Merge pull request SigmaHQ#4161 from SigmaHQ/emerging-threats

feat: new folder structure and other updates
SavinSpring · Apr 21, 2023 · 6bd5f42 · 6bd5f42
2 parents f42d6dc + 0c23616
commit 6bd5f42
Show file tree

Hide file tree

Showing 144 changed files with 52 additions and 19 deletions.
diff --git a/documentation/README.md b/documentation/README.md
diff --git a/...ation/logsource-guides/other/antivirus.md → ...ation/logsource-guides/other/antivirus.md b/...ation/logsource-guides/other/antivirus.md → ...ation/logsource-guides/other/antivirus.md
diff --git a/...ides/windows/category/process_creation.md → ...ides/windows/category/process_creation.md b/...ides/windows/category/process_creation.md → ...ides/windows/category/process_creation.md
diff --git a/...urce-guides/windows/category/ps_module.md → ...urce-guides/windows/category/ps_module.md b/...urce-guides/windows/category/ps_module.md → ...urce-guides/windows/category/ps_module.md
diff --git a/...urce-guides/windows/category/ps_script.md → ...urce-guides/windows/category/ps_script.md b/...urce-guides/windows/category/ps_script.md → ...urce-guides/windows/category/ps_script.md
diff --git a/...e-guides/windows/category/registry_add.md → ...e-guides/windows/category/registry_add.md b/...e-guides/windows/category/registry_add.md → ...e-guides/windows/category/registry_add.md
diff --git a/...uides/windows/category/registry_delete.md → ...uides/windows/category/registry_delete.md b/...uides/windows/category/registry_delete.md → ...uides/windows/category/registry_delete.md
diff --git a/...guides/windows/category/registry_event.md → ...guides/windows/category/registry_event.md b/...guides/windows/category/registry_event.md → ...guides/windows/category/registry_event.md
diff --git a/...uides/windows/category/registry_rename.md → ...uides/windows/category/registry_rename.md b/...uides/windows/category/registry_rename.md → ...uides/windows/category/registry_rename.md
diff --git a/...e-guides/windows/category/registry_set.md → ...e-guides/windows/category/registry_set.md b/...e-guides/windows/category/registry_set.md → ...e-guides/windows/category/registry_set.md
diff --git a/...urce-guides/windows/service/powershell.md → ...urce-guides/windows/service/powershell.md b/...urce-guides/windows/service/powershell.md → ...urce-guides/windows/service/powershell.md
diff --git a/...source-guides/windows/service/security.md → ...source-guides/windows/service/security.md b/...source-guides/windows/service/security.md → ...source-guides/windows/service/security.md
diff --git a/...entation/tools/sigma-logsource-checker.py → ...entation/tools/sigma-logsource-checker.py b/...entation/tools/sigma-logsource-checker.py → ...entation/tools/sigma-logsource-checker.py
diff --git a/rules-compliance/README.md b/rules-compliance/README.md
@@ -0,0 +1 @@
+TBD
diff --git a/rules-deprecated/README.md b/rules-deprecated/README.md
@@ -0,0 +1 @@
+TBD
diff --git a/...oxy_generic/proxy_apt_domestic_kitten.yml → ...recated/web/proxy_apt_domestic_kitten.yml b/...oxy_generic/proxy_apt_domestic_kitten.yml → ...recated/web/proxy_apt_domestic_kitten.yml
@@ -1,12 +1,12 @@
 title: Domestic Kitten FurBall Malware Pattern
 id: 6c939dfa-c710-4e12-a4dd-47e1f10e68e1
-status: test
+status: deprecated
 description: Detects specific malware patterns used by FurBall malware linked to Iranian Domestic Kitten APT group
 references:
     - https://research.checkpoint.com/2021/domestic-kitten-an-inside-look-at-the-iranian-surveillance-operations/
 author: Florian Roth (Nextron Systems)
 date: 2021/02/08
-modified: 2022/10/09
+modified: 2023/04/20
 tags:
     - attack.command_and_control
 logsource:

diff --git a/...n/proc_creation_win_apt_ta505_dropper.yml → ...s/proc_creation_win_apt_ta505_dropper.yml b/...n/proc_creation_win_apt_ta505_dropper.yml → ...s/proc_creation_win_apt_ta505_dropper.yml
@@ -1,12 +1,12 @@
 title: TA505 Dropper Load Pattern
 id: 18cf6cf0-39b0-4c22-9593-e244bdc9a2d4
-status: test
+status: deprecated
 description: Detects mshta loaded by wmiprvse as parent as used by TA505 malicious documents
 references:
     - https://twitter.com/ForensicITGuy/status/1334734244120309760
 author: Florian Roth (Nextron Systems)
 date: 2020/12/08
-modified: 2022/03/31
+modified: 2023/04/05
 tags:
     - attack.execution
     - attack.g0092

