Added Sigma Rules

2021-11-14 11:00:56 +09:00
parent ac3ea7b20b
commit 50aebce32e
1078 changed files with 45490 additions and 0 deletions
@@ -0,0 +1,32 @@
+title: Suspicious XOR Encoded PowerShell Command Line
+author: Teymur Kheirkhabarov, Harish Segar (rule)
+date: 2020/06/29
+description: Detects suspicious powershell process which includes bxor command, alternative
+    obfuscation method to b64 encoded commands.
+detection:
+    SELECTION_1:
+        HostName: ConsoleHost
+    SELECTION_2:
+        HostApplication: '*bxor*'
+    SELECTION_3:
+        HostApplication: '*join*'
+    SELECTION_4:
+        HostApplication: '*char*'
+    condition: (SELECTION_1 and (SELECTION_2 or SELECTION_3 or SELECTION_4))
+falsepositives:
+- unknown
+id: 812837bb-b17f-45e9-8bd0-0ec35d2e3bd6
+level: medium
+logsource:
+    category: ps_classic_start
+    definition: fields have to be extract from event
+    product: windows
+modified: 2021/10/16
+status: experimental
+tags:
+- attack.execution
+- attack.t1059.001
+- attack.t1086
+yml_filename: powershell_xor_commandline.yml
+yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/powershell/powershell_classic
+