CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Feature/addruletype to sigma rule#230 (#235)

Browse Source 
* added ruletype to SIGMA rule #230

* added ruletype to SIGMA rule converter tool #231
This commit is contained in:
DustInDark
2021-11-28 18:14:51 +09:00
committed by GitHub
parent bc230f7cd5
commit 0cfa806baf
1087 changed files with 1186 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
rules/sigma/builtin/win_aadhealth_mon_agent_regkey_access.yml
View File

@@ -37,3 +37,4 @@ status: experimental
tags: tags:
- attack.discovery - attack.discovery
- attack.t1012 - attack.t1012
ruletype: SIGMA

1
rules/sigma/builtin/win_aadhealth_svc_agent_regkey_access.yml
View File

@@ -39,3 +39,4 @@ status: experimental
tags: tags:
- attack.discovery - attack.discovery
- attack.t1012 - attack.t1012
ruletype: SIGMA

1
rules/sigma/builtin/win_account_backdoor_dcsync_rights.yml
View File

@@ -32,3 +32,4 @@ status: experimental
tags: tags:
- attack.persistence - attack.persistence
- attack.t1098 - attack.t1098
ruletype: SIGMA

1
rules/sigma/builtin/win_account_discovery.yml
View File

@@ -41,3 +41,4 @@ tags:
- attack.discovery - attack.discovery
- attack.t1087 - attack.t1087
- attack.t1087.002 - attack.t1087.002
ruletype: SIGMA

1
rules/sigma/builtin/win_ad_object_writedac_access.yml
View File

@@ -29,3 +29,4 @@ tags:
- attack.defense_evasion - attack.defense_evasion
- attack.t1222 - attack.t1222
- attack.t1222.001 - attack.t1222.001
ruletype: SIGMA

1
rules/sigma/builtin/win_ad_replication_non_machine_account.yml
View File

@@ -39,3 +39,4 @@ tags:
- attack.credential_access - attack.credential_access
- attack.t1003 - attack.t1003
- attack.t1003.006 - attack.t1003.006
ruletype: SIGMA

1
rules/sigma/builtin/win_ad_user_enumeration.yml
View File

@@ -32,3 +32,4 @@ tags:
- attack.discovery - attack.discovery
- attack.t1087 - attack.t1087
- attack.t1087.002 - attack.t1087.002
ruletype: SIGMA

1
rules/sigma/builtin/win_adcs_certificate_template_configuration_vulnerability.yml
View File

@@ -32,3 +32,4 @@ status: experimental
tags: tags:
- attack.privilege_escalation - attack.privilege_escalation
- attack.credential_access - attack.credential_access
ruletype: SIGMA

1
rules/sigma/builtin/win_adcs_certificate_template_configuration_vulnerability_eku.yml
View File

@@ -46,3 +46,4 @@ status: experimental
tags: tags:
- attack.privilege_escalation - attack.privilege_escalation
- attack.credential_access - attack.credential_access
ruletype: SIGMA

1
rules/sigma/builtin/win_admin_rdp_login.yml
View File

@@ -34,3 +34,4 @@ tags:
- attack.t1078.002 - attack.t1078.002
- attack.t1078.003 - attack.t1078.003
- car.2016-04-005 - car.2016-04-005
ruletype: SIGMA

1
rules/sigma/builtin/win_admin_share_access.yml
View File

@@ -26,3 +26,4 @@ tags:
- attack.lateral_movement - attack.lateral_movement
- attack.t1077 - attack.t1077
- attack.t1021.002 - attack.t1021.002
ruletype: SIGMA

1
rules/sigma/builtin/win_alert_active_directory_user_control.yml
View File

@@ -29,3 +29,4 @@ status: experimental
tags: tags:
- attack.persistence - attack.persistence
- attack.t1098 - attack.t1098
ruletype: SIGMA

1
rules/sigma/builtin/win_alert_ad_user_backdoors.yml
View File

@@ -50,3 +50,4 @@ status: experimental
tags: tags:
- attack.t1098 - attack.t1098
- attack.persistence - attack.persistence
ruletype: SIGMA

