separate rules to submodule (#304)

* rm: rules * Add: hayabusa-rules to submodule
2021-12-19 20:50:20 +09:00
parent dbba49b815
commit 0bce3800b7
1127 changed files with 4 additions and 42988 deletions
--- a/rules/sigma/process_creation/sysmon_long_powershell_commandline.yml
+++ b/rules/sigma/process_creation/sysmon_long_powershell_commandline.yml
@@ -1,34 +0,0 @@
-
-title: Too Long PowerShell Commandlines
-author: oscd.community, Natalia Shornikova
-date: 2020/10/06
-description: Detects Too long PowerShell command lines
-detection:
-  SELECTION_1:
-    EventID: 1
-  SELECTION_2:
-    CommandLine:
-    - '*powershell*'
-    - '*pwsh*'
-  SELECTION_3:
-    Description: Windows Powershell
-  SELECTION_4:
-    Product: PowerShell Core 6
-  SELECTION_5:
-    CommandLine|re: .{1000,}
-  condition: (SELECTION_1 and (SELECTION_2 or SELECTION_3 or SELECTION_4) and SELECTION_5)
-falsepositives:
- Unknown
-id: d0d28567-4b9a-45e2-8bbc-fb1b66a1f7f6
-level: medium
-logsource:
-  category: process_creation
-  product: windows
-modified: 2021/05/21
-references:
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
-status: experimental
-tags:
- attack.execution
- attack.t1059.001
-ruletype: SIGMA