security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: security-tools/blue-team-tools:0.1.1
Branches Tags
security-tools/blue-team-tools:master
security-tools/blue-team-tools:r2026-04-01 security-tools/blue-team-tools:r2026-01-01 security-tools/blue-team-tools:r2025-12-01 security-tools/blue-team-tools:r2025-11-01 security-tools/blue-team-tools:r2025-10-01 security-tools/blue-team-tools:r2025-07-08 security-tools/blue-team-tools:r2025-05-21 security-tools/blue-team-tools:r2025-02-03 security-tools/blue-team-tools:r2024-12-19 security-tools/blue-team-tools:r2024-11-10 security-tools/blue-team-tools:r2024-09-02 security-tools/blue-team-tools:r2024-07-17 security-tools/blue-team-tools:r2024-05-13 security-tools/blue-team-tools:r2024-04-29 security-tools/blue-team-tools:r2024-03-26 security-tools/blue-team-tools:r2024-03-11 security-tools/blue-team-tools:r2024-02-26 security-tools/blue-team-tools:r2024-02-12 security-tools/blue-team-tools:r2024-01-29 security-tools/blue-team-tools:r2024-01-15 security-tools/blue-team-tools:r2023-12-21 security-tools/blue-team-tools:r2023-12-04 security-tools/blue-team-tools:r2023-11-20 security-tools/blue-team-tools:r2023-11-06 security-tools/blue-team-tools:r2023-10-23 security-tools/blue-team-tools:r2023-10-09 security-tools/blue-team-tools:r2023-08-24 security-tools/blue-team-tools:0.22 security-tools/blue-team-tools:0.21 security-tools/blue-team-tools:0.20 security-tools/blue-team-tools:0.19.1 security-tools/blue-team-tools:0.19 security-tools/blue-team-tools:0.18.1 security-tools/blue-team-tools:0.17.0 security-tools/blue-team-tools:0.16.0 security-tools/blue-team-tools:0.15.0 security-tools/blue-team-tools:0.14 security-tools/blue-team-tools:0.13 security-tools/blue-team-tools:0.12.1 security-tools/blue-team-tools:0.12 security-tools/blue-team-tools:0.11 security-tools/blue-team-tools:0.10 security-tools/blue-team-tools:0.9 security-tools/blue-team-tools:0.8 security-tools/blue-team-tools:0.7.1 security-tools/blue-team-tools:0.6 security-tools/blue-team-tools:0.5 security-tools/blue-team-tools:0.4 security-tools/blue-team-tools:0.3.3 security-tools/blue-team-tools:0.3.2 security-tools/blue-team-tools:0.3.1 security-tools/blue-team-tools:0.3 security-tools/blue-team-tools:0.2 security-tools/blue-team-tools:0.1.3 security-tools/blue-team-tools:0.1.2 security-tools/blue-team-tools:0.1.1 security-tools/blue-team-tools:0.1
..
compare: security-tools/blue-team-tools:0.12.1
Branches Tags
security-tools/blue-team-tools:master
security-tools/blue-team-tools:r2026-04-01 security-tools/blue-team-tools:r2026-01-01 security-tools/blue-team-tools:r2025-12-01 security-tools/blue-team-tools:r2025-11-01 security-tools/blue-team-tools:r2025-10-01 security-tools/blue-team-tools:r2025-07-08 security-tools/blue-team-tools:r2025-05-21 security-tools/blue-team-tools:r2025-02-03 security-tools/blue-team-tools:r2024-12-19 security-tools/blue-team-tools:r2024-11-10 security-tools/blue-team-tools:r2024-09-02 security-tools/blue-team-tools:r2024-07-17 security-tools/blue-team-tools:r2024-05-13 security-tools/blue-team-tools:r2024-04-29 security-tools/blue-team-tools:r2024-03-26 security-tools/blue-team-tools:r2024-03-11 security-tools/blue-team-tools:r2024-02-26 security-tools/blue-team-tools:r2024-02-12 security-tools/blue-team-tools:r2024-01-29 security-tools/blue-team-tools:r2024-01-15 security-tools/blue-team-tools:r2023-12-21 security-tools/blue-team-tools:r2023-12-04 security-tools/blue-team-tools:r2023-11-20 security-tools/blue-team-tools:r2023-11-06 security-tools/blue-team-tools:r2023-10-23 security-tools/blue-team-tools:r2023-10-09 security-tools/blue-team-tools:r2023-08-24 security-tools/blue-team-tools:0.22 security-tools/blue-team-tools:0.21 security-tools/blue-team-tools:0.20 security-tools/blue-team-tools:0.19.1 security-tools/blue-team-tools:0.19 security-tools/blue-team-tools:0.18.1 security-tools/blue-team-tools:0.17.0 security-tools/blue-team-tools:0.16.0 security-tools/blue-team-tools:0.15.0 security-tools/blue-team-tools:0.14 security-tools/blue-team-tools:0.13 security-tools/blue-team-tools:0.12.1 security-tools/blue-team-tools:0.12 security-tools/blue-team-tools:0.11 security-tools/blue-team-tools:0.10 security-tools/blue-team-tools:0.9 security-tools/blue-team-tools:0.8 security-tools/blue-team-tools:0.7.1 security-tools/blue-team-tools:0.6 security-tools/blue-team-tools:0.5 security-tools/blue-team-tools:0.4 security-tools/blue-team-tools:0.3.3 security-tools/blue-team-tools:0.3.2 security-tools/blue-team-tools:0.3.1 security-tools/blue-team-tools:0.3 security-tools/blue-team-tools:0.2 security-tools/blue-team-tools:0.1.3 security-tools/blue-team-tools:0.1.2 security-tools/blue-team-tools:0.1.1 security-tools/blue-team-tools:0.1

1281 Commits
0.1.1 .. 0.12.1

Author SHA1 Message Date
Thomas Patzke 940c36a4cd Fixed build 
Missing package specification
 2019-08-05 23:42:33 +02:00
Florian Roth 83841ea117 Merge pull request #411 from nikotin69/master 
compliance rules by SOC prime
 2019-08-05 20:53:02 +02:00
Florian Roth 302ae9c5d0 Added level 2019-08-05 19:51:22 +02:00
Florian Roth 4dbf392562 Title, Level adjusted 2019-08-05 19:48:56 +02:00
Florian Roth fdb9b351d0 Level to low 2019-08-05 19:48:21 +02:00
Florian Roth 317c0bd07a Removed "Detects" keyword from title 2019-08-05 19:47:46 +02:00
Florian Roth 2af8cb0d0e Update cleartext_protocols.yml 2019-08-05 19:47:03 +02:00
Florian Roth b3780022d3 Merge pull request #412 from Karneades/mmc-rules 
Improve MMC rules: fix generic rule and add new rule for shell spawning
 2019-08-05 19:46:31 +02:00
Florian Roth c7ec45c0ff Update workstation_was_locked.yml 2019-08-05 19:44:14 +02:00
Florian Roth e64fcb32a2 Update group_modification_logging.yml 2019-08-05 19:43:59 +02:00
Florian Roth 5caf4f5f14 Update default_credentials_usage.yml 2019-08-05 19:43:46 +02:00
Florian Roth 10cc1de4c9 Fixed global rule syntax 2019-08-05 19:43:15 +02:00
Florian Roth dcdd021dc6 Duplicate port 3306 2019-08-05 19:36:50 +02:00
Karneades 42e6c9149b Remove unneeded event code 2019-08-05 19:13:39 +02:00
Karneades 0e3cc042f4 Add more exclusions to mmc process rule 2019-08-05 18:53:33 +02:00
Karneades 5caa951b8f Add new rule for detecting MMC spawning a shell 
Add (analog to win_mshta_spawn_shell.yml) a dedicated rule for dedecting MMC spawning a shell. See https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_mshta_spawn_shell.yml. And it should cover the (removed) cmd part from the existing rule https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_susp_mmc_source.yml.
 2019-08-05 18:42:31 +02:00
nikotin 780d9223e6 compliance rules by SOC prime 2019-08-05 19:42:19 +03:00
Karneades cfe44ad17d Fix win_susp_mmc_source to match what title says 
Remove cmd.exe filter to match what title and rule says: detect all processes created by MMC. A new dedicated rule will be created for detecting shells spawned by MMC.
 2019-08-05 16:21:56 +02:00
Florian Roth 6a8adc72ac rule: reworked vssadmin rule 2019-08-04 11:27:17 +02:00
Thomas Patzke a65a9655f4 Fixed config naming in es-qs query backend test 2019-08-02 08:25:21 +02:00
Thomas Patzke b8d3642c29 Merge branch 'master' of https://github.com/Neo23x0/sigma 2019-08-01 23:46:33 +02:00
Thomas Patzke d5885686fc Sigmatools release 0.12 
* Value modifiers
* Config name cleanup
 2019-08-01 23:45:07 +02:00
Thomas Patzke 805c739611 Merge branch 'devel-modifiers' 2019-07-31 23:44:10 +02:00
Thomas Patzke 31c6ffcb61 No escaping for typed values 2019-07-31 23:43:29 +02:00
Florian Roth d32fc2b2cf fix: fixing rule win_cmstp_com_object_access 
https://github.com/Neo23x0/sigma/issues/408
 2019-07-31 14:16:52 +02:00
Florian Roth 0657f29c99 Rule: reworked win_susp_powershell_enc_cmd 2019-07-30 14:36:30 +02:00
Florian Roth 9143e89f3e Rule: renamed and reworked hacktool Ruler rule 2019-07-26 14:49:09 +02:00
Florian Roth f3fb2b41b2 Rule: FP filters extended 2019-07-23 14:58:36 +02:00
Florian Roth 2c57b443e4 docs: modification date in rule 2019-07-17 09:21:35 +02:00
Florian Roth de74eb4eb7 Merge pull request #400 from yugoslavskiy/win_susp_dhcp_config_failed_fix 
Win susp dhcp config failed fix
 2019-07-17 09:20:25 +02:00
Florian Roth bf0179c0d5 Merge pull request #397 from neu5ron/patch-5 
prevent EventID collision for dhcp
 2019-07-17 09:17:05 +02:00
yugoslavskiy e8b9a6500e author string modified 2019-07-17 07:02:59 +03:00
yugoslavskiy a295334355 win_susp_dhcp_config_failed fixed 2019-07-17 07:01:58 +03:00
Thomas Patzke 0ca15e5c5e Added test case for value modifiers 2019-07-16 23:14:55 +02:00
Thomas Patzke 8a3117d73e Nested list handling for chained value modifiers 2019-07-16 23:03:19 +02:00
Nate Guagenti e2050404bc prevent EventID collision for dhcp 
This prevents EventID collision for this rule with other sources/logs that share the same EventIDs.
