Added Sigma Rules

rules/Sigma/sysmon_in_memory_powershell.yml

@@ -0,0 +1,66 @@
+title: In-memory PowerShell
+author: Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton
+date: 2019/11/14
+description: Detects loading of essential DLL used by PowerShell, but not by the process
+    powershell.exe. Detects meterpreter's "load powershell" extension.
+detection:
+    SELECTION_1:
+        EventID: 7
+    SELECTION_10:
+        Image: '*\wsmprovhost.exe'
+    SELECTION_11:
+        Image: '*\winrshost.exe'
+    SELECTION_12:
+        Image: '*\syncappvpublishingserver.exe'
+    SELECTION_13:
+        Image: '*\runscripthelper.exe'
+    SELECTION_14:
+        Image: '*\ServerManager.exe'
+    SELECTION_15:
+        Image: '*\Microsoft SQL Server Management Studio *\Common*\IDE\Ssms.exe'
+    SELECTION_2:
+        ImageLoaded: '*\System.Management.Automation.Dll'
+    SELECTION_3:
+        ImageLoaded: '*\System.Management.Automation.ni.Dll'
+    SELECTION_4:
+        Image: '*\powershell.exe'
+    SELECTION_5:
+        Image: '*\powershell_ise.exe'
+    SELECTION_6:
+        Image: '*\WINDOWS\System32\sdiagnhost.exe'
+    SELECTION_7:
+        Image: '*\mscorsvw.exe'
+    SELECTION_8:
+        Image: '*\WINDOWS\System32\RemoteFXvGPUDisablement.exe'
+    SELECTION_9:
+        Image: '*\sqlps.exe'
+    condition: (SELECTION_1 and (SELECTION_2 or SELECTION_3) and  not ((SELECTION_4
+        or SELECTION_5 or SELECTION_6 or SELECTION_7 or SELECTION_8 or SELECTION_9
+        or SELECTION_10 or SELECTION_11 or SELECTION_12 or SELECTION_13 or SELECTION_14
+        or SELECTION_15)))
+enrichment:
+- EN_0001_cache_sysmon_event_id_1_info
+- EN_0003_enrich_other_sysmon_events_with_event_id_1_data
+falsepositives:
+- Used by some .NET binaries, minimal on user workstation.
+- Used by Microsoft SQL Server Management Studio
+id: 092bc4b9-3d1d-43b4-a6b4-8c8acd83522f
+level: high
+logsource:
+    category: image_load
+    product: windows
+modified: 2021/11/11
+references:
+- https://adsecurity.org/?p=2921
+- https://github.com/p3nt4/PowerShdll
+related:
+-   id: 867613fb-fa60-4497-a017-a82df74a172c
+    type: obsoletes
+status: experimental
+tags:
+- attack.t1086
+- attack.t1059.001
+- attack.execution
+yml_filename: sysmon_in_memory_powershell.yml
+yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/image_load
+