Feature/rm submodule (#312)

* rm: submodule * Add: rules * Fix: hayabusa-rules to c9c10a
2021-12-20 21:14:32 +09:00
parent 1aebdca160
commit 83d891b2fa
1196 changed files with 46186 additions and 4 deletions
@@ -0,0 +1,26 @@
+
+title: PsExec Service Start
+ruletype: Sigma
+author: Florian Roth
+date: 2018/03/13
+description: Detects a PsExec service start
+detection:
+  SELECTION_1:
+    EventID: 1
+  SELECTION_2:
+    CommandLine: C:\Windows\PSEXESVC.exe
+  condition: (SELECTION_1 and SELECTION_2)
+falsepositives:
+- Administrative activity
+id: 3ede524d-21cc-472d-a3ce-d21b568d8db7
+level: low
+logsource:
+  category: process_creation
+  product: windows
+modified: 2021/11/27
+status: test
+tags:
+- attack.execution
+- attack.t1035
+- attack.s0029
+- attack.t1569.002