Added Sigma Rules

rules/Sigma/sysmon_logon_scripts_userinitmprlogonscript_reg.yml

@@ -0,0 +1,34 @@
+title: Logon Scripts (UserInitMprLogonScript) Registry
+author: Tom Ueltschi (@c_APT_ure)
+date: 2019/01/12
+description: Detects creation or execution of UserInitMprLogonScript persistence method
+detection:
+    SELECTION_1:
+        EventID: 12
+    SELECTION_2:
+        EventID: 13
+    SELECTION_3:
+        EventID: 14
+    SELECTION_4:
+        TargetObject: '*UserInitMprLogonScript*'
+    condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4)
+falsepositives:
+- exclude legitimate logon scripts
+- penetration tests, red teaming
+id: 9ace0707-b560-49b8-b6ca-5148b42f39fb
+level: high
+logsource:
+    category: registry_event
+    product: windows
+modified: 2020/07/01
+references:
+- https://attack.mitre.org/techniques/T1037/
+status: experimental
+tags:
+- attack.t1037
+- attack.t1037.001
+- attack.persistence
+- attack.lateral_movement
+yml_filename: sysmon_logon_scripts_userinitmprlogonscript_reg.yml
+yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/registry_event
+