Added Sigma Rules

2021-11-14 11:00:56 +09:00
parent ac3ea7b20b
commit 50aebce32e
1078 changed files with 45490 additions and 0 deletions
@@ -0,0 +1,38 @@
+title: PowerShell as a Service in Registry
+author: oscd.community, Natalia Shornikova
+date: 2020/10/06
+description: Detects that a powershell code is written to the registry as a service.
+detection:
+    SELECTION_1:
+        EventID: 12
+    SELECTION_2:
+        EventID: 13
+    SELECTION_3:
+        EventID: 14
+    SELECTION_4:
+        TargetObject: '*\Services\\*'
+    SELECTION_5:
+        TargetObject: '*\ImagePath'
+    SELECTION_6:
+        Details: '*powershell*'
+    SELECTION_7:
+        Details: '*pwsh*'
+    condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4 and SELECTION_5
+        and (SELECTION_6 or SELECTION_7))
+falsepositives:
+- Unknown
+id: 4a5f5a5e-ac01-474b-9b4e-d61298c9df1d
+level: high
+logsource:
+    category: registry_event
+    product: windows
+modified: 2021/05/21
+references:
+- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
+status: experimental
+tags:
+- attack.execution
+- attack.t1569.002
+yml_filename: sysmon_powershell_as_service.yml
+yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/registry_event
+