feat: update multiple rules

2023-04-18 18:08:08 +02:00
parent 4e7bb74d43
commit 9a2ee48ef8
8 changed files with 308 additions and 106 deletions
@@ -0,0 +1,31 @@
+title: Microsoft Binary Github Communication
+id: 635dbb88-67b3-4b41-9ea5-a3af2dd88153
+status: deprecated
+description: Detects an executable in the Windows folder accessing github.com
+references:
+    - https://twitter.com/M_haggis/status/900741347035889665
+    - https://twitter.com/M_haggis/status/1032799638213066752
+    - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/exfil/Invoke-ExfilDataToGitHub.ps1
+author: Michael Haag (idea), Florian Roth (Nextron Systems)
+date: 2017/08/24
+modified: 2023/04/18
+tags:
+    - attack.lateral_movement
+    - attack.t1105
+    - attack.exfiltration
+    - attack.t1567.001
+logsource:
+    category: network_connection
+    product: windows
+detection:
+    selection:
+        Initiated: 'true'
+        DestinationHostname|endswith:
+            - '.github.com'
+            - '.githubusercontent.com'
+        Image|startswith: 'C:\Windows\'
+    condition: selection
+falsepositives:
+    - Unknown
+    - '@subTee in your network'
+level: high