Feature/#140 document (#144)

* update

* fix regexes and whitelist

* underconstructing

* fix

* update

* add pic

* update

* update

* update

* fix

rules/deep_blue_cli/powershell/4103.yml

@@ -1,8 +1,6 @@
 title: PowerShell Execution Pipeline
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Microsoft-Windows-PowerShell/Operational
@@ -13,7 +11,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: medium
 output: 'command=%CommandLine%'
 creation_date: 2020/11/8
 updated_date: 2020/11/8

rules/deep_blue_cli/powershell/4104.yml

@@ -1,8 +1,6 @@
 title: PowerShell Execution Remote Command
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Microsoft-Windows-PowerShell/Operational
@@ -12,7 +10,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: medium
 output: 'command=%ScriptBlockText%'
 creation_date: 2020/11/8
 updated_date: 2020/11/8

rules/deep_blue_cli/security/1102.yml

@@ -1,8 +1,6 @@
 title: The Audit log file was cleared
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Security
@@ -10,7 +8,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: medium
 output: |
     Audit Log Clear 
     The Audit log was cleared.

rules/deep_blue_cli/security/4673.yml

@@ -1,8 +1,6 @@
 title: Sensitive Privilede Use (Mimikatz)
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Security
@@ -10,7 +8,6 @@ detection:
     # condition: selection | count(EventID) >  4
 falsepositives:
     - unknown
-level: medium
 output: |
     Sensitive Privilege Use Exceeds Threshold
     Potentially indicative of Mimikatz, multiple sensitive priviledge calls have been made.

rules/deep_blue_cli/security/4674.yml

@@ -1,8 +1,6 @@
 title: An Operation was attempted on a privileged object
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Security
@@ -12,7 +10,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: medium
 output: |
     Possible Hidden Service Attempt
     User requested to modify the Dynamic Access Control (DAC) permissions of a service, possibly to hide it from view.

rules/deep_blue_cli/security/4688.yml

@@ -1,8 +1,6 @@
 title: Command Line Logging
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Security
@@ -11,7 +9,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: medium
 output: 'CommandLine:%CommandLine% ParentProcessName:%ParentProcessName%'
 creation_date: 2020/11/8
 updated_date: 2020/11/8

rules/deep_blue_cli/security/4720.yml

@@ -1,8 +1,6 @@
 title: A user account was created.
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Security
@@ -10,7 +8,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: low
 output: 'New User Created UserName:%TargetUserName% SID:%TargetSid%'
 creation_date: 2020/11/8
 updated_date: 2020/11/8

rules/deep_blue_cli/security/4728.yml

@@ -1,8 +1,6 @@
 title: A member was added to a security-enabled global group.
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Security
@@ -11,7 +9,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: low
 output: 'user added to global Administrators UserName: %MemberName% SID: %MemberSid%'
 creation_date: 2020/11/8
 updated_date: 2020/11/8

rules/deep_blue_cli/security/4732.yml

@@ -1,8 +1,6 @@
 title: A member was added to a security-enabled local group.
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Security
@@ -11,7 +9,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: low
 output: 'user added to local Administrators UserName: %MemberName% SID: %MemberSid%'
 creation_date: 2020/11/8
 updated_date: 2020/11/8

rules/deep_blue_cli/security/4756.yml

@@ -1,8 +1,6 @@
 title: A member was added to a security-enabled universal group.
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Security
@@ -11,7 +9,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: low
 output: 'user added to universal Administrators UserName: %MemberName% SID: %MemberSid%'
 creation_date: 2020/11/8
 updated_date: 2020/11/8

rules/deep_blue_cli/security/_4625.yml

@@ -2,8 +2,6 @@ title: An account failed to log on
 description: hogehoge
 ignore: true
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Security
@@ -11,7 +9,6 @@ detection:
     # condition: selection | count(TargetUserName) > 3
 falsepositives:
     - unknown
-level: medium
 output: 'High number of logon failures for one account UserName:%event_data.SubjectUserName% Total logon faiures:%count%'
 creation_date: 2020/11/8
 updated_date: 2020/11/8

