separate rules to submodule (#304)

* rm: rules * Add: hayabusa-rules to submodule
2021-12-19 20:50:20 +09:00
parent dbba49b815
commit 0bce3800b7
1127 changed files with 4 additions and 42988 deletions
--- a/rules/sigma/powershell/powershell_script/powershell_adrecon_execution.yml
+++ b/rules/sigma/powershell/powershell_script/powershell_adrecon_execution.yml
@@ -1,30 +0,0 @@
-
-title: PowerShell ADRecon Execution
-author: Bhabesh Raj
-date: 2021/07/16
-description: Detects execution of ADRecon.ps1 for AD reconnaissance which has been
-  reported to be actively used by FIN7
-detection:
-  SELECTION_1:
-    ScriptBlockText:
-    - '*Function Get-ADRExcelComOb*'
-    - '*ADRecon-Report.xlsx*'
-  condition: SELECTION_1
-falsepositives:
- Unknown
-id: bf72941a-cba0-41ea-b18c-9aca3925690d
-level: high
-logsource:
-  category: ps_script
-  definition: Script block logging must be enabled
-  product: windows
-modified: 2021/10/16
-references:
- https://github.com/sense-of-security/ADRecon
- https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319
-status: experimental
-tags:
- attack.discovery
- attack.execution
- attack.t1059.001
-ruletype: SIGMA