specifically a lot with Microsoft-Windows-Security-SPP
 2019-07-16 15:30:52 -04:00
Thomas Patzke 6881967889 Further modifiers 
* base64
* base64offset
 2019-07-16 00:00:35 +02:00
Thomas Patzke 1bb29dca26 Implemented type modifiers and regular expressions 2019-07-15 22:52:10 +02:00
Thomas Patzke b9ff280209 Cleanup of configuration names 2019-07-14 00:50:15 +02:00
Thomas Patzke b20b42b9c9 Added breaking changes file 2019-07-14 00:24:32 +02:00
Thomas Patzke 5489f870cc Merge pull request #393 from HacknowledgeCH/master 
Explicit OR for list elements
 2019-07-13 23:11:44 +02:00
Thomas Patzke 134bfebe57 Ignore "timeframe" detection keyword in "all/any of" conditions 
Fixes #395
 2019-07-13 00:35:35 +02:00
christophetd 576912eb7a Support OR queries for Elasticsearch 6 and above 2019-07-08 17:12:53 +02:00
Florian Roth 2b062a0de7 Merge pull request #389 from christophetd/patch-1 
Include Github raw URLs in suspicious downloads detection rule
 2019-07-05 16:54:09 +02:00
Christophe Tafani-Dereeper 5bc10a4855 Include Github raw URLs in suspicious downloads detection rule 2019-07-05 09:01:35 +00:00
Florian Roth f7ba2b3976 fix: bug in sumologic backend with 'null' values 2019-07-02 22:31:10 +02:00
Florian Roth 0b883a90b6 fix: null value in separate expression 2019-07-02 20:14:45 +02:00
Florian Roth f5a8a81ff7 fix: linux cmds rule 2019-07-02 15:22:26 +02:00
Florian Roth ce43d600e3 fix: added null value / application to 4688 problem 2019-07-02 10:51:48 +02:00
Thomas Patzke 337681cfce Value modifiers 
* First transformation modfiers: contains, all
* Sigma converter modifier list
 2019-06-30 23:41:28 +02:00
Thomas Patzke 161965d14c Added version information to Winlogbeat configs 2019-06-30 22:44:12 +02:00
Thomas Patzke 66f7f5b516 Merge pull request #385 from herrBez/fix-beat-fieldnames 
Modified winlogbeat config to adhere to winlogbeat 7 field names
 2019-06-30 22:42:59 +02:00
Thomas Patzke 141c4f42f3 Merge pull request #383 from TareqAlKhatib/typos 
fixed typos
 2019-06-30 22:39:56 +02:00
herrBez 74021d53d8 Modified winlogbeat config to adhere to winlogbeat 7 field names breaking changes 
ref: https://www.elastic.co/guide/en/beats/libbeat/current/breaking-changes-7.0.html
 2019-06-30 12:13:21 +02:00
Tareq AlKhatib 15e2f5df5f fixed typos 2019-06-29 15:35:59 +03:00
Thomas Patzke f4c8745cde Merge branch 'juju4-devel-sumo' 2019-06-29 00:12:25 +02:00
Thomas Patzke 6fab5d7f23 Improved testing and removed dead&debug code 2019-06-29 00:09:53 +02:00
Thomas Patzke 377872c91e Merge branch 'devel-sumo' of https://github.com/juju4/sigma into juju4-devel-sumo 2019-06-28 23:39:15 +02:00
Thomas Patzke 1cb84d0592 Merge pull request #381 from vburov/patch-6 
Added command that stops services.
 2019-06-28 23:33:54 +02:00
Thomas Patzke a61ad9c9a6 Merge branch 'master' of https://github.com/Neo23x0/sigma 2019-06-28 23:32:37 +02:00
Thomas Patzke c09c1c1b6e Merge branch 'sacx-master' 2019-06-28 23:31:09 +02:00
Thomas Patzke 0c7151c901 Watcher backend default options, refactoring and testing 2019-06-28 23:22:16 +02:00
Vasiliy Burov 2f123f64a7 Added command that stops services. 2019-06-28 19:46:34 +03:00
Adrian Constantin Stanila feac0be8a4 Added 2 more actions on Elasticsearch X-pack Watcher: index and webhook 
Added timestamp filter query.
 2019-06-27 08:54:59 +03:00
Florian Roth ad386474bf fix: removed unusable extensions in proc exec context 2019-06-26 17:03:01 +02:00
Florian Roth 708f3ef002 fix: fixed duplicate element in new double extension rule 2019-06-26 16:00:58 +02:00
Florian Roth 41dc076959 Rule: suspicious double extension 2019-06-26 15:57:25 +02:00
Thomas Patzke 0ea3a681df Merge pull request #378 from cclauss/patch-1 
Use print() function in both Python 2 and Python 3
 2019-06-26 15:15:49 +02:00
cclauss 2cbefb208b Use print() function in both Python 2 and Python 3 
Legacy __print__ statements are syntax errors in Python 3 but __print()__ function works as expected in both Python 2 and Python 3.

[flake8](http://flake8.pycqa.org) testing of https://github.com/Neo23x0/sigma on Python 3.7.1

$ __flake8 . --count --select=E9,F63,F72,F82 --show-source --statistics__
```
./contrib/sigma2sumologic.py:123:5: F821 undefined name 'parser_print_help'
    parser_print_help()
    ^
./contrib/sigma2sumologic.py:211:32: F821 undefined name 'r'
            f.write(json.dumps(r, indent=4, sort_keys=True) + " ERROR: %s\n\nQUERY: %s" % (e, sumo_query))
                               ^
./contrib/sigma2elastalert.py:165:32: E999 SyntaxError: invalid syntax
        print "Converting file " + file
                               ^
./tools/sigma/parser/collection.py:52:27: F821 undefined name 'SigmaCollectionParseError'
                    raise SigmaCollectionParseError("action 'repeat' is only applicable after first valid Sigma rule")
                          ^
1     E999 SyntaxError: invalid syntax
3     F821 undefined name 'parser_print_help'
4
```
__E901,E999,F821,F822,F823__ are the "_showstopper_" [flake8](http://flake8.pycqa.org) issues that can halt the runtime with a SyntaxError, NameError, etc. These 5 are different from most other flake8 issues which are merely "style violations" -- useful for readability but they do not effect runtime safety.
* F821: undefined name `name`
* F822: undefined name `name` in `__all__`
* F823: local variable name referenced before assignment
* E901: SyntaxError or IndentationError
* E999: SyntaxError -- failed to compile a file into an Abstract Syntax Tree
 2019-06-26 14:44:09 +02:00
Florian Roth 39b5eddfc7 Rule: Suspicious userinit.exe child process 2019-06-23 13:27:06 +02:00
juju4 654a009c9e sumologic backend: remove TypeError 2019-06-22 16:49:46 -04:00
juju4 559d0f4ba8 sumologic backend: force as string 2019-06-22 16:43:50 -04:00
juju4 2df0e9765c sumologic backend: pycodestyle review - E501 2019-06-22 16:41:57 -04:00
juju4 49533a5909 sumologic backend: pycodestyle review 2019-06-22 16:39:13 -04:00
juju4 84de12635e self.debug option, fix multiple keyvalue escapings/cleanValue, inline index for now 2019-06-22 16:19:45 -04:00
juju4 059957138d pycodestyle review, openpyxl, error at query generation=continue 2019-06-22 16:18:17 -04:00
juju4 a11d800353 Merge branch 'master' into devel-sumo 2019-06-22 09:18:23 -04:00
Florian Roth 26036e0d35 fix: fixed image in taskmgr rule 2019-06-21 17:15:53 +02:00
Thomas Patzke ff7128209e Adjusted level 2019-06-20 00:03:48 +02:00
Thomas Patzke 5aecb6a5af Merge branch 'mgreen27-master' 2019-06-20 00:02:57 +02:00
Thomas Patzke 0f8849a652 Rule fixes 
* tagging
* removed spaces
* converted to generic log source
* typos/case
 2019-06-20 00:01:56 +02:00
Thomas Patzke f4c86f15b8 Merge branch 'master' of https://github.com/mgreen27/sigma into mgreen27-master 2019-06-19 23:49:20 +02:00
Thomas Patzke 429c29ed5a Merge pull request #363 from yugoslavskiy/win_kernel_and_3rd_party_drivers_exploits_token_stealing 
rule added: Windows Kernel and 3rd-party drivers exploits. Token stea…
 2019-06-19 23:43:10 +02:00
Thomas Patzke f4da0c5540 Added field SecurityID to Winlogbeat config 2019-06-19 23:35:50 +02:00
Thomas Patzke 960cd69d50 Merge branch 'patch-4' of https://github.com/dvas0004/sigma into dvas0004-patch-4 2019-06-19 23:34:25 +02:00
Thomas Patzke f271685f59 Merge pull request #372 from dvas0004/patch-2 
Addition of KeyLength field
 2019-06-19 23:28:31 +02:00
Thomas Patzke e4e8ebbf95 Merge pull request #368 from JayPowerUser/web-source-code-enumeration 
Web Source Code Enumeration via .git
 2019-06-19 23:27:37 +02:00
Thomas Patzke dbbc1751ef Converted rule to generic log source 2019-06-19 23:25:25 +02:00
Thomas Patzke d14f5c3436 Merge pull request #371 from savvyspoon/issue285 
CAR tagging
 2019-06-19 23:21:43 +02:00
Thomas Patzke d82df83ef1 Merge pull request #369 from TareqAlKhatib/refactors 
Refactors
 2019-06-19 23:16:19 +02:00
Thomas Patzke 84c7320849 Merge pull request #370 from SherifEldeeb/patch-1 
Add detection for recent Mimikatz versions
 2019-06-16 12:50:42 +02:00
mgreen27 07e2ee474c sigma/Add sysmon_renamed_binary 2019-06-15 20:20:52 +10:00
mgreen27 1d26708887 sigma/Add sysmon_renamed_binary 2019-06-15 20:19:35 +10:00
David Vassallo d7443d71a4 Create win_pass_the_hash_2.yml 
alternative detection methods
 2019-06-14 18:08:36 +03:00
David Vassallo fdce7ad9bf Addition of KeyLength field 2019-06-14 17:58:47 +03:00
Michael Wade f70549ec54 First Pass 2019-06-13 23:15:38 -05:00
Sherif Eldeeb 2d22a3fe02 Add detection for recent Mimikatz versions 
GrantedAccess is 0x1010 not 0x1410 in recent versions of mimikatz.
