separate rules to submodule (#304)

* rm: rules * Add: hayabusa-rules to submodule
2021-12-19 20:50:20 +09:00
parent dbba49b815
commit 0bce3800b7
1127 changed files with 4 additions and 42988 deletions
@@ -1,38 +0,0 @@
-
-title: WSF/JSE/JS/VBA/VBE File Execution
-author: Michael Haag
-date: 2019/01/16
-description: Detects suspicious file execution by wscript and cscript
-detection:
-  SELECTION_1:
-    EventID: 1
-  SELECTION_2:
-    Image:
-    - '*\wscript.exe'
-    - '*\cscript.exe'
-  SELECTION_3:
-    CommandLine:
-    - '*.jse*'
-    - '*.vbe*'
-    - '*.js*'
-    - '*.vba*'
-  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
-falsepositives:
- Will need to be tuned. I recommend adding the user profile path in CommandLine if
-  it is getting too noisy.
-fields:
- CommandLine
- ParentCommandLine
-id: 1e33157c-53b1-41ad-bbcc-780b80b58288
-level: medium
-logsource:
-  category: process_creation
-  product: windows
-modified: 2020/08/28
-status: experimental
-tags:
- attack.execution
- attack.t1059.005
- attack.t1059.007
- attack.t1064
-ruletype: SIGMA