diff --git a/rules-dfir/README.md b/rules-dfir/README.md
@@ -0,0 +1 @@
+TBD
diff --git a/...c_creation_win_apt_apt10_cloud_hopper.yml → ...c_creation_win_apt_apt10_cloud_hopper.yml b/...c_creation_win_apt_apt10_cloud_hopper.yml → ...c_creation_win_apt_apt10_cloud_hopper.yml
diff --git a/...n_win_apt_lazarus_binary_masquerading.yml → ...n_win_apt_lazarus_binary_masquerading.yml b/...n_win_apt_lazarus_binary_masquerading.yml → ...n_win_apt_lazarus_binary_masquerading.yml
diff --git a/...creation_win_apt_apt27_emissary_panda.yml → ...creation_win_apt_apt27_emissary_panda.yml b/...creation_win_apt_apt27_emissary_panda.yml → ...creation_win_apt_apt27_emissary_panda.yml
diff --git a/...ozy_bear_phishing_campaign_indicators.yml → ...ozy_bear_phishing_campaign_indicators.yml b/...ozy_bear_phishing_campaign_indicators.yml → ...ozy_bear_phishing_campaign_indicators.yml
diff --git a/...pt_apt29_phishing_campaign_indicators.yml → ...pt_apt29_phishing_campaign_indicators.yml b/...pt_apt29_phishing_campaign_indicators.yml → ...pt_apt29_phishing_campaign_indicators.yml
diff --git a/...ecurity/win_security_apt_oilrig_mar18.yml → .../OilRig/win_security_apt_oilrig_mar18.yml b/...ecurity/win_security_apt_oilrig_mar18.yml → .../OilRig/win_security_apt_oilrig_mar18.yml
diff --git a/...l_manager/win_system_apt_oilrig_mar18.yml → ...18/OilRig/win_system_apt_oilrig_mar18.yml b/...l_manager/win_system_apt_oilrig_mar18.yml → ...18/OilRig/win_system_apt_oilrig_mar18.yml
diff --git a/..._creation_win_apt_aptc12_bluemushroom.yml → ..._creation_win_apt_aptc12_bluemushroom.yml b/..._creation_win_apt_aptc12_bluemushroom.yml → ..._creation_win_apt_aptc12_bluemushroom.yml
diff --git a/...reation_win_apt_apt31_judgement_panda.yml → ...reation_win_apt_apt31_judgement_panda.yml b/...reation_win_apt_apt31_judgement_panda.yml → ...reation_win_apt_apt31_judgement_panda.yml
diff --git a/...on/proc_creation_win_apt_empiremonkey.yml → ...ey/proc_creation_win_apt_empiremonkey.yml b/...on/proc_creation_win_apt_empiremonkey.yml → ...ey/proc_creation_win_apt_empiremonkey.yml
diff --git a/...tion_win_apt_equationgroup_dll_u_load.yml → ...tion_win_apt_equationgroup_dll_u_load.yml b/...tion_win_apt_equationgroup_dll_u_load.yml → ...tion_win_apt_equationgroup_dll_u_load.yml
diff --git a/...on/proc_creation_win_apt_mustangpanda.yml → ...da/proc_creation_win_apt_mustangpanda.yml b/...on/proc_creation_win_apt_mustangpanda.yml → ...da/proc_creation_win_apt_mustangpanda.yml
diff --git a/...n/proc_creation_win_apt_evilnum_jul20.yml → ...m/proc_creation_win_apt_evilnum_jul20.yml b/...n/proc_creation_win_apt_evilnum_jul20.yml → ...m/proc_creation_win_apt_evilnum_jul20.yml
diff --git a/...on/proc_creation_win_apt_gallium_iocs.yml → ...UM/proc_creation_win_apt_gallium_iocs.yml b/...on/proc_creation_win_apt_gallium_iocs.yml → ...UM/proc_creation_win_apt_gallium_iocs.yml
diff --git a/.../proc_creation_win_apt_greenbug_may20.yml → .../proc_creation_win_apt_greenbug_may20.yml b/.../proc_creation_win_apt_greenbug_may20.yml → .../proc_creation_win_apt_greenbug_may20.yml
diff --git a/...reation/proc_creation_win_apt_hafnium.yml → ...HAFNIUM/proc_creation_win_apt_hafnium.yml b/...reation/proc_creation_win_apt_hafnium.yml → ...HAFNIUM/proc_creation_win_apt_hafnium.yml
diff --git a/...on/proc_creation_win_apt_revil_kaseya.yml → ...in/proc_creation_win_apt_revil_kaseya.yml b/...on/proc_creation_win_apt_revil_kaseya.yml → ...in/proc_creation_win_apt_revil_kaseya.yml
diff --git a/...e_load/image_load_usp_svchost_clfsw32.yml → ...ATELOG/image_load_usp_svchost_clfsw32.yml b/...e_load/image_load_usp_svchost_clfsw32.yml → ...ATELOG/image_load_usp_svchost_clfsw32.yml
@@ -3,7 +3,7 @@ id: 33a2d1dd-f3b0-40bd-8baf-7974468927cc
 status: test
 description: Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances
 references:
-    - https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html
+    - https://web.archive.org/web/20210901184449/https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html
 author: Florian Roth (Nextron Systems)
 date: 2021/09/07
 modified: 2022/10/09