1
rules/sigma/builtin/win_alert_enable_weak_encryption.yml
View File

@@ -88,3 +88,4 @@ tags:
- attack.defense_evasion - attack.defense_evasion
- attack.t1089 - attack.t1089
- attack.t1562.001 - attack.t1562.001
ruletype: SIGMA

1
rules/sigma/builtin/win_alert_lsass_access.yml
View File

@@ -28,3 +28,4 @@ tags:
- attack.credential_access - attack.credential_access
- attack.t1003 - attack.t1003
- attack.t1003.001 - attack.t1003.001
ruletype: SIGMA

1
rules/sigma/builtin/win_alert_mimikatz_keywords.yml
View File

@@ -43,3 +43,4 @@ tags:
- attack.t1003.004 - attack.t1003.004
- attack.t1003.001 - attack.t1003.001
- attack.t1003.006 - attack.t1003.006
ruletype: SIGMA

1
rules/sigma/builtin/win_alert_ruler.yml
View File

@@ -38,3 +38,4 @@ tags:
- attack.t1114 - attack.t1114
- attack.t1059 - attack.t1059
- attack.t1550.002 - attack.t1550.002
ruletype: SIGMA

1
rules/sigma/builtin/win_applocker_file_was_not_allowed_to_run.yml
View File

@@ -45,3 +45,4 @@ tags:
- attack.t1059.005 - attack.t1059.005
- attack.t1059.006 - attack.t1059.006
- attack.t1059.007 - attack.t1059.007
ruletype: SIGMA

1
rules/sigma/builtin/win_apt_carbonpaper_turla.yml
View File

@@ -28,3 +28,4 @@ tags:
- attack.g0010 - attack.g0010
- attack.t1050 - attack.t1050
- attack.t1543.003 - attack.t1543.003
ruletype: SIGMA

1
rules/sigma/builtin/win_apt_chafer_mar18_security.yml
View File

@@ -39,3 +39,4 @@ tags:
- attack.command_and_control - attack.command_and_control
- attack.t1071 - attack.t1071
- attack.t1071.004 - attack.t1071.004
ruletype: SIGMA

1
rules/sigma/builtin/win_apt_chafer_mar18_system.yml
View File

@@ -36,3 +36,4 @@ tags:
- attack.command_and_control - attack.command_and_control
- attack.t1071 - attack.t1071
- attack.t1071.004 - attack.t1071.004
ruletype: SIGMA

1
rules/sigma/builtin/win_apt_gallium.yml
View File

@@ -36,3 +36,4 @@ tags:
- attack.credential_access - attack.credential_access
- attack.command_and_control - attack.command_and_control
- attack.t1071 - attack.t1071
ruletype: SIGMA

1
rules/sigma/builtin/win_apt_slingshot.yml
View File

@@ -29,3 +29,4 @@ tags:
- attack.persistence - attack.persistence
- attack.t1053 - attack.t1053
- attack.s0111 - attack.s0111
ruletype: SIGMA

1
rules/sigma/builtin/win_apt_stonedrill.yml
View File

@@ -27,3 +27,4 @@ tags:
- attack.g0064 - attack.g0064
- attack.t1050 - attack.t1050
- attack.t1543.003 - attack.t1543.003
ruletype: SIGMA

1
rules/sigma/builtin/win_apt_turla_service_png.yml
View File

@@ -25,3 +25,4 @@ tags:
- attack.g0010 - attack.g0010
- attack.t1050 - attack.t1050
- attack.t1543.003 - attack.t1543.003
ruletype: SIGMA

1
rules/sigma/builtin/win_apt_wocao.yml
View File

@@ -35,3 +35,4 @@ tags:
- attack.t1053 - attack.t1053
- attack.t1059.001 - attack.t1059.001
- attack.t1086 - attack.t1086
ruletype: SIGMA

1
rules/sigma/builtin/win_arbitrary_shell_execution_via_settingcontent.yml
View File

@@ -32,3 +32,4 @@ tags:
- attack.t1566.001 - attack.t1566.001
- attack.execution - attack.execution
- attack.initial_access - attack.initial_access
ruletype: SIGMA

