separate rules to submodule (#304)

* rm: rules * Add: hayabusa-rules to submodule
2021-12-19 20:50:20 +09:00
parent dbba49b815
commit 0bce3800b7
1127 changed files with 4 additions and 42988 deletions
--- a/rules/sigma/powershell/powershell_script/powershell_invoke_nightmare.yml
+++ b/rules/sigma/powershell/powershell_script/powershell_invoke_nightmare.yml
@@ -1,25 +0,0 @@
-
-title: PrintNightmare Powershell Exploitation
-author: Max Altgelt, Tobias Michalski
-date: 2021/08/09
-description: Detects Commandlet name for PrintNightmare exploitation.
-detection:
-  SELECTION_1:
-    ScriptBlockText: '*Invoke-Nightmare*'
-  condition: SELECTION_1
-falsepositives:
- Unknown
-id: 6d3f1399-a81c-4409-aff3-1ecfe9330baf
-level: high
-logsource:
-  category: ps_script
-  definition: Script Block Logging must be enable
-  product: windows
-modified: 2021/10/16
-references:
- https://github.com/calebstewart/CVE-2021-1675
-status: test
-tags:
- attack.privilege_escalation
- attack.t1548
-ruletype: SIGMA