diff --git a/rules-emerging-threats/2021/Solarwinds-Supply-Chain/README.md b/rules-emerging-threats/2021/Solarwinds-Supply-Chain/README.md
diff --git a/...on/proc_creation_win_apt_unc2452_cmds.yml → ...in/proc_creation_win_apt_unc2452_cmds.yml b/...on/proc_creation_win_apt_unc2452_cmds.yml → ...in/proc_creation_win_apt_unc2452_cmds.yml
diff --git a/...tion/proc_creation_win_apt_unc2452_ps.yml → ...hain/proc_creation_win_apt_unc2452_ps.yml b/...tion/proc_creation_win_apt_unc2452_ps.yml → ...hain/proc_creation_win_apt_unc2452_ps.yml
diff --git a/...tion_win_apt_unc2452_vbscript_pattern.yml → ...tion_win_apt_unc2452_vbscript_pattern.yml b/...tion_win_apt_unc2452_vbscript_pattern.yml → ...tion_win_apt_unc2452_vbscript_pattern.yml
diff --git a/rules-emerging-threats/2023/3CX-Supply-Chain/README.md b/rules-emerging-threats/2023/3CX-Supply-Chain/README.md
@@ -0,0 +1,13 @@
+# 3CX Supply Chain Attack
+
+On March 29, 2023 CrowdStrike detected malicious activity, originating from a legitimate, signed binary called 3CXDesktopApp. The binary is part of a softphone system developed by 3CX.
+The observed malicious activity consisted of beaconing to infrastructure controlled by the actors, leading to the deployment of second-stage payloads and in a few cases direct on-keyboard activity from the attackers.
+
+You can find more information on the threat in the following articles:
+
+- [CrowdStrike Falcon Platform Detects and Prevents Active Intrusion Campaign Targeting 3CXDesktopApp Customers - By Crowdstrike](https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/)
+- [3CX Supply Chain Compromise Leads to ICONIC Incident - By Volexity](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/)
+- [3CX VoIP Software Compromise & Supply Chain Threats - By Huntress](https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats)
+- [Using THOR Lite to scan for indicators of Lazarus activity related to the 3CX compromise - By Nextron Systems](https://www.nextron-systems.com/2023/03/31/using-thor-lite-to-scan-for-indicators-of-lazarus-activity-related-to-the-3cx-compromise/)
+- [Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack - By Kaspersky](https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/)
+- [Elastic users protected from SUDDENICON’s supply chain attack - By Elastic](https://www.elastic.co/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack)
diff --git a/.../dns_query_win_malware_3cx_compromise.yml → .../dns_query_win_malware_3cx_compromise.yml b/.../dns_query_win_malware_3cx_compromise.yml → .../dns_query_win_malware_3cx_compromise.yml
diff --git a/..._load_malware_3cx_compromise_susp_dll.yml → ..._load_malware_3cx_compromise_susp_dll.yml b/..._load_malware_3cx_compromise_susp_dll.yml → ..._load_malware_3cx_compromise_susp_dll.yml
diff --git a/...are_3cx_compromise_beaconing_activity.yml → ...are_3cx_compromise_beaconing_activity.yml b/...are_3cx_compromise_beaconing_activity.yml → ...are_3cx_compromise_beaconing_activity.yml
diff --git a/..._win_malware_3cx_compromise_execution.yml → ..._win_malware_3cx_compromise_execution.yml b/..._win_malware_3cx_compromise_execution.yml → ..._win_malware_3cx_compromise_execution.yml
diff --git a/..._malware_3cx_compromise_susp_children.yml → ..._malware_3cx_compromise_susp_children.yml b/..._malware_3cx_compromise_susp_children.yml → ..._malware_3cx_compromise_susp_children.yml
diff --git a/...in_malware_3cx_compromise_susp_update.yml → ...in_malware_3cx_compromise_susp_update.yml b/...in_malware_3cx_compromise_susp_update.yml → ...in_malware_3cx_compromise_susp_update.yml
diff --git a/...are_3cx_compromise_c2_beacon_activity.yml → ...are_3cx_compromise_c2_beacon_activity.yml b/...are_3cx_compromise_c2_beacon_activity.yml → ...are_3cx_compromise_c2_beacon_activity.yml
diff --git a/...ware_3cx_compromise_susp_ico_requests.yml → ...ware_3cx_compromise_susp_ico_requests.yml b/...ware_3cx_compromise_susp_ico_requests.yml → ...ware_3cx_compromise_susp_ico_requests.yml
diff --git a/rules-emerging-threats/README.md b/rules-emerging-threats/README.md
@@ -0,0 +1 @@
+TBD
diff --git a/rules-placeholder/README.md b/rules-placeholder/README.md
@@ -0,0 +1 @@
+TBD
diff --git a/rules-threat-hunting/README.md b/rules-threat-hunting/README.md
@@ -0,0 +1 @@
+TBD
diff --git a/rules-unsupported/README.md b/rules-unsupported/README.md
@@ -0,0 +1 @@
+TBD
diff --git a/...unsupported/aws_ec2_download_userdata.yml → ...orted/cloud/aws_ec2_download_userdata.yml b/...unsupported/aws_ec2_download_userdata.yml → ...orted/cloud/aws_ec2_download_userdata.yml