1
rules/sigma/builtin/win_asr_bypass_via_appvlp_re.yml
View File

@@ -27,3 +27,4 @@ tags:
- attack.t1218 - attack.t1218
- attack.defense_evasion - attack.defense_evasion
- attack.execution - attack.execution
ruletype: SIGMA

1
rules/sigma/builtin/win_atsvc_task.yml
View File

@@ -33,3 +33,4 @@ tags:
- car.2013-05-004 - car.2013-05-004
- car.2015-04-001 - car.2015-04-001
- attack.t1053.002 - attack.t1053.002
ruletype: SIGMA

1
rules/sigma/builtin/win_audit_cve.yml
View File

@@ -36,3 +36,4 @@ tags:
- attack.t1210 - attack.t1210
- attack.impact - attack.impact
- attack.t1499.004 - attack.t1499.004
ruletype: SIGMA

1
rules/sigma/builtin/win_av_relevant_match.yml
View File

@@ -41,3 +41,4 @@ status: experimental
tags: tags:
- attack.resource_development - attack.resource_development
- attack.t1588 - attack.t1588
ruletype: SIGMA

1
rules/sigma/builtin/win_camera_microphone_access.yml
View File

@@ -29,3 +29,4 @@ status: experimental
tags: tags:
- attack.collection - attack.collection
- attack.t1123 - attack.t1123
ruletype: SIGMA

1
rules/sigma/builtin/win_cobaltstrike_service_installs.yml
View File

@@ -46,3 +46,4 @@ tags:
- attack.t1021.002 - attack.t1021.002
- attack.t1543.003 - attack.t1543.003
- attack.t1569.002 - attack.t1569.002
ruletype: SIGMA

1
rules/sigma/builtin/win_dce_rpc_smb_spoolss_named_pipe.yml
View File

@@ -28,3 +28,4 @@ status: experimental
tags: tags:
- attack.lateral_movement - attack.lateral_movement
- attack.t1021.002 - attack.t1021.002
ruletype: SIGMA

1
rules/sigma/builtin/win_dcom_iertutil_dll_hijack.yml
View File

@@ -27,3 +27,4 @@ tags:
- attack.lateral_movement - attack.lateral_movement
- attack.t1021.002 - attack.t1021.002
- attack.t1021.003 - attack.t1021.003
ruletype: SIGMA

1
rules/sigma/builtin/win_dcsync.yml
View File

@@ -38,3 +38,4 @@ tags:
- attack.s0002 - attack.s0002
- attack.t1003 - attack.t1003
- attack.t1003.006 - attack.t1003.006
ruletype: SIGMA

1
rules/sigma/builtin/win_disable_event_logging.yml
View File

@@ -37,3 +37,4 @@ tags:
- attack.defense_evasion - attack.defense_evasion
- attack.t1054 - attack.t1054
- attack.t1562.002 - attack.t1562.002
ruletype: SIGMA

1
rules/sigma/builtin/win_dpapi_domain_backupkey_extraction.yml
View File

@@ -28,3 +28,4 @@ tags:
- attack.credential_access - attack.credential_access
- attack.t1003 - attack.t1003
- attack.t1003.004 - attack.t1003.004
ruletype: SIGMA

1
rules/sigma/builtin/win_dpapi_domain_masterkey_backup_attempt.yml
View File

@@ -26,3 +26,4 @@ tags:
- attack.credential_access - attack.credential_access
- attack.t1003 - attack.t1003
- attack.t1003.004 - attack.t1003.004
ruletype: SIGMA

1
rules/sigma/builtin/win_etw_modification.yml
View File

@@ -34,3 +34,4 @@ status: experimental
tags: tags:
- attack.defense_evasion - attack.defense_evasion
- attack.t1112 - attack.t1112
ruletype: SIGMA

1
rules/sigma/builtin/win_event_log_cleared.yml
View File

@@ -28,3 +28,4 @@ status: experimental
tags: tags:
- attack.t1107 - attack.t1107
- attack.t1070.001 - attack.t1070.001
ruletype: SIGMA

1
rules/sigma/builtin/win_exchange_transportagent.yml
View File

@@ -25,3 +25,4 @@ status: experimental
tags: tags:
- attack.persistence - attack.persistence
- attack.t1505.002 - attack.t1505.002
ruletype: SIGMA