rules/deep_blue_cli/security/_4648.yml

@@ -2,8 +2,6 @@ title: An account failed to log on
 description: hogehoge
 ignore: true
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Security
@@ -11,7 +9,6 @@ detection:
     # condition: selection | count(TargetUserName) > 3
 falsepositives:
     - unknown
-level: High
 output: 'Distributed Account Explicit Credential Use (Password Spray Attack)¥n The use of multiple user account access attempts with explicit credentials is ¥nan indicator of a password spray attack.¥nTarget Usernames:%TargetUserName$¥nAccessing Username: %SubjectUserName%¥nAccessing Host Name: %SubjectDomainName%'
 creation_date: 2020/11/8
 updated_date: 2020/11/8

rules/deep_blue_cli/security/_4672.yml

@@ -2,8 +2,6 @@ title: Command Line Logging
 description: hogehoge
 ignore: true
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Security
@@ -12,7 +10,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: medium
 output: 'CommandLine:%CommandLine% ParentProcessName:%ParentProcessName%'
 creation_date: 2020/11/8
 updated_date: 2020/11/8

rules/deep_blue_cli/sysmon/1.yml

@@ -1,8 +1,6 @@
 title: Sysmon Check command lines
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Sysmon
@@ -11,7 +9,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: medium
 output: 'CommandLine=%CommandLine%¥nParentImage=%ParentImage%'
 creation_date: 2020/11/8
 uodated_date: 2020/11/8

rules/deep_blue_cli/sysmon/7.yml

@@ -1,8 +1,6 @@
 title: Check for unsigned EXEs/DLLs
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Sysmon
@@ -11,7 +9,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: low
 output: 'Message: Unsigned Image(DLL)¥n Result : Loaded by: %event_data.Image%¥nCommand : %event_data.ImageLoaded%'
 creation_date: 2020/11/8
 uodated_date: 2020/11/8

rules/deep_blue_cli/system/104.yml

@@ -1,8 +1,6 @@
 title: The System log file was cleared
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: System
@@ -10,7 +8,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: medium
 output: 'System Log Clear¥nThe System log was cleared.'
 creation_date: 2020/11/8
 uodated_date: 2020/11/8

rules/deep_blue_cli/system/7030.yml

@@ -1,8 +1,6 @@
 title: This service may not function properly
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: System
@@ -12,7 +10,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: low
 output: 'Interactive service warning¥nService name: %ServiceName%¥nMalware (and some third party software) trigger this warning'
 creation_date: 2020/11/8
 uodated_date: 2020/11/8

rules/deep_blue_cli/system/7036.yml

@@ -1,8 +1,6 @@
 title: The ... service entered the stopped|running state
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: System
@@ -12,7 +10,6 @@ detection:
     condition: selection
 falsepositives:
     - unknown
-level: low
 output: 'Suspicious Service Name¥nService name: %ServiceName%'
 creation_date: 2020/11/8
 uodated_date: 2020/11/8

rules/deep_blue_cli/system/7040.yml

@@ -1,8 +1,6 @@
 title: The start type of the Windows Event Log service was changed from auto start to disabled
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: System
@@ -14,7 +12,6 @@ detection:
     condition: selection
 falsepositives:
     - unknown
-level: low
 output: 'Service name : %param1%¥nMessage : Event Log Service Stopped¥nResults: Selective event log manipulation may follow this event.'
 creation_date: 2020/11/8
 uodated_date: 2020/11/8

rules/deep_blue_cli/system/7045.yml

@@ -1,8 +1,6 @@
 title: A service was installed in the system
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: System
@@ -15,7 +13,6 @@ detection:
     condition: selection
 falsepositives:
     - unknown
-level: low
 output: 'New Service Created¥n%ImagePath¥nService name: %ServiceName%'
 creation_date: 2020/11/8
 uodated_date: 2020/11/8