diff --git a/rules-unsupported/aws_enum_backup.yml → rules-unsupported/cloud/aws_enum_backup.yml b/rules-unsupported/aws_enum_backup.yml → rules-unsupported/cloud/aws_enum_backup.yml
diff --git a/rules-unsupported/aws_enum_listing.yml → rules-unsupported/cloud/aws_enum_listing.yml b/rules-unsupported/aws_enum_listing.yml → rules-unsupported/cloud/aws_enum_listing.yml
diff --git a/rules-unsupported/aws_enum_network.yml → rules-unsupported/cloud/aws_enum_network.yml b/rules-unsupported/aws_enum_network.yml → rules-unsupported/cloud/aws_enum_network.yml
diff --git a/rules-unsupported/aws_enum_storage.yml → rules-unsupported/cloud/aws_enum_storage.yml b/rules-unsupported/aws_enum_storage.yml → rules-unsupported/cloud/aws_enum_storage.yml
diff --git a/...ws_lambda_function_created_or_invoked.yml → ...ws_lambda_function_created_or_invoked.yml b/...ws_lambda_function_created_or_invoked.yml → ...ws_lambda_function_created_or_invoked.yml
diff --git a/rules-unsupported/aws_macic_evasion.yml → ...s-unsupported/cloud/aws_macic_evasion.yml b/rules-unsupported/aws_macic_evasion.yml → ...s-unsupported/cloud/aws_macic_evasion.yml
diff --git a/...unsupported/aws_ses_messaging_enabled.yml → ...orted/cloud/aws_ses_messaging_enabled.yml b/...unsupported/aws_ses_messaging_enabled.yml → ...orted/cloud/aws_ses_messaging_enabled.yml
diff --git a/...signin_failure_bad_password_threshold.yml → ...signin_failure_bad_password_threshold.yml b/...signin_failure_bad_password_threshold.yml → ...signin_failure_bad_password_threshold.yml
diff --git a/...td_cve_2021_3156_sudo_buffer_overflow.yml → ...td_cve_2021_3156_sudo_buffer_overflow.yml b/...td_cve_2021_3156_sudo_buffer_overflow.yml → ...td_cve_2021_3156_sudo_buffer_overflow.yml
diff --git a/...1_3156_sudo_buffer_overflow_brutforce.yml → ...1_3156_sudo_buffer_overflow_brutforce.yml b/...1_3156_sudo_buffer_overflow_brutforce.yml → ...1_3156_sudo_buffer_overflow_brutforce.yml
diff --git a/...-unsupported/lnx_auditd_cve_2021_4034.yml → ...ported/linux/lnx_auditd_cve_2021_4034.yml b/...-unsupported/lnx_auditd_cve_2021_4034.yml → ...ported/linux/lnx_auditd_cve_2021_4034.yml
diff --git a/...-unsupported/lnx_auditd_debugfs_usage.yml → ...ported/linux/lnx_auditd_debugfs_usage.yml b/...-unsupported/lnx_auditd_debugfs_usage.yml → ...ported/linux/lnx_auditd_debugfs_usage.yml
diff --git a/...migod_scx_runasprovider_executescript.yml → ...migod_scx_runasprovider_executescript.yml b/...migod_scx_runasprovider_executescript.yml → ...migod_scx_runasprovider_executescript.yml
diff --git a/...auth_susp_failed_logons_single_source.yml → ...auth_susp_failed_logons_single_source.yml b/...auth_susp_failed_logons_single_source.yml → ...auth_susp_failed_logons_single_source.yml
diff --git a/...s-unsupported/lnx_shell_priv_esc_prep.yml → ...pported/linux/lnx_shell_priv_esc_prep.yml b/...s-unsupported/lnx_shell_priv_esc_prep.yml → ...pported/linux/lnx_shell_priv_esc_prep.yml
diff --git a/rules-unsupported/net_dns_c2_detection.yml → ...upported/network/net_dns_c2_detection.yml b/rules-unsupported/net_dns_c2_detection.yml → ...upported/network/net_dns_c2_detection.yml
diff --git a/rules-unsupported/net_dns_high_bytes_out.yml → ...ported/network/net_dns_high_bytes_out.yml b/rules-unsupported/net_dns_high_bytes_out.yml → ...ported/network/net_dns_high_bytes_out.yml
diff --git a/...t_dns_high_null_records_requests_rate.yml → ...t_dns_high_null_records_requests_rate.yml b/...t_dns_high_null_records_requests_rate.yml → ...t_dns_high_null_records_requests_rate.yml
diff --git a/...nsupported/net_dns_high_requests_rate.yml → ...ed/network/net_dns_high_requests_rate.yml b/...nsupported/net_dns_high_requests_rate.yml → ...ed/network/net_dns_high_requests_rate.yml
diff --git a/...supported/net_dns_high_subdomain_rate.yml → ...d/network/net_dns_high_subdomain_rate.yml b/...supported/net_dns_high_subdomain_rate.yml → ...d/network/net_dns_high_subdomain_rate.yml
diff --git a/...et_dns_high_txt_records_requests_rate.yml → ...et_dns_high_txt_records_requests_rate.yml b/...et_dns_high_txt_records_requests_rate.yml → ...et_dns_high_txt_records_requests_rate.yml
diff --git a/...unsupported/net_dns_large_domain_name.yml → ...ted/network/net_dns_large_domain_name.yml b/...unsupported/net_dns_large_domain_name.yml → ...ted/network/net_dns_large_domain_name.yml
diff --git a/...orted/net_firewall_high_dns_bytes_out.yml → ...twork/net_firewall_high_dns_bytes_out.yml b/...orted/net_firewall_high_dns_bytes_out.yml → ...twork/net_firewall_high_dns_bytes_out.yml