1
rules/sigma/builtin/win_exploit_cve_2021_1675_printspooler.yml
View File

@@ -43,3 +43,4 @@ tags:
- attack.execution - attack.execution
- attack.t1569 - attack.t1569
- cve.2021.1675 - cve.2021.1675
ruletype: SIGMA

1
rules/sigma/builtin/win_exploit_cve_2021_1675_printspooler_operational.yml
View File

@@ -29,3 +29,4 @@ tags:
- attack.execution - attack.execution
- attack.t1569 - attack.t1569
- cve.2021.1675 - cve.2021.1675
ruletype: SIGMA

1
rules/sigma/builtin/win_exploit_cve_2021_1675_printspooler_security.yml
View File

@@ -32,3 +32,4 @@ tags:
- attack.t1569 - attack.t1569
- cve.2021.1675 - cve.2021.1675
- cve.2021.34527 - cve.2021.34527
ruletype: SIGMA

1
rules/sigma/builtin/win_external_device.yml
View File

@@ -26,3 +26,4 @@ tags:
- attack.t1200 - attack.t1200
- attack.lateral_movement - attack.lateral_movement
- attack.initial_access - attack.initial_access
ruletype: SIGMA

1
rules/sigma/builtin/win_global_catalog_enumeration.yml
View File

@@ -31,3 +31,4 @@ tags:
- attack.discovery - attack.discovery
- attack.t1087 - attack.t1087
- attack.t1087.002 - attack.t1087.002
ruletype: SIGMA

1
rules/sigma/builtin/win_gpo_scheduledtasks.yml
View File

@@ -35,3 +35,4 @@ tags:
- attack.lateral_movement - attack.lateral_movement
- attack.t1053 - attack.t1053
- attack.t1053.005 - attack.t1053.005
ruletype: SIGMA

1
rules/sigma/builtin/win_hack_smbexec.yml
View File

@@ -33,3 +33,4 @@ tags:
- attack.t1021.002 - attack.t1021.002
- attack.t1035 - attack.t1035
- attack.t1569.002 - attack.t1569.002
ruletype: SIGMA

1
rules/sigma/builtin/win_hidden_user_creation.yml
View File

@@ -26,3 +26,4 @@ status: experimental
tags: tags:
- attack.persistence - attack.persistence
- attack.t1136.001 - attack.t1136.001
ruletype: SIGMA

1
rules/sigma/builtin/win_hybridconnectionmgr_svc_installation.yml
View File

@@ -25,3 +25,4 @@ status: experimental
tags: tags:
- attack.persistence - attack.persistence
- attack.t1554 - attack.t1554
ruletype: SIGMA

1
rules/sigma/builtin/win_hybridconnectionmgr_svc_running.yml
View File

@@ -29,3 +29,4 @@ status: experimental
tags: tags:
- attack.persistence - attack.persistence
- attack.t1554 - attack.t1554
ruletype: SIGMA

1
rules/sigma/builtin/win_impacket_psexec.yml
View File

@@ -29,3 +29,4 @@ status: experimental
tags: tags:
- attack.lateral_movement - attack.lateral_movement
- attack.t1021.002 - attack.t1021.002
ruletype: SIGMA

1
rules/sigma/builtin/win_impacket_secretdump.yml
View File

@@ -32,3 +32,4 @@ tags:
- attack.t1003.002 - attack.t1003.002
- attack.t1003.004 - attack.t1003.004
- attack.t1003.003 - attack.t1003.003
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_clip_services.yml
View File

@@ -25,3 +25,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_clip_services_security.yml
View File

@@ -28,3 +28,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_obfuscated_iex_services.yml
View File

@@ -35,3 +35,4 @@ status: experimental
tags: tags:
- attack.defense_evasion - attack.defense_evasion
- attack.t1027 - attack.t1027
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_obfuscated_iex_services_security.yml
View File

@@ -40,3 +40,4 @@ status: experimental
tags: tags:
- attack.defense_evasion - attack.defense_evasion
- attack.t1027 - attack.t1027
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_stdin_services.yml
View File

@@ -25,3 +25,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_stdin_services_security.yml
View File