This modification should address both
 2019-06-12 12:13:31 +03:00
Thomas Patzke a23f15d42b Converted rule to generic log source 2019-06-11 13:20:15 +02:00
Thomas Patzke 5715413da9 Usage of Channel field name in ELK Windows config 2019-06-11 13:15:43 +02:00
Tareq AlKhatib d61a971874 Minor refactors 2019-06-10 09:55:52 +03:00
Tareq AlKhatib 3bcfc53905 Corrected Typo 2019-06-10 09:54:37 +03:00
Tareq AlKhatib fce2a45dac Corrected Typo 2019-06-10 09:51:34 +03:00
James Ahearn eae7e3ab10 Web Source Code Enumeration via .git 2019-06-08 22:40:28 -04:00
Thomas Patzke 407d8214f7 Added APT40 Dropbox exfiltration proxy rule 2019-06-07 14:03:41 +02:00
yugoslavskiy 5827165c2d event id deleted 2019-06-03 15:51:54 +02:00
yugoslavskiy cf947e3720 changed to process_creation category 2019-06-03 15:47:24 +02:00
yugoslavskiy 6a39b4fb41 date added 2019-06-03 15:42:02 +02:00
yugoslavskiy 10db09c596 rule added: Windows Kernel and 3rd-party drivers exploits. Token stealing 2019-06-03 15:37:41 +02:00
Florian Roth a0c9f1594e Rule: renamed file - name was too generic 2019-06-02 10:57:44 +02:00
Florian Roth 491c519d1f Rule: added wmic SHADOWCOPY DELETE 2019-06-02 10:56:13 +02:00
Florian Roth 80560dc12f Rule: Scanner PoC for CVE-2019-0708 RDP RCE vuln 2019-06-02 09:52:18 +02:00
Florian Roth 5e7ae0590c Rule: Split up WanaCry rule into two separate rules 2019-06-02 09:52:18 +02:00
Florian Roth df35d70ab1 Merge pull request #361 from neu5ron/patch-4 
update correct process name
 2019-06-01 20:51:55 +02:00
Nate Guagenti 2163208e9c update correct process name 
incorrect process name. accidentally had fsutil, should be bcdedit.

thanks to https://twitter.com/INIT_3 for pointing this out
 2019-06-01 09:50:50 -04:00
Thomas Patzke 8a0f706cca Merge branch 'master' of https://github.com/Neo23x0/sigma 2019-05-30 23:24:37 +02:00
Thomas Patzke 1986bcb843 Sigma tools release 0.11 2019-05-30 22:56:38 +02:00
Thomas Patzke 4e96666c04 Merge pull request #336 from petermat/added_rule_T1156 
added rule .bash_profile and .bashrc T1156
 2019-05-30 22:43:33 +02:00
Thomas Patzke 673973e523 Merge pull request #357 from agix/es_dsl_bug 
fix missing condition when unique plus timeframe
 2019-05-30 22:42:09 +02:00
Thomas Patzke fa0aaa7d2b Merge branch 'agix-elastalert_dsl_backend' 2019-05-30 22:38:41 +02:00
Thomas Patzke 67707b6c82 Added test for new elastalert-dsl backend 2019-05-30 22:38:12 +02:00
Thomas Patzke 8023011bb1 Merge branch 'elastalert_dsl_backend' of https://github.com/agix/sigma into agix-elastalert_dsl_backend 2019-05-30 22:33:57 +02:00
Florian GAULTIER 89c1d7b63d Wrong fix, self.queries should be emptied after copied to rule_object 2019-05-29 16:10:14 +02:00
Florian GAULTIER 748ac2e206 Dont combine multiple queries 2019-05-29 16:05:53 +02:00
Florian Roth 2cf402aa1f Merge pull request #360 from spellanser/patch-1 
win_disable_event_logging.yml: typo in audit policy name;
 2019-05-29 15:07:46 +02:00
Sarkis Nanyan 60bc5253cf win_disable_event_logging.yml: typo in audit policy name; 2019-05-29 15:43:44 +03:00
Thomas Patzke 04d91573f3 Merge pull request #355 from agix/allow_empty_keyword 
Allow empty keyword_field
 2019-05-28 21:45:55 +02:00
Thomas Patzke 2ecc55c13f Merge pull request #351 from ipninichuck/master 
added metadata field to the watcher alert
 2019-05-28 21:42:27 +02:00
Thomas Patzke f3edc39535 Merge pull request #346 from tuckner/master 
Add Azure Log Analytics / Azure Sentinel to README list of integrations
 2019-05-28 21:41:19 +02:00
Florian GAULTIER d866e75750 Be sure there is a key in the single condition 2019-05-27 17:27:16 +02:00
Florian GAULTIER e8a7c5f7b9 fix missing condition when unique plus timeframe 2019-05-27 17:22:28 +02:00
Florian GAULTIER 6bf010fb4b introduce elastalert-dsl 
(cherry picked from commit 0235ec23200e62766d9f21fbd26ed834991a0b61)
 2019-05-27 17:18:19 +02:00
Florian GAULTIER 4168c0ec64 Allow empty keyword_field 2019-05-27 15:08:33 +02:00
Thomas Patzke 36ba9f78da Improved message if configuration is missing 2019-05-27 13:18:36 +02:00
Florian Roth 7c1e856095 Merge pull request #353 from lprat/master 
Add rule for CVE-2019-0708
 2019-05-27 09:11:17 +02:00
Florian Roth 323a7313fd FP adjustments 
We have checked the False Positive rate in different environments and noticed these event IDs in cases in which systems had bad network connections / we accessed via VPN. Therefore we reduced the level to "high" and added that note to the "False Positives" list.
 2019-05-27 08:54:18 +02:00
Thomas Patzke 38f3966751 Changed backend list formatting to new method 2019-05-26 22:58:14 +02:00
Thomas Patzke eb9564557e Moved generic class discovery code into new tools module 2019-05-26 22:29:07 +02:00
Thomas Patzke 84690280c5 Improved behavior on missing configuration 
Listing all configus usable with chosen backend
 2019-05-24 22:41:47 +02:00
Thomas Patzke 241d814221 Merged WannaCry rules 2019-05-24 22:17:36 +02:00
Lionel PRAT f65f693a88 Add rule for CVE-2019-0708 2019-05-24 10:01:19 +02:00
Florian Roth 7b63c92fc0 Rule: applying recommendation 
https://twitter.com/SwiftOnSecurity/status/1131464234901094400
 2019-05-23 09:44:25 +02:00
Florian Roth 253417a367 Merge pull request #350 from olafhartong/master 
Rule Windows 10 scheduled task SandboxEscaper 0-day
 2019-05-22 13:54:45 +02:00
ipninichuck 75ec169d5c added metadata field to the watcher alert 
While utilizing Kibana to track watches directly from the watch index it became quickly apparent that useful metadata was not available. In my project's case it was the title, description and tags from the sigma rule. By adding them to the metadata field it makes it easier to utilize them in visualizations of the watches themselves. In the future perhaps the contents of the metadata field could be given as an option for each user.
 2019-05-22 04:30:47 -07:00
Olaf Hartong b60cfbe244 Added password flag 2019-05-22 13:20:26 +02:00
Florian Roth 346022cfe8 Transformed to process creation rule 2019-05-22 12:50:49 +02:00
Olaf Hartong 4a775650a2 Rule Windows 10 scheduled task SandboxEscaper 0-day 2019-05-22 12:36:03 +02:00
Olaf Hartong e675cdf9c4 Rule Windows 10 scheduled task SandboxEscaper 0-day 2019-05-22 12:32:07 +02:00
Olaf Hartong 544dfe3704 Rule Windows 10 scheduled task SandboxEscaper 0-day 2019-05-22 12:28:42 +02:00
Florian Roth c937fe3c1b Rule: Terminal Service Process Spawn 2019-05-22 10:38:27 +02:00
Florian Roth 74ca0eeb88 Rule: Renamed PsExec 2019-05-21 09:49:40 +02:00
Thomas Patzke 2d0c08cc8b Added wildcards to rule values 
These values appear somewhere in a log message, therefore wildcards are
required.
 2019-05-21 01:03:20 +02:00
tuckner 7d10491bf2 Update README.md 2019-05-20 17:46:28 -05:00
tuckner 5867b5da74 Update README.md 2019-05-20 17:45:18 -05:00
Thomas Patzke 194afa739f Generate rule name for each condition 
In backends kibana and xpack-watcher.

Fixes #329
 2019-05-21 00:36:19 +02:00
Thomas Patzke af0bd1b082 Removed debug code from backend option handling 
Additionally: code simplification
 2019-05-21 00:21:52 +02:00
Thomas Patzke 97541ac267 Added -C shortcut for --backend-config 2019-05-21 00:15:01 +02:00
Thomas Patzke 7e163d71eb Added option to use old URL in xpack-watcher backend 2019-05-21 00:01:21 +02:00
Thomas Patzke 4e63e925cf Merge branch 'patch-1' of https://github.com/lliknart/sigma into lliknart-patch-1 2019-05-20 23:43:49 +02:00
Thomas Patzke 11ed7e7ef8 Check for valid configuration/backend combinations 2019-05-20 01:00:33 +02:00
Thomas Patzke e271484eef Load configurations via new config management 2019-05-20 00:27:35 +02:00
Thomas Patzke 3d20e0bc98 Sigma configuration management with listing 
Missing:
* Use config by identifier
 2019-05-17 09:13:59 +02:00
Thomas Patzke 71ff6bd943 Catch type errors in configuration handling 2019-05-16 23:34:44 +02:00
Thomas Patzke 36aeb19721 Added title to all configurations 2019-05-16 23:33:51 +02:00
lliknart f86342012a Update elasticsearch.py 
From ElasticSearch 7.0, the URI to access to Watcher API changes

Deprecation: [PUT /_xpack/watcher/watch/{id}] is deprecated! Use [PUT /_watcher/watch/{id}] instead.