diff --git a/...d/net_firewall_high_dns_requests_rate.yml → ...k/net_firewall_high_dns_requests_rate.yml b/...d/net_firewall_high_dns_requests_rate.yml → ...k/net_firewall_high_dns_requests_rate.yml
diff --git a/.../net_firewall_susp_network_scan_by_ip.yml → .../net_firewall_susp_network_scan_by_ip.yml b/.../net_firewall_susp_network_scan_by_ip.yml → .../net_firewall_susp_network_scan_by_ip.yml
diff --git a/...et_firewall_susp_network_scan_by_port.yml → ...et_firewall_susp_network_scan_by_port.yml b/...et_firewall_susp_network_scan_by_port.yml → ...et_firewall_susp_network_scan_by_port.yml
diff --git a/...nsupported/net_possible_dns_rebinding.yml → ...ed/network/net_possible_dns_rebinding.yml b/...nsupported/net_possible_dns_rebinding.yml → ...ed/network/net_possible_dns_rebinding.yml
diff --git a/rules-unsupported/modsec_mulitple_blocks.yml → ...upported/other/modsec_mulitple_blocks.yml b/rules-unsupported/modsec_mulitple_blocks.yml → ...upported/other/modsec_mulitple_blocks.yml
diff --git a/...ultiple_susp_resp_codes_single_source.yml → ...ultiple_susp_resp_codes_single_source.yml b/...ultiple_susp_resp_codes_single_source.yml → ...ultiple_susp_resp_codes_single_source.yml
diff --git a/.../dns_query_win_possible_dns_rebinding.yml → .../dns_query_win_possible_dns_rebinding.yml b/.../dns_query_win_possible_dns_rebinding.yml → .../dns_query_win_possible_dns_rebinding.yml
diff --git a/...oad_invoke_obfuscation_clip+_services.yml → ...oad_invoke_obfuscation_clip+_services.yml b/...oad_invoke_obfuscation_clip+_services.yml → ...oad_invoke_obfuscation_clip+_services.yml
diff --git a/...e_obfuscation_obfuscated_iex_services.yml → ...e_obfuscation_obfuscated_iex_services.yml b/...e_obfuscation_obfuscated_iex_services.yml → ...e_obfuscation_obfuscated_iex_services.yml
diff --git a/...ad_invoke_obfuscation_stdin+_services.yml → ...ad_invoke_obfuscation_stdin+_services.yml b/...ad_invoke_obfuscation_stdin+_services.yml → ...ad_invoke_obfuscation_stdin+_services.yml
diff --git a/...load_invoke_obfuscation_var+_services.yml → ...load_invoke_obfuscation_var+_services.yml b/...load_invoke_obfuscation_var+_services.yml → ...load_invoke_obfuscation_var+_services.yml
diff --git a/...oke_obfuscation_via_compress_services.yml → ...oke_obfuscation_via_compress_services.yml b/...oke_obfuscation_via_compress_services.yml → ...oke_obfuscation_via_compress_services.yml
diff --git a/...nvoke_obfuscation_via_rundll_services.yml → ...nvoke_obfuscation_via_rundll_services.yml b/...nvoke_obfuscation_via_rundll_services.yml → ...nvoke_obfuscation_via_rundll_services.yml
diff --git a/...invoke_obfuscation_via_stdin_services.yml → ...invoke_obfuscation_via_stdin_services.yml b/...invoke_obfuscation_via_stdin_services.yml → ...invoke_obfuscation_via_stdin_services.yml
diff --git a/...oke_obfuscation_via_use_clip_services.yml → ...oke_obfuscation_via_use_clip_services.yml b/...oke_obfuscation_via_use_clip_services.yml → ...oke_obfuscation_via_use_clip_services.yml
diff --git a/...ke_obfuscation_via_use_mshta_services.yml → ...ke_obfuscation_via_use_mshta_services.yml b/...ke_obfuscation_via_use_mshta_services.yml → ...ke_obfuscation_via_use_mshta_services.yml
diff --git a/...obfuscation_via_use_rundll32_services.yml → ...obfuscation_via_use_rundll32_services.yml b/...obfuscation_via_use_rundll32_services.yml → ...obfuscation_via_use_rundll32_services.yml
diff --git a/...invoke_obfuscation_via_var++_services.yml → ...invoke_obfuscation_via_var++_services.yml b/...invoke_obfuscation_via_var++_services.yml → ...invoke_obfuscation_via_var++_services.yml
diff --git a/...strike_getsystem_service_installation.yml → ...strike_getsystem_service_installation.yml b/...strike_getsystem_service_installation.yml → ...strike_getsystem_service_installation.yml
diff --git a/...d/driver_load_tap_driver_installation.yml → ...s/driver_load_tap_driver_installation.yml b/...d/driver_load_tap_driver_installation.yml → ...s/driver_load_tap_driver_installation.yml
diff --git a/...ipt_creation_by_office_using_file_ext.yml → ...ipt_creation_by_office_using_file_ext.yml b/...ipt_creation_by_office_using_file_ext.yml → ...ipt_creation_by_office_using_file_ext.yml
diff --git a/...mage_load_mimikatz_inmemory_detection.yml → ...mage_load_mimikatz_inmemory_detection.yml b/...mage_load_mimikatz_inmemory_detection.yml → ...mage_load_mimikatz_inmemory_detection.yml