@@ -28,3 +28,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_var_services.yml
View File

@@ -25,3 +25,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_var_services_security.yml
View File

@@ -28,3 +28,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_via_compress_services.yml
View File

@@ -25,3 +25,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_via_compress_services_security.yml
View File

@@ -28,3 +28,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_via_rundll_services.yml
View File

@@ -25,3 +25,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_via_rundll_services_security.yml
View File

@@ -28,3 +28,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_via_stdin_services.yml
View File

@@ -25,3 +25,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_via_stdin_services_security.yml
View File

@@ -28,3 +28,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_via_use_clip_services.yml
View File

@@ -25,3 +25,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_via_use_clip_services_security.yml
View File

@@ -28,3 +28,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_via_use_mshta_services.yml
View File

@@ -25,3 +25,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_via_use_mshta_services_security.yml
View File

@@ -28,3 +28,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_via_use_rundll32_services.yml
View File

@@ -25,3 +25,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_via_use_rundll32_services_security.yml
View File

@@ -28,3 +28,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_via_var_services.yml
View File

@@ -25,3 +25,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_invoke_obfuscation_via_var_services_security.yml
View File

@@ -28,3 +28,4 @@ tags:
- attack.t1027 - attack.t1027
- attack.execution - attack.execution
- attack.t1059.001 - attack.t1059.001
ruletype: SIGMA

1
rules/sigma/builtin/win_iso_mount.yml
View File

@@ -34,3 +34,4 @@ status: experimental
tags: tags:
- attack.initial_access - attack.initial_access
- attack.t1566.001 - attack.t1566.001
ruletype: SIGMA

1
rules/sigma/builtin/win_lm_namedpipe.yml
View File

@@ -51,3 +51,4 @@ tags:
- attack.lateral_movement - attack.lateral_movement
- attack.t1077 - attack.t1077
- attack.t1021.002 - attack.t1021.002
ruletype: SIGMA

1
rules/sigma/builtin/win_lolbas_execution_of_nltest.yml
View File

@@ -32,3 +32,4 @@ tags:
- attack.t1482 - attack.t1482
- attack.t1018 - attack.t1018
- attack.t1016 - attack.t1016
ruletype: SIGMA

1
rules/sigma/builtin/win_lsass_access_non_system_account.yml
View File

@@ -67,3 +67,4 @@ tags:
- attack.credential_access - attack.credential_access
- attack.t1003 - attack.t1003
- attack.t1003.001 - attack.t1003.001
ruletype: SIGMA

1
rules/sigma/builtin/win_mal_creddumper.yml
View File

@@ -40,3 +40,4 @@ tags:
- attack.t1035 - attack.t1035
- attack.t1569.002 - attack.t1569.002
- attack.s0005 - attack.s0005
ruletype: SIGMA

1
rules/sigma/builtin/win_mal_wceaux_dll.yml
View File

@@ -31,3 +31,4 @@ tags:
- attack.credential_access - attack.credential_access
- attack.t1003 - attack.t1003
- attack.s0005 - attack.s0005
ruletype: SIGMA

1
rules/sigma/builtin/win_metasploit_authentication.yml
View File

@@ -37,3 +37,4 @@ tags:
- attack.lateral_movement - attack.lateral_movement
- attack.t1077 - attack.t1077
- attack.t1021.002 - attack.t1021.002
ruletype: SIGMA

1
rules/sigma/builtin/win_meterpreter_or_cobaltstrike_getsystem_service_installation.yml
View File

@@ -63,3 +63,4 @@ tags:
- attack.t1134 - attack.t1134
- attack.t1134.001 - attack.t1134.001
- attack.t1134.002 - attack.t1134.002
ruletype: SIGMA

1
rules/sigma/builtin/win_mmc20_lateral_movement.yml
View File

@@ -31,3 +31,4 @@ tags:
- attack.execution - attack.execution
- attack.t1175 - attack.t1175
- attack.t1021.003 - attack.t1021.003
ruletype: SIGMA

1
rules/sigma/builtin/win_moriya_rootkit.yml
View File

@@ -25,3 +25,4 @@ tags:
- attack.persistence - attack.persistence
- attack.privilege_escalation - attack.privilege_escalation
- attack.t1543.003 - attack.t1543.003
ruletype: SIGMA

