Added Sigma Rules

2021-11-14 11:00:56 +09:00
parent ac3ea7b20b
commit 50aebce32e
1078 changed files with 45490 additions and 0 deletions
@@ -0,0 +1,30 @@
+title: External Disk Drive Or USB Storage Device
+author: Keith Wright
+date: 2019/11/20
+description: Detects external diskdrives or plugged in USB devices , EventID 6416
+    on windows 10 or later
+detection:
+    SELECTION_1:
+        EventID: 6416
+    SELECTION_2:
+        ClassName: DiskDrive
+    SELECTION_3:
+        DeviceDescription: USB Mass Storage Device
+    condition: ((SELECTION_1 and SELECTION_2) or SELECTION_3)
+falsepositives:
+- Legitimate administrative activity
+id: f69a87ea-955e-4fb4-adb2-bb9fd6685632
+level: low
+logsource:
+    product: windows
+    service: security
+modified: 2021/08/09
+status: experimental
+tags:
+- attack.t1091
+- attack.t1200
+- attack.lateral_movement
+- attack.initial_access
+yml_filename: win_external_device.yml
+yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/builtin
+