diff --git a/...posh_ps_cl_invocation_lolscript_count.yml → ...posh_ps_cl_invocation_lolscript_count.yml b/...posh_ps_cl_invocation_lolscript_count.yml → ...posh_ps_cl_invocation_lolscript_count.yml
diff --git a/..._ps_cl_mutexverifiers_lolscript_count.yml → ..._ps_cl_mutexverifiers_lolscript_count.yml b/..._ps_cl_mutexverifiers_lolscript_count.yml → ..._ps_cl_mutexverifiers_lolscript_count.yml
diff --git a/...correlation_apt_silence_downloader_v3.yml → ...correlation_apt_silence_downloader_v3.yml b/...correlation_apt_silence_downloader_v3.yml → ...correlation_apt_silence_downloader_v3.yml
diff --git a/...correlation_apt_turla_commands_medium.yml → ...correlation_apt_turla_commands_medium.yml b/...correlation_apt_turla_commands_medium.yml → ...correlation_apt_turla_commands_medium.yml
diff --git a/...ion_dnscat2_powershell_implementation.yml → ...ion_dnscat2_powershell_implementation.yml b/...ion_dnscat2_powershell_implementation.yml → ...ion_dnscat2_powershell_implementation.yml
diff --git a/...ion_win_correlation_multiple_susp_cli.yml → ...ion_win_correlation_multiple_susp_cli.yml b/...ion_win_correlation_multiple_susp_cli.yml → ...ion_win_correlation_multiple_susp_cli.yml
diff --git a/...rrelation_susp_builtin_commands_recon.yml → ...rrelation_susp_builtin_commands_recon.yml b/...rrelation_susp_builtin_commands_recon.yml → ...rrelation_susp_builtin_commands_recon.yml
diff --git a/..._cmd_and_powershell_spawned_processes.yml → ..._cmd_and_powershell_spawned_processes.yml b/..._cmd_and_powershell_spawned_processes.yml → ..._cmd_and_powershell_spawned_processes.yml
diff --git a/...tall_elevated_parent_child_correlated.yml → ...tall_elevated_parent_child_correlated.yml b/...tall_elevated_parent_child_correlated.yml → ...tall_elevated_parent_child_correlated.yml
diff --git a/...ed/sysmon_non_priv_program_files_move.yml → ...ws/sysmon_non_priv_program_files_move.yml b/...ed/sysmon_non_priv_program_files_move.yml → ...ws/sysmon_non_priv_program_files_move.yml
diff --git a/...-unsupported/sysmon_process_reimaging.yml → ...rted/windows/sysmon_process_reimaging.yml b/...-unsupported/sysmon_process_reimaging.yml → ...rted/windows/sysmon_process_reimaging.yml
diff --git a/...ss_fake_files_with_stored_credentials.yml → ...ss_fake_files_with_stored_credentials.yml b/...ss_fake_files_with_stored_credentials.yml → ...ss_fake_files_with_stored_credentials.yml
diff --git a/rules-unsupported/win_apt_apt29_tor.yml → ...unsupported/windows/win_apt_apt29_tor.yml b/rules-unsupported/win_apt_apt29_tor.yml → ...unsupported/windows/win_apt_apt29_tor.yml
diff --git a/...ported/win_dumping_ntdsdit_via_dcsync.yml → ...indows/win_dumping_ntdsdit_via_dcsync.yml b/...ported/win_dumping_ntdsdit_via_dcsync.yml → ...indows/win_dumping_ntdsdit_via_dcsync.yml
diff --git a/...orted/win_dumping_ntdsdit_via_netsync.yml → ...ndows/win_dumping_ntdsdit_via_netsync.yml b/...orted/win_dumping_ntdsdit_via_netsync.yml → ...ndows/win_dumping_ntdsdit_via_netsync.yml
diff --git a/...party_drivers_exploits_token_stealing.yml → ...party_drivers_exploits_token_stealing.yml b/...party_drivers_exploits_token_stealing.yml → ...party_drivers_exploits_token_stealing.yml
diff --git a/...-unsupported/win_mal_service_installs.yml → ...rted/windows/win_mal_service_installs.yml b/...-unsupported/win_mal_service_installs.yml → ...rted/windows/win_mal_service_installs.yml
diff --git a/...r_impacket_smb_psexec_service_install.yml → ...r_impacket_smb_psexec_service_install.yml b/...r_impacket_smb_psexec_service_install.yml → ...r_impacket_smb_psexec_service_install.yml
diff --git a/...vilege_escalation_using_rotten_potato.yml → ...vilege_escalation_using_rotten_potato.yml b/...vilege_escalation_using_rotten_potato.yml → ...vilege_escalation_using_rotten_potato.yml
diff --git a/rules-unsupported/win_remote_schtask.yml → ...nsupported/windows/win_remote_schtask.yml b/rules-unsupported/win_remote_schtask.yml → ...nsupported/windows/win_remote_schtask.yml
diff --git a/rules-unsupported/win_remote_service.yml → ...nsupported/windows/win_remote_service.yml b/rules-unsupported/win_remote_service.yml → ...nsupported/windows/win_remote_service.yml
diff --git a/...n_security_global_catalog_enumeration.yml → ...n_security_global_catalog_enumeration.yml b/...n_security_global_catalog_enumeration.yml → ...n_security_global_catalog_enumeration.yml
diff --git a/.../win_security_rare_schtasks_creations.yml → .../win_security_rare_schtasks_creations.yml b/.../win_security_rare_schtasks_creations.yml → .../win_security_rare_schtasks_creations.yml
