forked from SigmaHQ/sigma
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'SigmaHQ:master' into master
- Loading branch information
Showing
776 changed files
with
17,046 additions
and
3,846 deletions.
There are no files selected for viewing
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
42 changes: 42 additions & 0 deletions
42
rules-unsupported/sysmon_always_install_elevated_parent_child_correlated.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| title: Always Install Elevated Parent Child Correlated | ||
| id: 078235c5-6ec5-48e7-94b2-f8b5474379ea | ||
| description: This rule will looks any process with low privilege launching Windows Installer service (msiexec.exe) that tries to install MSI packages with SYSTEM privilege | ||
| #look for MSI start by low privilege user, write the process guid to the suspicious_guid variable | ||
| #look for child process from the suspicious_guid, alert if it's Windows Installer trying to install package with SYSTEM privilege | ||
| status: experimental | ||
| author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community | ||
| date: 2020/10/13 | ||
| references: | ||
| - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-48-638.jpg | ||
| tags: | ||
| - attack.privilege_escalation | ||
| - attack.t1548.002 | ||
| logsource: | ||
| product: windows | ||
| category: process_creation | ||
| detection: | ||
| system_integrity: | ||
| IntegrityLevel: 'System' | ||
| system_user: | ||
| User: 'NT AUTHORITY\SYSTEM' | ||
| image_1: | ||
| Image|contains|all: | ||
| - '\Windows\Installer\' | ||
| - 'msi' | ||
| Image|endswith: | ||
| - 'tmp' | ||
| image_2: | ||
| Image|endswith: '\msiexec.exe' | ||
| child_of_suspicious_guid: | ||
| ParentProcessGuid: '%suspicious_guid%' | ||
| condition: write ProcessGuid from (event_id and image_2 and not system_user) to %suspicious_guid%; then if (child_of_suspicious_guid and event_id and image_1 and system_user) or (suspicious_guid and event_id and image_2 and system_user and integrity_level) -> alert | ||
| fields: | ||
| - EventID | ||
| - IntegrityLevel | ||
| - User | ||
| - Image | ||
| ParentProcessGuid | ||
| falsepositives: | ||
| - System administrator usage | ||
| - Penetration test | ||
| level: high |
29 changes: 29 additions & 0 deletions
29
rules-unsupported/win_access_fake_files_with_stored_credentials.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| title: Stored Credentials in Fake Files | ||
| id: 692b979c-f747-41dc-ad72-1f11c01b110e | ||
| description: Search for accessing of fake files with stored credentials | ||
| status: experimental | ||
| author: Teymur Kheirkhabarov (idea), Ryan Plas (rule), oscd.community | ||
| date: 2020/10/05 | ||
| references: | ||
| - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-13-638.jpg | ||
| tags: | ||
| - attack.credential_access | ||
| - attack.t1555 | ||
| logsource: | ||
| product: windows | ||
| service: security | ||
| detection: | ||
| selection: | ||
| EventID: 4663 | ||
| AccessList|contains: '%%4416' | ||
| ObjectName|endswith: | ||
| - '\%POLICY_ID%\Machine\Preferences\Groups\Groups.xml' | ||
| - '\%FOLDER_NAME%\Unattend.xml' | ||
| condition: selection | ||
| fields: | ||
| - EventID | ||
| - AccessList | ||
| - ObjectName | ||
| falsepositives: | ||
| - Unknown | ||
| level: high |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| title: Remote Schtasks Creation | ||
| id: cf349c4b-99af-40fa-a051-823aa2307a84 | ||
| status: experimental | ||
| description: Detects remote execution via scheduled task creation or update on the destination host | ||
| author: Jai Minton, oscd.community | ||
| date: 2020/10/05 | ||
| references: | ||
| - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view | ||
| tags: | ||
| - attack.lateral_movement | ||
| - attack.persistence | ||
| - attack.execution | ||
| - attack.t1053.005 | ||
| logsource: | ||
| product: windows | ||
| service: security | ||
| definition: 'The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection (not in the baseline recommendations by Microsoft).' | ||
| detection: | ||
| selection1: | ||
| EventID: 4624 | ||
| Logon_Type: 3 | ||
| selection2: | ||
| EventID: | ||
| - 4698 | ||
| - 4702 | ||
| filter1: | ||
| Source_Network_Address: | ||
| - '::1' | ||
| - '127.0.0.1' | ||
| filter2: | ||
| Source_Network_Address: '-' | ||
| timeframe: 30d | ||
| condition: (selection1 and not filter1) or selection2 and not filter2 | ||
| # where: | ||
| # selection1: TargetLogonID = selection2: SubjectLogonID, grouped by host over 30seconds | eventcount > 1 | ||
| # Rule should trigger where the SubjectLogonID from event 4698 or 4702 is the same as the TargetLogonID from event 4624 with a Logon_Type of 3, in a 30second period, provided its from the same host. | ||
| # This logic would be similar to the Splunk 'Transaction' operator which groups related events over a timeframe. | ||
| # This takes both field values (e.g. Logon_ID), and an expression provided (e.g. startswith=(EventCode=4624) maxspan=30s) which occurs over the raw event log to find events, at which point a Union based on the criteria provided occurs to merge these events into a single transaction. | ||
| # This is similar to stats as an aggregation function, but allows you to see the raw text of events rather than to calculate stats on then, and it retains the raw event to allow an eval expression to occur for grouping. This is beneficial as fields such as LogonIDs are reused over time. | ||
| # By having this you can group logon events to their remote schtask creation event (as it is searching for a logon followed by a schtask creation) even by using a search timeframe over a long period of time e.g. 30days without running the risk of incorrectly grouping a logonID at one time, to a task creation at another. | ||
| # Rule logic is currently not supported by SIGMA. | ||
| falsepositives: | ||
| - Unknown | ||
| level: medium |
Oops, something went wrong.