 2019-05-16 16:17:57 +02:00
Florian Roth 9e2345c491 Merge pull request #338 from yt0ng/development 
Suspicious Outbound RDP Rule likely identifying CVE-2019-0708
 2019-05-15 21:35:52 +02:00
Florian Roth a6d2a5d79b fix: more general fixes of the var type issue 2019-05-15 21:25:53 +02:00
Florian Roth 9f1bbb0a0d fix: missing type check in WDATP backend 2019-05-15 21:20:20 +02:00
Florian Roth 694fa567b6 Reformatted 2019-05-15 20:22:53 +02:00
Florian Roth 1c36bfde79 Bugfix - Swisscom in Newline 2019-05-15 15:03:55 +02:00
Florian Roth d5f49c5777 Fixed syntax 2019-05-15 14:50:57 +02:00
Florian Roth 508d1cdae0 Removed double back slashes 2019-05-15 14:46:45 +02:00
Unknown 13522b97a7 Adjusting Newline 2019-05-15 12:15:41 +02:00
Unknown 275896dbe6 Suspicious Outbound RDP Rule likely identifying CVE-2019-0708 2019-05-15 11:47:12 +02:00
petermmm b6c4e64a9b fixed attack category number 2->3 2019-05-12 11:59:13 +02:00
petermmm 2778558ae3 added rule .bash_profile and .bashrc T1156 2019-05-12 02:07:13 +02:00
Florian Roth 5dfe39c05b Merge pull request #335 from Codehardt/master 
fix: fixed reference list, otherwise it's not valid string list
 2019-05-10 14:06:11 +02:00
Codehardt 1ca57719b0 fix: fixed reference list, otherwise it's not valid string list 2019-05-10 10:37:12 +02:00
Thomas Patzke 1c2bc87946 Merge pull request #334 from Codehardt/master 
fix: fixed reference list, otherwise it's not valid string list
 2019-05-10 10:19:56 +02:00
Codehardt 6585c83077 fix: fixed reference list, otherwise it's not valid string list 2019-05-10 10:13:35 +02:00
Thomas Patzke 526468bec3 Merge pull request #298 from christophetd/elastalert-allow-rules-without-http-post-url 
Allow generating Elastalert rules with the http_post alert type without specifying a URL at generation time
 2019-05-10 00:31:33 +02:00
Thomas Patzke f4d8dcaa1e Merge branch 'Karneades-patch-1' 2019-05-10 00:21:15 +02:00
Thomas Patzke 25c0330dca Added filter 2019-05-10 00:20:56 +02:00
Thomas Patzke 995c03eef9 Merge branch 'patch-1' of https://github.com/Karneades/sigma into Karneades-patch-1 2019-05-10 00:15:51 +02:00
Thomas Patzke a361664ed2 Merge pull request #318 from HacknowledgeCH/es-qs-not-parenthesis-fix 
Correct parenthesization for NOT expressions in the ES-QS backend
 2019-05-10 00:14:29 +02:00
Thomas Patzke 56f64ca47d Merge pull request #315 from P4T12ICK/feature/net_dnc_c2_detection 
New C2 DNS Tunneling Sigma Detection Rule
 2019-05-10 00:12:39 +02:00
Thomas Patzke c50119b913 Merge branch 'P4T12ICK-feature/lnx-priv-esc-prep' 2019-05-10 00:08:48 +02:00
Thomas Patzke 46c789105b Fix and ordering 2019-05-10 00:08:26 +02:00
Thomas Patzke 595f22552d Merge branch 'feature/lnx-priv-esc-prep' of https://github.com/P4T12ICK/sigma into P4T12ICK-feature/lnx-priv-esc-prep 2019-05-10 00:05:06 +02:00
Thomas Patzke 27199fc231 Merge branch 'neu5ron-patch-3' 2019-05-10 00:02:33 +02:00
Thomas Patzke 15a4c7e477 Fixed rule 2019-05-10 00:02:20 +02:00
Thomas Patzke 666e859d14 Merge branch 'patch-3' of https://github.com/neu5ron/sigma into neu5ron-patch-3 2019-05-10 00:00:14 +02:00
Thomas Patzke 14b10c232e Merge branch 'MadsRC-MadsRC-patch-1' 2019-05-09 23:58:14 +02:00
Thomas Patzke f51e918a2e Small rule change 2019-05-09 23:57:55 +02:00
Thomas Patzke 31946426a5 Merge branch 'MadsRC-patch-1' of https://github.com/MadsRC/sigma into MadsRC-MadsRC-patch-1 2019-05-09 23:54:18 +02:00
Thomas Patzke f01fbd6b79 Merge branch 2019-05-09 23:51:15 +02:00
Thomas Patzke e60fe1f46d Changed rule 
* Adapted false positive notice to observation
* Decreased level
 2019-05-09 23:49:39 +02:00
Florian Roth 3dd76a9c5e Converted to generic process creation rule 
Previous rule was prone to FPs; more generic form
 2019-05-09 23:48:42 +02:00
Vasiliy Burov 792095734d Update win_proc_wrong_parent.yml 
changes accordingly this documents:
https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/
https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf
 2019-05-09 23:48:36 +02:00
Florian Roth 378ba5b38f Transformed rule 
I would try it like this - the 4th selection for uncommon parents of explorer.exe looks prone to FPs

Fixed Typo

Changes to title and description
 2019-05-09 23:48:36 +02:00
Vasiliy Burov 8e6295e402 Windows processes with wrong parent 
Detect scenarios when malicious program is disguised as legitimate process
 2019-05-09 23:48:36 +02:00
Thomas Patzke 1e2ef92104 Merge branch 'vburov-patch-2' 2019-05-09 23:10:52 +02:00
Thomas Patzke 121e21960e Rule changes 
* Replaced variables with usual path names
* Removed Temp directories due to many false positives
* Matching on Image field, CommandLines often contain these paths
 2019-05-09 23:09:22 +02:00
Thomas Patzke 9b67705799 Merge branch 'patch-2' of https://github.com/vburov/sigma into vburov-patch-2 2019-05-09 22:55:07 +02:00
Thomas Patzke 763939a8ca Hide --shoot-yourself-in-the-foot 2019-04-25 23:42:13 +02:00
Thomas Patzke eb022f3908 Conditional field mapping for null values 
Fixes #326
 2019-04-25 23:24:05 +02:00
Thomas Patzke cfb4f32651 Backend es-dsl tolerates rules without title and log source 2019-04-25 22:41:31 +02:00
Florian Roth 16bf5eef0f Merge pull request #327 from Codehardt/master 
Added logsources for generic sigma rules to spark config, renamed spa…
 2019-04-25 10:10:51 +02:00
Codehardt 17ae9ea91c Renamed spark config in setup.py 2019-04-25 09:56:29 +02:00
Codehardt 8cf505fcb3 Accidentally removed windows-dhcp logsource in spark's config file 2019-04-25 08:23:48 +02:00
Codehardt 79f7edb6b4 Added logsources for generic sigma rules to spark config, renamed spark config to thor config 2019-04-25 08:15:50 +02:00
Thomas Patzke 6918784e87 Configuration order checking 2019-04-23 00:54:10 +02:00
Thomas Patzke c90d3e811e Formatted error code definitions 2019-04-23 00:53:52 +02:00
Thomas Patzke e9af99c147 Completed error codes 2019-04-23 00:52:31 +02:00
Thomas Patzke 4559aa4e00 Fixed es-qs backend check 2019-04-23 00:05:36 +02:00
Thomas Patzke d0bd8a2a41 Mandatory configuration for most backends 2019-04-22 23:40:21 +02:00
Thomas Patzke 87abd20c0f Removed deprecated PyYAML API from rule test 2019-04-22 23:21:08 +02:00
Thomas Patzke 34c426a95b Moved error codes to constants defined centrally 2019-04-22 23:15:35 +02:00
Thomas Patzke f0b0f54500 Merge improved pull request #322 2019-04-21 23:56:36 +02:00
Thomas Patzke 765fe9dcd9 Further improved Windows user creation rule 
* Decreased level
* Fixed field names
* Added false positive possibility
 2019-04-21 23:54:18 +02:00
Florian Roth d0950bd077 fix: yaml.load() issue 
https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
 2019-04-21 20:30:31 +02:00
Karneades b47900fbee Add default path to filter for explorer in exe anomaly rule 2019-04-21 17:42:47 +02:00
Florian Roth 38d548868d Merge pull request #324 from Neo23x0/revert-322-feature/win_user_creation 
Revert "New Sigma rule detecting local user creation"
 2019-04-21 09:20:48 +02:00
Florian Roth dd9648b31e Revert "New Sigma rule detecting local user creation" 2019-04-21 09:09:25 +02:00
Florian Roth a85acdfd02 Changed title and description 2019-04-21 08:54:56 +02:00
Florian Roth 0713360443 Fixed MITRE ATT&CK tags 2019-04-21 08:52:07 +02:00
Thomas Patzke 49beb5d1a8 Integrated PR from @P4T12ICK in existing rule 
PR #321
 2019-04-21 00:28:40 +02:00
Thomas Patzke bdd184a24c Merge pull request #322 from P4T12ICK/feature/win_user_creation 
New Sigma rule detecting local user creation
 2019-04-21 00:20:15 +02:00
Thomas Patzke 80f45349ed Modified rule 
* Adjusted ATT&CK tagging
* Set status
 2019-04-21 00:14:57 +02:00
Florian Roth aab3dbee4f Rule: Detect Empire PowerShell Default Cmdline Params 2019-04-20 09:38:41 +02:00
Florian Roth 03d8184990 Rule: Extended PowerShell Susp Cmdline Enc Commands 2019-04-20 09:38:41 +02:00
Florian Roth 5249279a66 Rule: another MSF payload user agent 2019-04-20 09:38:41 +02:00
Florian Roth d5fa51eab9 Merge pull request #305 from Karneades/patch-3 
Remove too loose filter in notepad++ updater rule
 2019-04-19 12:40:24 +02:00
Florian Roth e32708154f Merge pull request #304 from Karneades/patch-2 
Remove too loose filter in mshta rule
 2019-04-19 09:51:45 +02:00
Florian Roth 74dd008b10 FP note for HP software 2019-04-19 09:51:32 +02:00
Florian Roth 8a5ae01f0e Merge pull request #323 from Karneades/filterFix 
Restrict filter in system exe anomaly rule
 2019-04-19 09:17:16 +02:00
Karneades d75ea35295 Restrict whitelist filter in system exe anomaly rule 2019-04-18 22:06:12 +02:00
patrick 8609fc7ece New Sigma rule detecting local user creation 2019-04-18 19:59:43 +02:00
Florian Roth f78413deab Merge pull request #309 from jmlynch/master 
added rules for renamed wscript, cscript and paexec. Added two direct…
 2019-04-17 23:59:27 +02:00
Florian Roth 4808f49e0d More exact path 2019-04-17 23:45:15 +02:00
Florian Roth 1a4a74b64b fix: dot mustn't be escaped 2019-04-17 23:44:36 +02:00
Florian Roth 76780ccce2 Too many different trusted cscript imphashes 2019-04-17 23:33:56 +02:00
Florian Roth 7c5f985f6f Modifications 2019-04-17 23:30:49 +02:00
Florian Roth 4298abffb7 Modifications 2019-04-17 23:29:29 +02:00
Florian Roth 615a802a8e Modifications 2019-04-17 23:26:20 +02:00
Florian Roth 0a960ed3cd Merge pull request #319 from Sam0x90/master 
Update win_susp_svchost rule
 2019-04-17 23:22:08 +02:00
Sam0x90 0e8a46aaf7 Update win_subp_svchost rule 
Adding rpcnet.exe as ParentImage
 2019-04-16 15:00:06 +02:00
christophetd 4e16bbafa8 Correct parenthesization for NOT expressions in the ES-QS backend 2019-04-16 10:30:18 +02:00
Florian Roth 17470d1545 Rule: extended parent list for legitimate svchost starts 
https://twitter.com/Sam0x90/status/1117768799816753153
 2019-04-15 14:54:35 +02:00
Florian Roth daaee558a1 Rule: added date to Tom's WMI rule 2019-04-15 09:06:53 +02:00
Florian Roth 612a7642d2 Added Local directory 2019-04-15 08:47:53 +02:00
Florian Roth 65b81dad32 Rule: Suspicious scripting in a WMI consumer 2019-04-15 08:13:35 +02:00
Florian Roth 1d3159bef0 Rule: Extended Office Shell rule 2019-04-15 08:13:35 +02:00
Karneades d872c52a43 Add restricted filters to notepad++ gup.exe rule 2019-04-15 08:12:12 +02:00
Thomas Patzke 5194e8778c Fail on missing target selection 2019-04-14 23:50:07 +02:00
Florian Roth 1e262f5055 Merge pull request #303 from Karneades/patch-1 
Remove too loose filter in wmi spwns powershell rule
 2019-04-14 23:11:57 +02:00
Florian Roth cb0a87e21e Merge pull request #316 from megan201296/patch-19 
Update win_mal_ursnif.yml
 2019-04-14 23:10:16 +02:00
Florian Roth 08ec8597a5 Merge pull request #317 from megan201296/patch-20 
Create apt_oceanlotus_registry.yml
 2019-04-14 23:09:42 +02:00
Thomas Patzke 5463128ea0 Merge pull request #314 from Karneades/patch-4 
Remove loose wildcard filter in powershell encoded cmd rule
 2019-04-14 23:02:42 +02:00
megan201296 74fce5f511 Create apt_oceanlotus_registry.yml 
Rule based on https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/. Based on OSINT, these keys are unique to the oceanlotus activity and not at all legitimate.
