Feature/rm submodule (#312)

* rm: submodule * Add: rules * Fix: hayabusa-rules to c9c10a
2021-12-20 21:14:32 +09:00
parent 1aebdca160
commit 83d891b2fa
1196 changed files with 46186 additions and 4 deletions
@@ -0,0 +1,30 @@
+
+title: USB Device Plugged
+ruletype: Sigma
+author: Florian Roth
+date: 2017/11/09
+description: Detects plugged USB devices
+detection:
+  SELECTION_1:
+    EventID: 2003
+  SELECTION_2:
+    EventID: 2100
+  SELECTION_3:
+    EventID: 2102
+  condition: (SELECTION_1 or SELECTION_2 or SELECTION_3)
+falsepositives:
+- Legitimate administrative activity
+id: 1a4bd6e3-4c6e-405d-a9a3-53a116e341d4
+level: low
+logsource:
+  definition: mapping Provider_Name 'Microsoft-Windows-DriverFrameworks-UserMode/Operational'
+  product: windows
+  service: driver-framework
+modified: 2021/11/30
+references:
+- https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/
+- https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/
+status: test
+tags:
+- attack.initial_access
+- attack.t1200