separate rules to submodule (#304)

* rm: rules * Add: hayabusa-rules to submodule
2021-12-19 20:50:20 +09:00
parent dbba49b815
commit 0bce3800b7
1127 changed files with 4 additions and 42988 deletions
@@ -1,33 +0,0 @@
-
-title: Encoded FromBase64String
-author: Florian Roth
-date: 2019/08/24
-description: Detects a base64 encoded FromBase64String keyword in a process command
-  line
-detection:
-  SELECTION_1:
-    EventID: 1
-  SELECTION_2:
-    CommandLine:
-    - '*OjpGcm9tQmFzZTY0U3RyaW5n*'
-    - '*o6RnJvbUJhc2U2NFN0cmluZ*'
-    - '*6OkZyb21CYXNlNjRTdHJpbm*'
-  condition: (SELECTION_1 and SELECTION_2)
-falsepositives:
- unknown
-fields:
- CommandLine
- ParentCommandLine
-id: fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c
-level: critical
-logsource:
-  category: process_creation
-  product: windows
-status: experimental
-tags:
- attack.defense_evasion
- attack.t1140
- attack.execution
- attack.t1059.001
- attack.t1086
-ruletype: SIGMA