 2019-04-14 12:01:52 -05:00
megan201296 eb8a0636c5 Update win_mal_ursnif.yml 
After @thomaspatzke changed to HKU, I did some reading. HKU is for HKEY_User, not HKEY_Current_User (what this threat is tied to. However, he was correct that HKCU does not exist as a prefix for sysmon (see the notes section under event id 13 here: https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml). Changed to ignore the key name, confirmed that the key is still uniique.
 2019-04-14 11:51:13 -05:00
patrick 51d19b36cc Add new Sigma Rule for C2 DNS Tunneling 2019-04-13 20:28:55 +02:00
patrick 4b43db2aac Add new Sigma Rule for C2 DNS Tunneling 2019-04-13 20:27:36 +02:00
Florian Roth 6351c5a350 Sigma ATT&CK coverage by @jmallette 2019-04-11 18:27:52 +02:00
Florian Roth 038918d2c0 Merge pull request #311 from jmallette/master 
ATT&CK Navigator Coverage Layer
 2019-04-11 18:18:16 +02:00
Karneades 75d36165fc Remove non-generic falsepositives 
There are tons of FPs for that... :)
 2019-04-11 12:55:24 +02:00
Karneades 51e65be98b Remove loose wildcard filter in powershell encoded cmd rule 2019-04-11 12:53:12 +02:00
Jon cd456a1d2b initial SIGMA ATTACK Navigator layer release 2019-04-09 22:49:28 -04:00
jmallette c775b7a033 Merge pull request #1 from Neo23x0/master 
update fork
 2019-04-09 22:43:32 -04:00
Jason Lynch 89fb726875 added win_office_spawn_exe_from_users_directory.yml. Detects executable in users directory started via office program. Helpful for adversaries that tend to drop and execute renamed binaries in this location such as fin7 2019-04-09 09:45:07 -04:00
Jason Lynch f0c8c428bb added rules for renamed wscript, cscript and paexec. Added two directories to the existing sysmon_susp_prog_location_network_connection rule. These additions are all fin7 related. 2019-04-08 08:07:30 -04:00
juju4 152febcea2 sumologic: fixing non-pushed cleannode() 2019-04-07 13:04:15 -04:00
patrick ca4b710c01 Added Sigma Use Case detecting Privilege Escalation Preparation in Linux 2019-04-07 15:36:19 +02:00
Karneades 97376c00de Fix condition 2019-04-04 22:33:32 +02:00
Karneades 766b8b8d18 Fix condition 2019-04-04 22:32:47 +02:00
Karneades 788e75ef1b Fix condition 2019-04-04 22:32:21 +02:00
Karneades 840eb2f519 Remove too loose filter in notepad updater rule 2019-04-04 22:25:05 +02:00
Karneades eb690d8902 Remove too loose filter in mshta rule 2019-04-04 22:16:24 +02:00
Karneades 1915561351 Remove to loose wildcard from wmi spwns powershell rule 2019-04-04 22:12:28 +02:00
Florian Roth 81693d81b6 Merge pull request #295 from sbousseaden/master 
Create win_atsvc_task.yml
 2019-04-04 18:32:13 +02:00
sbousseaden c4b8f75940 Update win_lm_namedpipe.yml 2019-04-04 18:22:50 +02:00
MadsRC 41b4d800c5 Update net_susp_dns_txt_exec_strings.yml 
Fixed my botched YAML syntax...
 2019-04-04 08:35:37 +02:00
sbousseaden 22958c45a3 Update win_GPO_scheduledtasks.yml 2019-04-03 21:50:55 +02:00
sbousseaden b4ac9a432f Update win_susp_psexec.yml 2019-04-03 21:50:25 +02:00
sbousseaden 353e457104 Update win_lm_namedpipe.yml 2019-04-03 21:49:58 +02:00
sbousseaden d5818a417b Update win_impacket_secretdump.yml 2019-04-03 21:49:30 +02:00
sbousseaden 9c5575d003 Update win_atsvc_task.yml 2019-04-03 21:48:38 +02:00
sbousseaden edb98f2781 Update win_account_discovery.yml 2019-04-03 21:40:59 +02:00
MadsRC d0d51b6601 Update net_susp_dns_txt_exec_strings.yml 
The references indicate that this rule should apply to TXT records, but without specifying that the "record_type" must be "TXT" there's the potential for a lot of false positives.

"record_type" was chosen as that fits with Splunks "Network Resolution (DNS)" datamodel.
 2019-04-03 20:31:31 +02:00
Florian Roth 2b814011cd Merge pull request #287 from P4T12ICK/feature/lnx-clear-cmd-history-signature 
Add new signature for linux clear command history
 2019-04-03 19:45:06 +02:00
Florian Roth 13f86e9333 Merge pull request #296 from Karneades/patch-1 
Remove backslashes in CommandLine for sticky key rule
 2019-04-03 19:44:02 +02:00
Florian Roth b4b7d810fc Merge pull request #300 from yt0ng/development 
Sqirrel packages manager, EmpireMonkey, WMI Spawning PowerShel
 2019-04-03 19:20:46 +02:00
yt0ng e0459cec1c renamed file 2019-04-03 17:39:17 +02:00
christophetd d32e5c10b8 Allow generating Elastalert rules with the http_post alert type without specifying a URL at generation time 2019-04-03 17:22:58 +02:00
t0x1c-1 7e058e611c WMI spawning PowerShell seen in various attacks 2019-04-03 16:56:45 +02:00
Unknown 9ada22b8e0 adjusted link 2019-04-03 16:40:18 +02:00
Unknown d2e605fc5c Auto stash before rebase of "Neo23x0/master" 2019-04-03 16:25:18 +02:00
Karneades 865d971704 Remove backslashes in CommandLine for sticky key rule 
Example command line is exactly "cmd.exe sethc.exe 211".
=> the detection with *\cmd.exe... would not match.
 2019-04-03 16:16:18 +02:00
sbousseaden eda5298457 Create win_account_backdoor_dcsync_rights.yml 2019-04-03 16:16:05 +02:00
sbousseaden 0756b00cdf Create win_susp_psexec.yml 2019-04-03 15:59:46 +02:00
sbousseaden 9c1a5a5264 Create win_lm_namedpipe.yml 2019-04-03 15:48:42 +02:00
sbousseaden 56b68a0266 Create win_GPO_scheduledtasks.yml 2019-04-03 15:36:24 +02:00
sbousseaden b941f6411f Create win_impacket_secretdump.yml 2019-04-03 15:18:42 +02:00
sbousseaden 516c8f3ea1 Create win_account_discovery.yml 2019-04-03 14:41:11 +02:00
sbousseaden 3d69727332 Create sysmon_rdp_settings_hijack.yml 2019-04-03 14:16:25 +02:00
sbousseaden 016261cacf Update sysmon_lsass_memdump.yml 2019-04-03 14:06:49 +02:00
sbousseaden a85c668f6f Update sysmon_lsass_memdump.yml 2019-04-03 14:00:51 +02:00
sbousseaden d62bc41bfb Create win_svcctl_remote_service.yml 2019-04-03 13:58:20 +02:00
sbousseaden 32c6b34746 Create sysmon_lsass_memdump.yml 2019-04-03 13:51:59 +02:00
sbousseaden 548145ce10 Create win_susp_raccess_sensitive_fext.yml 2019-04-03 13:22:42 +02:00
sbousseaden ddb2d92a98 Create sysmon_tsclient_filewrite_startup.yml 2019-04-03 13:19:59 +02:00
sbousseaden e3f99c323b Create win_atsvc_task.yml 2019-04-03 13:08:12 +02:00
Florian Roth 6cc1770351 Merge pull request #294 from Pr0t3an/patch-3 
Update lnx_shell_susp_rev_shells.yml
 2019-04-03 01:07:07 +02:00
Florian Roth b76925f838 Rule: extending rule with /dev/udp 2019-04-02 20:09:13 +02:00
Pr0t3an d067087632 Update lnx_shell_susp_rev_shells.yml 
added 
 - 'bash -i >& /dev/udp/'
        - 'sh -I >$ /dev/udp/'
        - 'sh -i   >$ /dev/tcp/'
 2019-04-02 18:22:18 +01:00
Florian Roth 5c5a16c4d5 Rule: adding xterm -display string to rule 2019-04-02 18:48:18 +02:00
Florian Roth 453bd10e6e Rule: Suspicious reverse shell command lines 2019-04-02 17:03:57 +02:00
Thomas Patzke 8e854b06f6 Specified source to prevent EventID collisions 
Issue #263
 2019-04-01 23:45:55 +02:00
Thomas Patzke 0419ff215a Fixed quoting of single quotes in grep backend 2019-04-01 23:22:05 +02:00
Florian Roth d06a5431eb Changes 2019-04-01 14:03:54 +02:00
Florian Roth c7553dc8a1 Merge pull request #292 from yt0ng/development 
Allow Incoming Connections by Port or Application on Windows Firewall
 2019-04-01 14:02:10 +02:00
Florian Roth e473efb7c3 Trying to fix ATT&CK framework tag 2019-04-01 10:36:35 +02:00
Florian Roth 3f2ce4b71f Lowered level to medium 2019-04-01 09:47:14 +02:00
t0x1c-1 51c42a15a7 Allow Incoming Connections by Port or Application on Windows Firewall 2019-04-01 08:16:56 +02:00
patrick 0242c40360 Add new signature for linux clear command history 2019-03-24 10:10:14 +01:00
Nate Guagenti 60c4fed2e0 Create win_etw_trace_evasion.yml 
there are two versions of clear and two variations of set that can be used with something like wevtutil
`wevtutil cl | wevtutil clear-log | wevtutil sl | wevtutil set-log `

Also, I am adding a `*` match at the end, because there are other parameters that could be placed on the end -- so unless this was used on a general search on a text/analyzed field then the `*` is necessary.

