separate rules to submodule (#304)

* rm: rules * Add: hayabusa-rules to submodule
2021-12-19 20:50:20 +09:00
parent dbba49b815
commit 0bce3800b7
1127 changed files with 4 additions and 42988 deletions
--- a/rules/sigma/process_creation/win_powershell_b64_shellcode.yml
+++ b/rules/sigma/process_creation/win_powershell_b64_shellcode.yml
@@ -1,30 +0,0 @@
-
-title: PowerShell Base64 Encoded Shellcode
-author: Florian Roth
-date: 2018/11/17
-description: Detects Base64 encoded Shellcode
-detection:
-  SELECTION_1:
-    EventID: 1
-  SELECTION_2:
-    CommandLine: '*AAAAYInlM*'
-  SELECTION_3:
-    CommandLine:
-    - '*OiCAAAAYInlM*'
-    - '*OiJAAAAYInlM*'
-  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
-falsepositives:
- Unknown
-id: 2d117e49-e626-4c7c-bd1f-c3c0147774c8
-level: critical
-logsource:
-  category: process_creation
-  product: windows
-modified: 2020/09/01
-references:
- https://twitter.com/cyb3rops/status/1063072865992523776
-status: experimental
-tags:
- attack.defense_evasion
- attack.t1027
-ruletype: SIGMA