Feature/rm submodule (#312)

* rm: submodule * Add: rules * Fix: hayabusa-rules to c9c10a
2021-12-20 21:14:32 +09:00
parent 1aebdca160
commit 83d891b2fa
1196 changed files with 46186 additions and 4 deletions
@@ -0,0 +1,49 @@
+
+title: Suspicious MSHTA Process Patterns
+ruletype: Sigma
+author: Florian Roth
+date: 2021/07/17
+description: Detects suspicious mshta process patterns
+detection:
+  SELECTION_1:
+    EventID: 1
+  SELECTION_2:
+    Image: '*\mshta.exe'
+  SELECTION_3:
+    ParentImage:
+    - '*\cmd.exe'
+    - '*\powershell.exe'
+  SELECTION_4:
+    CommandLine:
+    - '*\AppData\Local*'
+    - '*C:\Windows\Temp*'
+    - '*C:\Users\Public*'
+  SELECTION_5:
+    Image:
+    - '*C:\Windows\System32*'
+    - '*C:\Windows\SysWOW64*'
+  SELECTION_6:
+    CommandLine:
+    - '*.htm*'
+    - '*.hta*'
+  SELECTION_7:
+    CommandLine:
+    - '*mshta.exe'
+    - '*mshta'
+  condition: (SELECTION_1 and SELECTION_2 and (((SELECTION_3 or SELECTION_4) or  not
+    (SELECTION_5)) or  not (SELECTION_6 and SELECTION_7)))
+falsepositives:
+- Unknown
+id: e32f92d1-523e-49c3-9374-bdb13b46a3ba
+level: high
+logsource:
+  category: process_creation
+  product: windows
+references:
+- https://en.wikipedia.org/wiki/HTML_Application
+- https://www.echotrail.io/insights/search/mshta.exe
+- https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/
+status: experimental
+tags:
+- attack.execution
+- attack.t1106