusa-rules to submodule
2021-12-19 20:50:20 +09:00
parent dbba49b815
commit 0bce3800b7
1127 changed files with 4 additions and 42988 deletions
@@ -1,27 +0,0 @@
-
-title: T1086 PowerShell Execution
-author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
-date: 2019/09/12
-description: Detects execution of PowerShell
-detection:
-  SELECTION_1:
-    EventID: 17
-  SELECTION_2:
-    EventID: 18
-  SELECTION_3:
-    PipeName: \PSHost*
-  condition: ((SELECTION_1 or SELECTION_2) and SELECTION_3)
-falsepositives:
- Unknown
-id: ac7102b4-9e1e-4802-9b4f-17c5524c015c
-level: informational
-logsource:
-  category: pipe_created
-  product: windows
-references:
- https://threathunterplaybook.com/notebooks/windows/02_execution/WIN-190410151110.html
-status: experimental
-tags:
- attack.execution
- attack.t1059.001
-ruletype: SIGMA