example `wevtutil set-log Microsoft-Windows-WMI-Activity/Trace /e:disable /q:true`
 2019-03-22 11:36:55 -04:00
Florian Roth ffac77fb37 Rule: extended LockerGoga description 2019-03-22 11:03:48 +01:00
Florian Roth 1adb040e0b Rule: LockerGoga 2019-03-22 10:59:31 +01:00
Florian Roth 2ad2ba9589 fix: rule field fix in proc_creation rule 2019-03-22 10:59:18 +01:00
Thomas Patzke 140a32d8c9 Sigma tools release 0.10 2019-03-16 01:02:48 +01:00
Thomas Patzke 2dda9a7b77 Moved Sysmon schema XML from contrib directory into module 2019-03-16 00:59:29 +01:00
Thomas Patzke be25aa2c37 Added CAR tags 2019-03-16 00:37:09 +01:00
Thomas Patzke 8512417de0 Incorporated MITRE CAR mapping from #55 2019-03-16 00:03:27 +01:00
Thomas Patzke 5c4d8bc2ca Merge branch 'christophetd-backend-config-file' 2019-03-15 23:47:24 +01:00
Thomas Patzke 5e973a6321 Fixes and CI testing of --backend-config 2019-03-15 23:46:38 +01:00
Thomas Patzke 0864d05aa5 Merge branch 'backend-config-file' of https://github.com/christophetd/sigma into christophetd-backend-config-file 2019-03-15 23:35:11 +01:00
Thomas Patzke 9be6b8b1a5 Merge branch 'tuckner-master' 2019-03-15 23:27:40 +01:00
Thomas Patzke 3f7e08733a Added backend option 'sysmon' for ala backend 2019-03-15 23:26:15 +01:00
Thomas Patzke 8d1723e65c Merge branch 'master' of https://github.com/tuckner/sigma into tuckner-master 2019-03-15 23:06:08 +01:00
Thomas Patzke 5e3a25537e Merge pull request #283 from LiamSennitt/master 
Added and fixed tags on APT rules
 2019-03-15 23:00:25 +01:00
Florian Roth 4650271117 Merge pull request #284 from krakow2600/master 
added missed service
 2019-03-14 08:20:48 +01:00
yugoslavskiy 33db032a16 added missed service 2019-03-14 00:44:26 +01:00
Liam Sennitt bb026e4692 fixed tag typo on rules 2019-03-13 10:25:41 +00:00
Liam Sennitt 0aaac1a48e add tags to crime fireball rule 2019-03-13 10:10:12 +00:00
Liam Sennitt 1e29c9c1ce add tags to apt zxshell rule 2019-03-13 10:09:05 +00:00
Liam Sennitt 1f47dc1cdc add tags to apt turla commands rule 2019-03-13 10:06:34 +00:00
Liam Sennitt 96492834c5 add tags to apt sofacy rule 2019-03-13 09:53:02 +00:00
Liam Sennitt aca36c88cc add tags to apt slingshot rule 2019-03-13 09:50:39 +00:00
Liam Sennitt aac632bb41 add tags on apt equationgroup dll_u load rule 2019-03-13 09:48:27 +00:00
Liam Sennitt 5ffc027f22 fix tags in apt carbonpaper turla rule 2019-03-13 09:43:18 +00:00
Liam Sennitt 25b680bfec fix and add tags to apt bear activity gtr19 rule 2019-03-13 09:40:28 +00:00
Liam Sennitt 3b193fb691 add tags to apt babyshark rule 2019-03-13 09:32:10 +00:00
Liam Sennitt aee0d1dd67 fix tags on apt29 tor rule 2019-03-13 09:25:28 +00:00
Liam Sennitt 5dc229b590 add tags to apt29 thinktanks rule 2019-03-13 09:22:41 +00:00
Florian Roth 95b47972f0 fix: transformed rule to new proc_creation format 2019-03-12 09:03:30 +01:00
Florian Roth c4003ff410 Merge pull request #264 from darkquasar/master 
adding rule win-susp-mshta-execution.yml
 2019-03-11 23:50:56 +01:00
Florian Roth bd38cff042 Merge pull request #272 from LiamSennitt/master 
fix tagging in turla png dropper service rule
 2019-03-11 23:48:18 +01:00
Florian Roth 909c09f4ac Merge pull request #282 from krakow2600/master 
updated detection logic
 2019-03-11 23:47:53 +01:00
Yugoslavskiy Daniil 5d54e9c8a1 nbstat.exe -> nbtstat.exe 2019-03-11 19:28:29 +01:00
Yugoslavskiy Daniil c22265c655 updated detection logic 2019-03-11 16:58:57 +01:00
Florian Roth 8dd39a2653 Merge pull request #281 from TareqAlKhatib/oops 
Migrated the last detections to process_creation
 2019-03-09 19:40:25 +01:00
Tareq AlKhatib 783d8c4268 Reverting back to regular Sysmon 1 to fix CI test 2019-03-09 21:31:56 +03:00
Tareq AlKhatib 7f4557d183 Enabled check for process_creation 2019-03-09 21:00:11 +03:00
Tareq AlKhatib 075df83118 Converted to use the new process_creation data source 2019-03-09 20:57:59 +03:00
Tareq AlKhatib c3b079990a Properly end anchored the regex 2019-03-09 19:23:50 +03:00
Florian Roth 361f2ffa5f Product Support - RANK VASA 2019-03-08 16:32:22 +01:00
Florian Roth fe9e50167f Rule: renamed bitsadmin rule 2019-03-08 16:25:16 +01:00
Florian Roth 49532438eb Rule: Bitsadmin wot uncommon TLD 2019-03-08 16:20:10 +01:00
John Tuckner a1ba04aec8 modified process creation logic 2019-03-08 00:01:43 -06:00
Thomas Patzke 082ee586bf Merge branch 'christophetd-elastalert-alert-types' 2019-03-08 00:05:08 +01:00
Thomas Patzke 6d97c6d0bb Extended elastalert CI testing 2019-03-08 00:04:43 +01:00
Thomas Patzke a429f09cc1 Merge branch 'elastalert-alert-types' of https://github.com/christophetd/sigma into christophetd-elastalert-alert-types 2019-03-07 23:54:05 +01:00
Thomas Patzke 3c1948f089 Merge pull request #277 from megan201296/patch-18 
Remove invalid link
 2019-03-07 23:49:13 +01:00
Thomas Patzke c235944a0c Merge pull request #278 from krakow2600/master 
fixed incorrect date format
 2019-03-07 23:46:12 +01:00
tuckner c97f0f097b Merge branch 'master' of https://github.com/tuckner/sigma 2019-03-07 16:29:01 -06:00
tuckner e9ddd933f8 more fixes for process creation 2019-03-07 16:28:35 -06:00
Yugoslavskiy Daniil 475113b1c1 fixed incorrect date format 2019-03-07 22:52:11 +01:00
megan201296 c2a16591af Remove invalid link 
Cybereason link was broken. Couldn't find anything with a super similar file path. The below link might be a valid replacement but went better safe than sorry and just removed it completely. https://www.cybereason.com/hubfs/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty-Part1.pdf
 2019-03-07 14:22:29 -06:00
John Tuckner 1182ee2de2 added ala to makefile 2019-03-07 10:43:22 -06:00
John Tuckner 5a64f572e3 update 2019-03-07 10:32:59 -06:00
Florian Roth a82ea0a022 Merge pull request #276 from krakow2600/master 
ATC windows rules review
 2019-03-06 17:16:32 +01:00
Florian Roth 83c0c71bc7 Reworked for process_creation rules 2019-03-06 17:09:43 +01:00
Florian Roth d7c25adfb6 Merge pull request #274 from TareqAlKhatib/multifile_yamls 
Updated to use the new process_creation logsource
 2019-03-06 17:06:04 +01:00
Yugoslavskiy Daniil cb7243de5d fixed wrong tags 2019-03-06 06:18:38 +01:00
Yugoslavskiy Daniil 8bec627ff1 fixed multiple tags issue 2019-03-06 06:09:37 +01:00
Yugoslavskiy Daniil 5154460726 changed service to product 2019-03-06 05:57:01 +01:00
Yugoslavskiy Daniil 05cc7e455d atc review 2019-03-06 05:25:12 +01:00
yugoslavskiy 725ab99e90 Merge pull request #1 from AverageS/master 
Fix rules
 2019-03-06 04:31:01 +01:00
John Tuckner 283bd278f4 added eventid to sysmon process creation 2019-03-05 20:58:23 -06:00
John Tuckner 971bd49071 accomodated process creation and slash escapes 2019-03-05 20:50:30 -06:00
Wydra Mateusz 534f250c35 Merge branch 'master' of https://github.com/krakow2600/sigma 2019-03-06 00:45:16 +01:00
Wydra Mateusz bb95347745 rules update 2019-03-06 00:43:42 +01:00
mrblacyk 6232362f04 Missing tags 2019-03-06 00:16:40 +01:00
mrblacyk 07807837ee Missing tags 2019-03-06 00:02:37 +01:00
mikhail be108d95cc Merge branch 'master' of https://github.com/AverageS/sigma 2019-03-06 01:57:38 +03:00
mikhail 40241c1fdf Fix 4 rules 2019-03-06 01:56:05 +03:00
mrblacyk 99595a7f89 Added missing tags and some minor improvements 2019-03-05 23:25:49 +01:00
Tareq AlKhatib 879017818f More conversions to the new process_creation logsource 2019-03-05 09:46:53 +03:00
tuckner 2c0cc87ab8 Added schema file checking 2019-03-04 11:57:30 -06:00
tuckner cf186387af Added schema file checking 2019-03-04 11:53:51 -06:00
tuckner c5796d7853 Added Azure Log Analytics backend 2019-03-04 10:49:50 -06:00
tuckner 8179d182c4 added azure log analytics 2019-03-04 10:44:45 -06:00
Tareq AlKhatib b2952b9f78 Fixing failed CI build - take 2 2019-03-04 16:51:39 +03:00
Tareq AlKhatib c8be6e649b Fixing failed CI build 2019-03-04 16:44:30 +03:00
Tareq AlKhatib 45458121c6 Updated to use the new process_creation logsource 2019-03-04 16:13:27 +03:00
Florian Roth ae1541242c New custom suspicious TLD in rule ".pw" 2019-03-03 10:58:12 +01:00
Thomas Patzke 17e9729ddd Merge pull request #273 from TareqAlKhatib/process_create 
Process create
 2019-03-02 21:57:59 +01:00
Tareq AlKhatib 58c61430a2 updated to use process_creation 2019-03-02 21:05:15 +03:00
Tareq AlKhatib be2ca8dc4d Added checks for Sysmon 1 or EID 4688 instead of process_creation 2019-03-02 20:51:49 +03:00
Florian Roth 33e490e4fa Titles in Examples 2019-03-02 12:23:44 +01:00
Florian Roth 7b3d67ae66 fix: bugfix in new proc creation rule 2019-03-02 11:28:13 +01:00
Florian Roth 9a3ceb8421 Sigmac Usage Examples 2019-03-02 10:58:02 +01:00
Liam Sennitt bef5f03015 fix tagging in turla png dropper service rule 2019-03-02 09:01:00 +00:00
Florian Roth 1a583c158d fixed typo as in pull request by @m0jtaba 2019-03-02 08:16:25 +01:00
Florian Roth 2188001f98 Extended filter list provided by @Ov3rflow 2019-03-02 08:13:29 +01:00
Florian Roth bd4e61acd8 Merge pull request #271 from vburov/patch-4 
Update win_susp_failed_logon_reasons.yml
 2019-03-02 07:21:28 +01:00
Florian Roth f80cf52982 Expired happens too often 
Back then when we created this rule, we noticed that "logon attempt with expired account" happens pretty often, so we decided to not include it. All event codes in this rule did not appear in a 30 day time period and therefore the rule's "level" was set to "high".