diff --git a/...sp_failed_logons_explicit_credentials.yml → ...sp_failed_logons_explicit_credentials.yml b/...sp_failed_logons_explicit_credentials.yml → ...sp_failed_logons_explicit_credentials.yml
diff --git a/...ity_susp_failed_logons_single_process.yml → ...ity_susp_failed_logons_single_process.yml b/...ity_susp_failed_logons_single_process.yml → ...ity_susp_failed_logons_single_process.yml
diff --git a/...rity_susp_failed_logons_single_source.yml → ...rity_susp_failed_logons_single_source.yml b/...rity_susp_failed_logons_single_source.yml → ...rity_susp_failed_logons_single_source.yml
diff --git a/...ity_susp_failed_logons_single_source2.yml → ...ity_susp_failed_logons_single_source2.yml b/...ity_susp_failed_logons_single_source2.yml → ...ity_susp_failed_logons_single_source2.yml
diff --git a/..._failed_logons_single_source_kerberos.yml → ..._failed_logons_single_source_kerberos.yml b/..._failed_logons_single_source_kerberos.yml → ..._failed_logons_single_source_kerberos.yml
diff --git a/...failed_logons_single_source_kerberos2.yml → ...failed_logons_single_source_kerberos2.yml b/...failed_logons_single_source_kerberos2.yml → ...failed_logons_single_source_kerberos2.yml
diff --git a/...failed_logons_single_source_kerberos3.yml → ...failed_logons_single_source_kerberos3.yml b/...failed_logons_single_source_kerberos3.yml → ...failed_logons_single_source_kerberos3.yml
diff --git a/...susp_failed_logons_single_source_ntlm.yml → ...susp_failed_logons_single_source_ntlm.yml b/...susp_failed_logons_single_source_ntlm.yml → ...susp_failed_logons_single_source_ntlm.yml
diff --git a/...usp_failed_logons_single_source_ntlm2.yml → ...usp_failed_logons_single_source_ntlm2.yml b/...usp_failed_logons_single_source_ntlm2.yml → ...usp_failed_logons_single_source_ntlm2.yml
diff --git a/...sp_failed_remote_logons_single_source.yml → ...sp_failed_remote_logons_single_source.yml b/...sp_failed_remote_logons_single_source.yml → ...sp_failed_remote_logons_single_source.yml
diff --git a/...usp_multiple_files_renamed_or_deleted.yml → ...usp_multiple_files_renamed_or_deleted.yml b/...usp_multiple_files_renamed_or_deleted.yml → ...usp_multiple_files_renamed_or_deleted.yml
diff --git a/...upported/win_security_susp_samr_pwset.yml → .../windows/win_security_susp_samr_pwset.yml b/...upported/win_security_susp_samr_pwset.yml → .../windows/win_security_susp_samr_pwset.yml
diff --git a/...ed/win_susp_failed_hidden_share_mount.yml → ...ws/win_susp_failed_hidden_share_mount.yml b/...ed/win_susp_failed_hidden_share_mount.yml → ...ws/win_susp_failed_hidden_share_mount.yml
diff --git a/...spicious_werfault_connection_outbound.yml → ...spicious_werfault_connection_outbound.yml b/...spicious_werfault_connection_outbound.yml → ...spicious_werfault_connection_outbound.yml
diff --git a/...rted/win_system_rare_service_installs.yml → ...dows/win_system_rare_service_installs.yml b/...rted/win_system_rare_service_installs.yml → ...dows/win_system_rare_service_installs.yml
diff --git a/...n_taskscheduler_rare_schtask_creation.yml → ...n_taskscheduler_rare_schtask_creation.yml b/...n_taskscheduler_rare_schtask_creation.yml → ...n_taskscheduler_rare_schtask_creation.yml
diff --git a/.../zeek_dce_rpc_domain_user_enumeration.yml → .../zeek_dce_rpc_domain_user_enumeration.yml b/.../zeek_dce_rpc_domain_user_enumeration.yml → .../zeek_dce_rpc_domain_user_enumeration.yml
diff --git a/...ek_http_exfiltration_compressed_files.yml → ...ek_http_exfiltration_compressed_files.yml b/...ek_http_exfiltration_compressed_files.yml → ...ek_http_exfiltration_compressed_files.yml
diff --git a/rules/README.md b/rules/README.md
@@ -0,0 +1 @@
+TBD
diff --git a/rules/windows/process_creation/proc_creation_win_wmiprvse_susp_child_processes.yml b/rules/windows/process_creation/proc_creation_win_wmiprvse_susp_child_processes.yml
@@ -5,13 +5,16 @@ related:
       type: similar
     - id: d21374ff-f574-44a7-9998-4a8c8bf33d7d
       type: similar
+    - id: 18cf6cf0-39b0-4c22-9593-e244bdc9a2d4
+      type: obsoletes
 status: test
 description: Detects suspicious and uncommon child processes of WmiPrvSE
 references:
     - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
     - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml
     - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
-author: Vadim Khrykov (ThreatIntel), Cyb3rEng
+    - https://twitter.com/ForensicITGuy/status/1334734244120309760
+author: Vadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems)
 date: 2021/08/23
 modified: 2023/03/23
 tags:

