Added Sigma Rules

rules/Sigma/sysmon_logon_scripts_userinitmprlogonscript_proc.yml

@@ -0,0 +1,40 @@
+title: Logon Scripts (UserInitMprLogonScript)
+author: Tom Ueltschi (@c_APT_ure)
+date: 2019/01/12
+description: Detects creation or execution of UserInitMprLogonScript persistence method
+detection:
+    SELECTION_1:
+        EventID: 1
+    SELECTION_2:
+        EventID: 1
+    SELECTION_3:
+        ParentImage: '*\userinit.exe'
+    SELECTION_4:
+        Image: '*\explorer.exe'
+    SELECTION_5:
+        CommandLine: '*netlogon.bat*'
+    SELECTION_6:
+        CommandLine: '*UsrLogon.cmd*'
+    SELECTION_7:
+        CommandLine: '*UserInitMprLogonScript*'
+    condition: (SELECTION_1 and ((SELECTION_2 and (SELECTION_3 and  not (SELECTION_4))
+        and  not ((SELECTION_5 or SELECTION_6))) or SELECTION_7))
+falsepositives:
+- exclude legitimate logon scripts
+- penetration tests, red teaming
+id: 0a98a10c-685d-4ab0-bddc-b6bdd1d48458
+level: high
+logsource:
+    category: process_creation
+    product: windows
+modified: 2020/08/26
+references:
+- https://attack.mitre.org/techniques/T1037/
+status: experimental
+tags:
+- attack.t1037
+- attack.t1037.001
+- attack.persistence
+yml_filename: sysmon_logon_scripts_userinitmprlogonscript_proc.yml
+yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/process_creation
+