 2019-03-02 07:20:59 +01:00
Thomas Patzke 99b15edf8a Sigma tools release 0.9 2019-03-02 00:47:03 +01:00
Thomas Patzke 56a1ed1eac Merge branch 'project-1' 2019-03-02 00:26:10 +01:00
Thomas Patzke 7602309138 Increased indentation to 4 
* Converted (to generic sigma) rules
* Converter outputs by default with indentation 4
 2019-03-02 00:14:20 +01:00
Florian Roth 1aac9baaed Merge pull request #270 from LiamSennitt/master 
fix bug in chafer activity rule #269
 2019-03-01 17:13:04 +01:00
Vasiliy Burov 7bebedbac1 Update win_susp_failed_logon_reasons.yml 
Added descriptions for logon failure statuses and new logon failure status that may indicate suspicious logon.
 2019-03-01 18:18:39 +03:00
Florian Roth af6a1ff26a Extended rule, modified timestamp 2019-03-01 13:36:54 +01:00
Florian Roth f560e83886 Added modified date 2019-03-01 12:07:31 +01:00
Florian Roth fc683ac7ee Added error code for denied logon type 2019-03-01 12:06:54 +01:00
Liam Sennitt 2345cbf7bd fix bug in chafer activity rule #269 2019-03-01 10:23:02 +00:00
Thomas Patzke 690807c846 Sigma tools release 0.8 2019-02-28 09:08:22 +01:00
Thomas Patzke 6bdb4ab78a Merge cleanup 2019-02-27 22:05:27 +01:00
darkquasar 155e273a1c adding rule win-susp-mshta-execution.yml 2019-02-27 15:55:39 +11:00
Florian Roth 8ce4b1530d Rule: added SAM export 2019-02-26 09:00:47 +01:00
Thomas Patzke c922f7d73f Merge branch 'master' into project-1 2019-02-26 00:24:46 +01:00
Thomas Patzke 58a32f35d9 Merge pull request #246 from james0d0a/master 
Added esentutl copy command to sysmon_susp_vssadmin_ntds_activity.yml
 2019-02-24 16:53:49 +01:00
Florian Roth f278a00174 Rule: certutil encode 2019-02-24 14:10:40 +01:00
Florian Roth e7f5cbc22a Rule: BabyShark activity 2019-02-24 14:04:44 +01:00
Florian Roth a60b53a7df fix: bugfix in BEAR activity rule 2019-02-24 14:04:44 +01:00
Florian Roth 8b7f0508a7 Merge pull request #262 from TareqAlKhatib/sysinternals 
Added a detection path through process spawn
 2019-02-24 09:19:00 +01:00
Tareq AlKhatib 7d3d819ea5 Added a detection path through process spawn 2019-02-24 10:29:58 +03:00
Florian Roth bdf0dd8e21 Merge pull request #260 from TareqAlKhatib/malware_backconnect 
Added private IP filter to reduce FPs
 2019-02-23 22:47:14 +01:00
Tareq AlKhatib a022333382 Added private IP filter to reduce FPs 2019-02-23 21:15:03 +03:00
Vasiliy Burov f0c89239d3 Added some unusual paths. 2019-02-23 17:45:08 +03:00
christophetd 1a6faf385c Add HTTP POST alert type to the Elastalert backend 2019-02-23 14:12:14 +01:00
christophetd 3a7160d52b Accept backend options from a configuration file (closes #213) 2019-02-23 13:20:20 +01:00
Florian Roth f25416bd65 chore: workaround Travis Python 3.5 problems 2019-02-23 07:43:41 +01:00
Florian Roth afa18245bf Merge pull request #254 from darkquasar/master 
adding MPreter as McAfee classifies it
 2019-02-23 07:34:04 +01:00
Thomas Patzke c17f9d172f Merge pull request #248 from megan201296/patch-17 
Create win_mal_ursnif.yml
 2019-02-22 21:30:49 +01:00
Thomas Patzke 02239fa288 Changed registry root key 
According to [this](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-12-registryevent-object-create-and-delete) it is abbreviated to HKU.
 2019-02-22 21:30:30 +01:00
Thomas Patzke 18d012cc2e Merge pull request #255 from vburov/patch-1 
Update win_susp_process_creations.yml
 2019-02-22 21:15:52 +01:00
Thomas Patzke 5c63ef17d2 Added further NirSoft tool parameters 2019-02-22 21:15:03 +01:00
vburov bdf44be077 Update win_susp_process_creations.yml 2019-02-22 22:46:57 +03:00
darkquasar 87994ca46b adding MPreter as McAfee classifies it 
McAfee classifies some Meterpreter events with the "Mpreter" keyword
 2019-02-22 15:22:10 +11:00
Florian Roth d3b623e92a Rule: suspicious pipes extended 
https://github.com/Neo23x0/sigma/issues/253
 2019-02-21 13:26:48 +01:00
Florian Roth 343a40ced7 Rule: extended exec location rule to support 4688 events 2019-02-21 13:26:48 +01:00
Florian Roth c8701ac6e9 Merge pull request #252 from keepwatch/patch-1 
Fixing yara condition
 2019-02-21 10:17:09 +01:00
Florian Roth 8ae37f5d64 BEAR activity - CrowdStrike GTR 2019 
https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
 2019-02-21 09:54:01 +01:00
Florian Roth 3a994d0d63 fix: bugfix in Judgement Panda rule 2019-02-21 09:50:49 +01:00
Florian Roth 5935eaa572 fix: added MITRE ATT&CK tags to APT rule 2019-02-21 09:27:59 +01:00
Florian Roth aca470961a fix: bugfix in Judgement Panda rule 2019-02-21 09:20:52 +01:00
Florian Roth c474bfcae5 Judgement Panda - Crowdstrike GTR 2019 
https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
 2019-02-21 09:20:52 +01:00
Keep Watcher 07dec06222 Fixing yara condition 2019-02-20 10:57:24 -05:00
Thomas Patzke 9ef314486e Grep backend escapes + 2019-02-19 14:49:06 +01:00
Florian Roth eeae74e245 Merge pull request #249 from TareqAlKhatib/duplicate_filters 
Duplicate Detections
 2019-02-18 21:58:39 +01:00
Tareq AlKhatib ae62acf3d2 Added a test for duplicate filters and a test for Source: Eventlog 2019-02-18 21:05:58 +03:00
Tareq AlKhatib 2e3a2b9ba6 Merged 'Eventlog Cleared' and 'Eventlog Cleared Experimental' 2019-02-18 21:03:53 +03:00
Florian Roth f0a4aede24 Rule: RDP over Reverse SSH Tunnel 2019-02-16 19:36:13 +01:00
Florian Roth 08e00945aa doc: SANS webcast link in README 2019-02-16 09:51:02 +01:00
megan201296 34f9d17b26 Create win_mal_ursnif.yml 2019-02-13 15:22:57 -06:00
Florian Roth 2e61233e31 Merge pull request #247 from TareqAlKhatib/duplicate_filters 
Unnecessary 1/all of them
 2019-02-13 20:30:53 +01:00
Tareq AlKhatib 97b28f4308 Added a test for unnecessary use of '1 of them' in condition 2019-02-13 21:27:27 +03:00
Tareq AlKhatib cd3cdc9451 Removed unnecessary '1 of them' in condition 2019-02-13 21:26:02 +03:00
Florian Roth 8d819cfeea Rule: fixed bug in Renamed PowerShell rule 2019-02-13 13:23:02 +01:00
Florian Roth 004497075d fix: spark source config bug 2019-02-12 23:27:38 +01:00
Florian Roth c2eda887fa Rule: Suspicious Windows NT 9 UA 2019-02-12 10:33:33 +01:00
james dickenson b16bb4bf9b Added esentutl copy command to sysmon_susp_vssadmin_ntds_activity.yml 2019-02-11 21:10:49 -08:00
Florian Roth be26ada875 Rule: Suspicious csc.exe parents 2019-02-11 13:50:51 +01:00
Florian Roth 74e3c79f40 Rule: Suspicious PowerShell keywords 2019-02-11 13:02:38 +01:00
Thomas Patzke a5af134bfe Merge branch 'neu5ron-patch-2' 2019-02-10 00:16:55 +01:00
Thomas Patzke 01570f88db YAML fixes 2019-02-10 00:16:27 +01:00
Thomas Patzke 6dd4b4775a Merge branch 'patch-2' of https://github.com/neu5ron/sigma into neu5ron-patch-2 2019-02-10 00:15:25 +01:00
Thomas Patzke ff5081f186 Merge branch 'yt0ng-development' 2019-02-10 00:09:29 +01:00
Thomas Patzke 14769938e9 Fixed condition keyword 2019-02-10 00:07:30 +01:00
Thomas Patzke d43e67a882 Merge branch 'development' of https://github.com/yt0ng/sigma into yt0ng-development 2019-02-10 00:00:45 +01:00
Thomas Patzke 3cd6de2864 Merge pull request #240 from neu5ron/master 
new rule and updated false positive note
 2019-02-09 23:57:39 +01:00
Thomas Patzke 01dfc23a26 Merge pull request #234 from juju4/devel-sumo 
Sumologic support update
 2019-02-09 23:54:23 +01:00
Thomas Patzke d9aceeb7eb Merge pull request #228 from keepwatch/ssp-regkey-detection 
SSP added to LSA configuration
 2019-02-09 23:44:55 +01:00
Thomas Patzke 5866d8eb71 Merge pull request #238 from sisecbe/patch-1 
Adapt count function when aggfield not present
 2019-02-09 23:38:20 +01:00
juju4 4429d7564f remove 'escape' of '_' - not needed 2019-02-09 12:57:43 -05:00
juju4 a815b7eb9b add custom cleanValue function for wildcards in keyvalue: OK with lists, NOK with string 2019-02-09 12:57:07 -05:00
Florian Roth aab703a4b4 Suspicious calc.exe usage 2019-02-09 14:03:23 +01:00
Florian Roth 05424883dd Added Info Graphic to README 2019-02-09 09:38:01 +01:00
Florian Roth efb223b147 Merge pull request #245 from kpolley/master 
2nd method to call downloadString or downloadFile in Powershell
 2019-02-09 09:35:19 +01:00
Florian Roth 7e732a2a89 Merge pull request #232 from TareqAlKhatib/duplicate_filters 
Duplicate filters
 2019-02-09 09:23:57 +01:00
Florian Roth d2743351e7 Minor fix: indentation 2019-02-09 09:19:40 +01:00
Kyle Polley c8c06763b4 added keywords & source to sysmon_powershell_download.yml 2019-02-07 18:25:04 -08:00
Nate Guagenti d151deaa29 Rename win_susp_bcdedit to win_susp_bcdedit.yml 2019-02-07 00:21:57 -05:00
Nate Guagenti 91862f284b Create win_susp_bcdedit 
This is a more general rule for possible boot/mbr value edits using bcdedit that I have seen in the wild.
