separate rules to submodule (#304)

* rm: rules * Add: hayabusa-rules to submodule
2021-12-19 20:50:20 +09:00
parent dbba49b815
commit 0bce3800b7
1127 changed files with 4 additions and 42988 deletions
--- a/rules/sigma/powershell/powershell_script/powershell_prompt_credentials.yml
+++ b/rules/sigma/powershell/powershell_script/powershell_prompt_credentials.yml
@@ -1,28 +0,0 @@
-
-title: PowerShell Credential Prompt
-author: John Lambert (idea), Florian Roth (rule)
-date: 2017/04/09
-description: Detects PowerShell calling a credential prompt
-detection:
-  SELECTION_1:
-    ScriptBlockText: '*PromptForCredential*'
-  condition: SELECTION_1
-falsepositives:
- Unknown
-id: ca8b77a9-d499-4095-b793-5d5f330d450e
-level: high
-logsource:
-  category: ps_script
-  definition: Script block logging must be enabled
-  product: windows
-modified: 2021/10/16
-references:
- https://twitter.com/JohnLaTwC/status/850381440629981184
- https://t.co/ezOTGy1a1G
-status: experimental
-tags:
- attack.credential_access
- attack.execution
- attack.t1059.001
- attack.t1086
-ruletype: SIGMA