Feature/addruletype to sigma rule#230 (#235)

* added ruletype to SIGMA rule #230 * added ruletype to SIGMA rule converter tool #231
2021-11-28 18:14:51 +09:00
parent bc230f7cd5
commit 0cfa806baf
1087 changed files with 1186 additions and 90 deletions
--- a/rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml
+++ b/rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml
@@ -23,3 +23,4 @@ tags:
 - attack.t1084
 - attack.persistence
 - attack.t1546.003
+ruletype: SIGMA
--- a/rules/sigma/wmi_event/sysmon_wmi_susp_encoded_scripts.yml
+++ b/rules/sigma/wmi_event/sysmon_wmi_susp_encoded_scripts.yml
@@ -40,3 +40,4 @@ tags:
 - attack.t1047
 - attack.persistence
 - attack.t1546.003
+ruletype: SIGMA
--- a/rules/sigma/wmi_event/sysmon_wmi_susp_scripting.yml
+++ b/rules/sigma/wmi_event/sysmon_wmi_susp_scripting.yml
@@ -57,3 +57,4 @@ tags:
 - attack.t1086
 - attack.execution
 - attack.t1059.005
+ruletype: SIGMA