diff --git a/tests/test_logsource.py b/tests/test_logsource.py
@@ -16,13 +16,18 @@
 
 class TestRules(unittest.TestCase):
 
-    path_to_rules = "rules"
-
+    path_to_rules_ = ["rules", "rules-emerging-threats", "rules-placeholder", "rules-threat-hunting", "rules-compliance"]
+    path_to_rules = []
+    for path_ in path_to_rules_:
+        path_to_rules.append(os.path.join(os.path.dirname(os.path.realpath(__file__)), path_))
+
     # Helper functions
-    def yield_next_rule_file_path(self, path_to_rules: str) -> str:
-        for root, _, files in os.walk(path_to_rules):
-            for file in files:
-                yield os.path.join(root, file)
+    def yield_next_rule_file_path(self, path_to_rules: list) -> str:
+        for path_ in path_to_rules:
+            for root, _, files in os.walk(path_):
+                for file in files:
+                    if file.endswith('.yml'):
+                        yield os.path.join(root, file)
 
     def get_rule_yaml(self, file_path: str) -> dict:
         data = []

diff --git a/tests/test_rules.py b/tests/test_rules.py
@@ -33,14 +33,18 @@ def setUpClass(cls):
     # Don't use trademarks in rules - they require non-ASCII characters to be used on we don't want them in our rules
     TRADE_MARKS = {"MITRE ATT&CK", "ATT&CK"}
 
-    path_to_rules = "../rules"
-    path_to_rules = os.path.join(os.path.dirname(os.path.realpath(__file__)), path_to_rules)
+    path_to_rules_ = ["rules", "rules-emerging-threats", "rules-placeholder", "rules-threat-hunting", "rules-compliance"]
+    path_to_rules = []
+    for path_ in path_to_rules_:
+        path_to_rules.append(os.path.join(os.path.dirname(os.path.realpath(__file__)), path_))
 
     # Helper functions
-    def yield_next_rule_file_path(self, path_to_rules: str) -> str:
-        for root, _, files in os.walk(path_to_rules):
-            for file in files:
-                yield os.path.join(root, file)
+    def yield_next_rule_file_path(self, path_to_rules: list) -> str:
+        for path_ in path_to_rules:
+            for root, _, files in os.walk(path_):
+                for file in files:
+                    if file.endswith('.yml'):
+                        yield os.path.join(root, file)
 
     def get_rule_part(self, file_path: str, part_name: str):
         yaml_dicts = self.get_rule_yaml(file_path)
@@ -59,7 +63,7 @@ def get_rule_yaml(self, file_path: str) -> dict:
                 data.append(part)
 
         return data
-
+    
     # Tests
     # def test_confirm_extension_is_yml(self):
         # files_with_incorrect_extensions = []