separate rules to submodule (#304)

* rm: rules * Add: hayabusa-rules to submodule
2021-12-19 20:50:20 +09:00
parent dbba49b815
commit 0bce3800b7
1127 changed files with 4 additions and 42988 deletions
--- a/rules/sigma/powershell/powershell_classic/powershell_renamed_powershell.yml
+++ b/rules/sigma/powershell/powershell_classic/powershell_renamed_powershell.yml
@@ -1,30 +0,0 @@
-
-title: Renamed Powershell Under Powershell Channel
-author: Harish Segar, frack113
-date: 2020/06/29
-description: Detects renamed powershell
-detection:
-  SELECTION_1:
-    HostName: ConsoleHost
-  SELECTION_2:
-    HostApplication:
-    - powershell.exe*
-    - C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe*
-  condition: (SELECTION_1 and  not (SELECTION_2))
-falsepositives:
- unknown
-id: 30a8cb77-8eb3-4cfb-8e79-ad457c5a4592
-level: low
-logsource:
-  category: ps_classic_start
-  definition: fields have to be extract from event
-  product: windows
-modified: 2021/10/16
-references:
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
-status: test
-tags:
- attack.execution
- attack.t1086
- attack.t1059.001
-ruletype: SIGMA