change rules dir structure. addlogon timeline.

rules/alert-rules/sigma/sysmon_win_binary_github_com.yml

@@ -0,0 +1,39 @@
+title: Microsoft Binary Github Communication
+author: Michael Haag (idea), Florian Roth (rule)
+date: 2017/08/24
+description: Detects an executable in the Windows folder accessing github.com
+detection:
+    SELECTION_1:
+        EventID: 3
+    SELECTION_2:
+        Initiated: 'true'
+    SELECTION_3:
+        DestinationHostname: '*.github.com'
+    SELECTION_4:
+        DestinationHostname: '*.githubusercontent.com'
+    SELECTION_5:
+        Image: C:\Windows\\*
+    condition: (SELECTION_1 and SELECTION_2 and (SELECTION_3 or SELECTION_4) and SELECTION_5)
+falsepositives:
+- Unknown
+- '@subTee in your network'
+id: 635dbb88-67b3-4b41-9ea5-a3af2dd88153
+level: high
+logsource:
+    category: network_connection
+    product: windows
+modified: 2020/08/24
+references:
+- https://twitter.com/M_haggis/status/900741347035889665
+- https://twitter.com/M_haggis/status/1032799638213066752
+- https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/exfil/Invoke-ExfilDataToGitHub.ps1
+status: experimental
+tags:
+- attack.lateral_movement
+- attack.t1105
+- attack.exfiltration
+- attack.t1567.001
+- attack.t1048
+yml_filename: sysmon_win_binary_github_com.yml
+yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/network_connection
+