Added Sigma Rules

rules/Sigma/sysmon_hack_wce_reg.yml

@@ -0,0 +1,32 @@
+title: Windows Credential Editor Registry
+author: Florian Roth
+date: 2019/12/31
+description: Detects the use of Windows Credential Editor (WCE)
+detection:
+    SELECTION_1:
+        EventID: 12
+    SELECTION_2:
+        EventID: 13
+    SELECTION_3:
+        EventID: 14
+    SELECTION_4:
+        TargetObject: '*Services\WCESERVICE\Start*'
+    condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4)
+falsepositives:
+- Unknown
+id: a6b33c02-8305-488f-8585-03cb2a7763f2
+level: critical
+logsource:
+    category: registry_event
+    product: windows
+modified: 2020/09/06
+references:
+- https://www.ampliasecurity.com/research/windows-credentials-editor/
+tags:
+- attack.credential_access
+- attack.t1003
+- attack.t1003.001
+- attack.s0005
+yml_filename: sysmon_hack_wce_reg.yml
+yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/registry_event
+