Added Sigma Rules

rules/Sigma/win_powershell_b64_shellcode.yml

@@ -0,0 +1,31 @@
+title: PowerShell Base64 Encoded Shellcode
+author: Florian Roth
+date: 2018/11/17
+description: Detects Base64 encoded Shellcode
+detection:
+    SELECTION_1:
+        EventID: 1
+    SELECTION_2:
+        CommandLine: '*AAAAYInlM*'
+    SELECTION_3:
+        CommandLine: '*OiCAAAAYInlM*'
+    SELECTION_4:
+        CommandLine: '*OiJAAAAYInlM*'
+    condition: (SELECTION_1 and SELECTION_2 and (SELECTION_3 or SELECTION_4))
+falsepositives:
+- Unknown
+id: 2d117e49-e626-4c7c-bd1f-c3c0147774c8
+level: critical
+logsource:
+    category: process_creation
+    product: windows
+modified: 2020/09/01
+references:
+- https://twitter.com/cyb3rops/status/1063072865992523776
+status: experimental
+tags:
+- attack.defense_evasion
+- attack.t1027
+yml_filename: win_powershell_b64_shellcode.yml
+yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/process_creation
+