Feature/rm submodule (#312)

* rm: submodule * Add: rules * Fix: hayabusa-rules to c9c10a
2021-12-20 21:14:32 +09:00
parent 1aebdca160
commit 83d891b2fa
1196 changed files with 46186 additions and 4 deletions
@@ -0,0 +1,38 @@
+
+title: smbexec.py Service Installation
+ruletype: Sigma
+author: Omer Faruk Celik
+date: 2018/03/20
+description: Detects the use of smbexec.py tool by detecting a specific service installation
+detection:
+  SELECTION_1:
+    Provider_Name: Service Control Manager
+  SELECTION_2:
+    EventID: 7045
+  SELECTION_3:
+    ServiceName: BTOBTO
+  SELECTION_4:
+    ServiceFileName: '*\execute.bat'
+  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4)
+falsepositives:
+- Penetration Test
+- Unknown
+fields:
+- ServiceName
+- ServiceFileName
+id: 52a85084-6989-40c3-8f32-091e12e13f09
+level: critical
+logsource:
+  product: windows
+  service: system
+modified: 2021/11/30
+references:
+- https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-2-psexec-and-services/
+status: test
+tags:
+- attack.lateral_movement
+- attack.execution
+- attack.t1077
+- attack.t1021.002
+- attack.t1035
+- attack.t1569.002