Feature/addruletype to sigma rule#230 (#235)

* added ruletype to SIGMA rule #230 * added ruletype to SIGMA rule converter tool #231
2021-11-28 18:14:51 +09:00
parent bc230f7cd5
commit 0cfa806baf
1087 changed files with 1186 additions and 90 deletions
--- a/rules/sigma/sysmon/sysmon_accessing_winapi_in_powershell_credentials_dumping.yml
+++ b/rules/sigma/sysmon/sysmon_accessing_winapi_in_powershell_credentials_dumping.yml
@@ -27,3 +27,4 @@ status: experimental
 tags:
 - attack.credential_access
 - attack.t1003.001
+ruletype: SIGMA
--- a/rules/sigma/sysmon/sysmon_config_modification_error.yml
+++ b/rules/sigma/sysmon/sysmon_config_modification_error.yml
@@ -26,3 +26,4 @@ status: experimental
 tags:
 - attack.defense_evasion
 - attack.t1564
+ruletype: SIGMA
--- a/rules/sigma/sysmon/sysmon_config_modification_status.yml
+++ b/rules/sigma/sysmon/sysmon_config_modification_status.yml
@@ -28,3 +28,4 @@ status: experimental
 tags:
 - attack.defense_evasion
 - attack.t1564
+ruletype: SIGMA
--- a/rules/sigma/sysmon/sysmon_dcom_iertutil_dll_hijack.yml
+++ b/rules/sigma/sysmon/sysmon_dcom_iertutil_dll_hijack.yml
@@ -35,3 +35,4 @@ tags:
 - attack.lateral_movement
 - attack.t1021.002
 - attack.t1021.003
+ruletype: SIGMA