separate rules to submodule (#304)

* rm: rules * Add: hayabusa-rules to submodule
2021-12-19 20:50:20 +09:00
parent dbba49b815
commit 0bce3800b7
1127 changed files with 4 additions and 42988 deletions
--- a/rules/sigma/powershell/powershell_module/powershell_powercat.yml
+++ b/rules/sigma/powershell/powershell_module/powershell_powercat.yml
@@ -1,30 +0,0 @@
-
-title: Netcat The Powershell Version
-author: frack113
-date: 2021/07/21
-description: Adversaries may use a non-application layer protocol for communication
-  between host and C2 server or among infected hosts within a network
-detection:
-  SELECTION_1:
-    ContextInfo:
-    - '*powercat *'
-    - '*powercat.ps1*'
-  condition: SELECTION_1
-falsepositives:
- Unknown
-id: bf7286e7-c0be-460b-a7e8-5b2e07ecc2f2
-level: medium
-logsource:
-  category: ps_module
-  definition: PowerShell Module Logging must be enabled
-  product: windows
-modified: 2021/10/16
-references:
- https://nmap.org/ncat/
- https://github.com/besimorhino/powercat
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1095/T1095.md
-status: experimental
-tags:
- attack.command_and_control
- attack.t1095
-ruletype: SIGMA