Added Sigma Rules

2021-11-14 11:00:56 +09:00
parent ac3ea7b20b
commit 50aebce32e
1078 changed files with 45490 additions and 0 deletions
@@ -0,0 +1,27 @@
+title: SyncAppvPublishingServer Execution to Bypass Powershell Restriction
+author: "Ensar \u015Eamil, @sblmsrsn, OSCD Community"
+date: 2020/10/05
+description: Detects SyncAppvPublishingServer process execution which usually utilized
+    by adversaries to bypass PowerShell execution restrictions.
+detection:
+    condition: SyncAppvPublishingServer.exe
+falsepositives:
+- App-V clients
+id: 9f7aa113-9da6-4a8d-907c-5f1a4b908299
+level: medium
+logsource:
+    product: windows
+    service: powershell
+modified: 2021/09/11
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/
+related:
+-   id: fde7929d-8beb-4a4c-b922-be9974671667
+    type: derived
+status: deprecated
+tags:
+- attack.defense_evasion
+- attack.t1218
+yml_filename: powershell_syncappvpublishingserver_exe.yml
+yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/deprecated
+