Added Sigma Rules

rules/Sigma/sysmon_susp_webdav_client_execution.yml

@@ -0,0 +1,31 @@
+title: Suspicious WebDav Client Execution
+author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
+date: 2020/05/02
+description: A General detection for svchost.exe spawning rundll32.exe with command
+    arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an
+    indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server).
+detection:
+    SELECTION_1:
+        EventID: 1
+    SELECTION_2:
+        Image: '*\rundll32.exe'
+    SELECTION_3:
+        CommandLine: '*C:\windows\system32\davclnt.dll,DavSetCookie*'
+    condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
+falsepositives:
+- unknown
+id: 2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5
+level: medium
+logsource:
+    category: process_creation
+    product: windows
+references:
+- https://github.com/OTRF/detection-hackathon-apt29/issues/17
+- https://threathunterplaybook.com/evals/apt29/detections/7.B.4_C10730EA-6345-4934-AA0F-B0EFCA0C4BA6.html
+status: experimental
+tags:
+- attack.exfiltration
+- attack.t1048.003
+yml_filename: sysmon_susp_webdav_client_execution.yml
+yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/process_creation
+