Added Sigma Rules

rules/Sigma/win_vul_java_remote_debugging.yml

@@ -0,0 +1,32 @@
+title: Java Running with Remote Debugging
+author: Florian Roth
+date: 2019/01/16
+description: Detects a JAVA process running with remote debugging allowing more than
+    just localhost to connect
+detection:
+    SELECTION_1:
+        EventID: 1
+    SELECTION_2:
+        CommandLine: '*transport=dt_socket,address=*'
+    SELECTION_3:
+        CommandLine: '*address=127.0.0.1*'
+    SELECTION_4:
+        CommandLine: '*address=localhost*'
+    condition: (SELECTION_1 and SELECTION_2 and  not (SELECTION_3 or SELECTION_4))
+falsepositives:
+- unknown
+fields:
+- CommandLine
+- ParentCommandLine
+id: 8f88e3f6-2a49-48f5-a5c4-2f7eedf78710
+level: medium
+logsource:
+    category: process_creation
+    product: windows
+modified: 2020/08/29
+tags:
+- attack.t1203
+- attack.execution
+yml_filename: win_vul_java_remote_debugging.yml
+yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/process_creation
+