1
rules/sigma/builtin/win_net_ntlm_downgrade.yml
View File

@@ -38,3 +38,4 @@ tags:
- attack.t1089 - attack.t1089
- attack.t1562.001 - attack.t1562.001
- attack.t1112 - attack.t1112
ruletype: SIGMA

1
rules/sigma/builtin/win_net_use_admin_share.yml
View File

@@ -30,3 +30,4 @@ status: experimental
tags: tags:
- attack.lateral_movement - attack.lateral_movement
- attack.t1021.002 - attack.t1021.002
ruletype: SIGMA

1
rules/sigma/builtin/win_new_or_renamed_user_account_with_dollar_sign.yml
View File

@@ -27,3 +27,4 @@ status: experimental
tags: tags:
- attack.defense_evasion - attack.defense_evasion
- attack.t1036 - attack.t1036
ruletype: SIGMA

1
rules/sigma/builtin/win_not_allowed_rdp_access.yml
View File

@@ -28,3 +28,4 @@ tags:
- attack.lateral_movement - attack.lateral_movement
- attack.t1076 - attack.t1076
- attack.t1021.001 - attack.t1021.001
ruletype: SIGMA

1
rules/sigma/builtin/win_ntfs_vuln_exploit.yml
View File

@@ -31,3 +31,4 @@ status: experimental
tags: tags:
- attack.impact - attack.impact
- attack.t1499.001 - attack.t1499.001
ruletype: SIGMA

1
rules/sigma/builtin/win_overpass_the_hash.yml
View File

@@ -29,3 +29,4 @@ tags:
- attack.t1075 - attack.t1075
- attack.s0002 - attack.s0002
- attack.t1550.002 - attack.t1550.002
ruletype: SIGMA

1
rules/sigma/builtin/win_pass_the_hash.yml
View File

@@ -40,3 +40,4 @@ tags:
- attack.t1075 - attack.t1075
- car.2016-04-004 - car.2016-04-004
- attack.t1550.002 - attack.t1550.002
ruletype: SIGMA

1
rules/sigma/builtin/win_pass_the_hash_2.yml
View File

@@ -42,3 +42,4 @@ tags:
- attack.lateral_movement - attack.lateral_movement
- attack.t1075 - attack.t1075
- attack.t1550.002 - attack.t1550.002
ruletype: SIGMA

1
rules/sigma/builtin/win_petitpotam_network_share.yml
View File

@@ -31,3 +31,4 @@ status: experimental
tags: tags:
- attack.credential_access - attack.credential_access
- attack.t1187 - attack.t1187
ruletype: SIGMA

1
rules/sigma/builtin/win_petitpotam_susp_tgt_request.yml
View File

@@ -41,3 +41,4 @@ status: experimental
tags: tags:
- attack.credential_access - attack.credential_access
- attack.t1187 - attack.t1187
ruletype: SIGMA

1
rules/sigma/builtin/win_possible_dc_shadow.yml
View File

@@ -32,3 +32,4 @@ status: experimental
tags: tags:
- attack.credential_access - attack.credential_access
- attack.t1207 - attack.t1207
ruletype: SIGMA

1
rules/sigma/builtin/win_powershell_script_installed_as_service.yml
View File

@@ -25,3 +25,4 @@ status: experimental
tags: tags:
- attack.execution - attack.execution
- attack.t1569.002 - attack.t1569.002
ruletype: SIGMA

1
rules/sigma/builtin/win_privesc_cve_2020_1472.yml
View File

@@ -29,3 +29,4 @@ status: experimental
tags: tags:
- attack.t1068 - attack.t1068
- attack.privilege_escalation - attack.privilege_escalation
ruletype: SIGMA

1
rules/sigma/builtin/win_protected_storage_service_access.yml
View File

@@ -27,3 +27,4 @@ tags:
- attack.lateral_movement - attack.lateral_movement
- attack.t1021 - attack.t1021
- attack.t1021.002 - attack.t1021.002
ruletype: SIGMA

Some files were not shown because too many files have changed in this diff Show More