It is different than https://github.com/Neo23x0/sigma/blob/3288f6425b1a868c66f6f0a255956f8f041bc666/rules/windows/malware/win_mal_wannacry.yml
because it is not specific to anyone family (of malware) and also has different CLI options
 2019-02-07 00:19:38 -05:00
Kyle Polley 423fdca32c Merge pull request #1 from Neo23x0/master 
Get updates from head repo
 2019-02-06 17:02:41 -08:00
Florian Roth adb6690c80 Rule: Suspicious GUP.exe usage 2019-02-06 19:21:16 +01:00
Florian Roth f0f0bdae40 Rule: fixed date - wrong year 2019-02-06 19:21:16 +01:00
Florian Roth 7192f149a3 Merge pull request #243 from keepwatch/broadening-suspicious-certutil 
Added '/' prefix, -encode switch, better renamed certutil coverage
 2019-02-06 16:58:27 +01:00
keepwatch e6217928f3 Added '/' prefix, -encode switch, better renamed certutil coverage 2019-02-06 10:45:32 -05:00
Unknown 2f66ba25f0 adjusted MITRE ATTCK tag 2019-02-06 11:27:51 +01:00
Unknown a9731d211d removed my garbage 2019-02-06 11:16:40 +01:00
Unknown 4d048c71bb adjusted spaces 2019-02-06 11:10:42 +01:00
Unknown 54ec01bcdd adjusted space 2019-02-06 11:10:00 +01:00
Unknown a0bac993ed adjusted spaces 2019-02-06 11:07:09 +01:00
t0x1c-1 04f1edd171 added reverted base64 with dosfuscation 2019-02-06 10:59:09 +01:00
Unknown 22b67a67ac Initial Commit Cobalt Malleable for OneDrive 2019-02-06 10:59:02 +01:00
Unknown 353f66dd7c CobaltStrike Malleable OCSP) Profile with Typo (OSCP) in URL 2019-02-06 10:58:48 +01:00
t0x1c-1 150499d151 Detects Executables without FileVersion,Description,Product,Company likely created with py2exe 2019-02-06 10:58:37 +01:00
Unknown c78ac9333c adjusted formatting 2019-02-06 10:54:12 +01:00
t0x1c-1 21f34ab8ba suspicious behaviour 2019-02-06 10:52:41 +01:00
neu5ron 35ebcff543 add new rule 2019-02-05 18:56:24 -05:00
neu5ron 65e4ba5aba added false positive possibility 2019-02-05 18:45:53 -05:00
keepwatch bad80ffa78 Update sysmon_ssp_added_lsa_config.yml 
Syntax fix
 2019-02-05 16:28:06 -05:00
Florian Roth cc8a89b679 Merge pull request #239 from neu5ron/master 
update helk config
 2019-02-05 20:01:28 +01:00
neu5ron 046510f021 updated HELK Destination IP name 2019-02-05 13:11:06 -05:00
sisecbe 5d94b9f0bc Changed stats to eventstats 
Changed 'stats' to 'eventstats' when using aggregation, this keeps the original data of the event in the result.
 2019-02-05 17:36:46 +01:00
Florian Roth 5092b1e603 Rule: removed overlapping strings in Linux rule 2019-02-05 16:12:07 +01:00
Florian Roth 32c098294f Rule: extended suspicious command lines 2019-02-05 15:58:15 +01:00
Florian Roth 8f684ddd06 Rule: FP in WMI persistence with SCCM 2019-02-05 15:57:54 +01:00
sisecbe 2f5eb08b41 Adapt count function when aggfield not present 
When no field is present, use "count" , when field is present use "dc(field)". As described in the Sigma specifications.
Splunk throws errors when using "count()" with empy fields. use "count" instead.
 2019-02-05 15:44:05 +01:00
Florian Roth a276d3083d DHCP log source in sigmac configs 2019-02-05 14:35:23 +01:00
Florian Roth dfd4ce878f Rule: limiting rule to DHCP log 2019-02-05 14:35:23 +01:00
Florian Roth 5b92790e3f Rule: WMI Persistence - FPs 2019-02-05 14:35:23 +01:00
Florian Roth abf5a5088e Rule: more malicious UAs 2019-02-05 14:35:23 +01:00
juju4 98a18fd4a2 add sigma2sumologic.py as test/example script 2019-02-03 12:54:03 -05:00
juju4 7d159fb980 sumologic backend: review with inspiration from arcsight 2019-02-03 12:53:58 -05:00
Thomas Patzke 3ef930b094 Escaped '\*' to '\\*' where required 2019-02-03 00:24:57 +01:00
Thomas Patzke 9c44bb04a7 Added mail address to CI fail notification 2019-02-02 23:52:54 +01:00
Thomas Patzke 9403128aef Merge branch 'master' of https://github.com/Neo23x0/sigma 2019-02-02 23:52:06 +01:00
Thomas Patzke 6215a694a8 Remove escaping from '\\*' in es-dsl backend 2019-02-02 23:51:11 +01:00
Florian Roth 37e13c9f41 Notify me 2019-02-02 08:56:00 +01:00
Thomas Patzke 8a0784ad33 Fixed escaping of \\* 2019-02-02 00:18:58 +01:00
Thomas Patzke 6440bc962b CACTUSTORCH detection 2019-02-01 23:27:53 +01:00
Thomas Patzke 6436cb3ae1 Added missing conditions 2019-02-01 23:02:03 +01:00
Florian Roth 27c2684a0f Rule: Chafer malware proxy pattern 2019-01-31 12:31:48 +01:00
Florian Roth a8d1e7c62b Rule: Fixed ntdsutil rule field in 4688 events 2019-01-29 15:59:39 +01:00
Florian Roth 6c8d08942e Rule: Fixed field in RDP rule 2019-01-29 15:17:29 +01:00
Florian Roth f61b44efa8 Rule: Netsh port forwarding 2019-01-29 14:04:48 +01:00
Florian Roth 086e62a495 Rule: Netsh RDP port forwarding rule 2019-01-29 14:04:28 +01:00
Florian Roth a2eac623a6 Rule: Adjusted RDP login from localhost rule level 2019-01-29 14:04:10 +01:00
Florian Roth c9ec469180 style: cosmetics - removed empty lines at file end 2019-01-29 12:54:07 +01:00
Thomas Patzke 516bfc88ff Added rule: RDP login from localhost 2019-01-28 22:43:22 +01:00
Tareq AlKhatib cd2af196e3 Corrected path to rules 2019-01-25 12:25:51 +03:00
Tareq AlKhatib 96220e776f Added a test to check for duplicate filters in rules 2019-01-25 12:22:28 +03:00
Tareq AlKhatib 7e4bb1d21a Removed duplicate filters 2019-01-25 12:21:57 +03:00
Thomas Patzke 3c7f46a6cd Added rule test to CI testing 2019-01-23 23:31:36 +01:00
Thomas Patzke 9ce7d18712 Merge pull request #231 from TareqAlKhatib/rule_testing_framework 
Rule testing framework
 2019-01-23 23:16:46 +01:00
Tareq AlKhatib ecffe28933 Correct MITRE tag 2019-01-22 21:26:07 +03:00
Tareq AlKhatib e3d61047bb Added two tests. One for MITRE and another for file extension. 2019-01-22 21:25:13 +03:00
Florian Roth 90e8eba530 rule: false positive reduction in PowerShell rules 2019-01-22 16:37:36 +01:00
Florian Roth cc6e0baef1 rule: extended certutil rule to include verifyctl and allows renamed certutil 
https://twitter.com/egre55/status/1087685529016193025
 2019-01-22 16:20:06 +01:00
Florian Roth b1ea976f66 fix: fixed bug inntdsutil rule that included a white space 2019-01-22 16:18:43 +01:00
Florian Roth 8c4b21f063 Rule: Apache threading errors 2019-01-22 08:49:10 +01:00
keepwatch f99df33b01 SSP added to LSA configuration 2019-01-18 14:05:21 -05:00
Thomas Patzke 3eaf83cf5a Improved configurations 
Added Security/4688 field mappings
 2019-01-16 23:37:18 +01:00
Thomas Patzke 96eb460944 Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00
Thomas Patzke ba64f485ac Added generic Windows audit log configuration 2019-01-16 22:41:42 +01:00
Thomas Patzke 4bc4c94a91 sigma2genericsigma: preserve dict order 2019-01-16 22:37:32 +01:00
Florian Roth 5645c75576 Rule: updated relevant AV signatures - exploiting 
https://twitter.com/haroldogden/status/1085556071891173376
 2019-01-16 18:43:28 +01:00
Florian Roth f759e8b07c Rule: Suspicious Program Location Process Starts 2019-01-15 15:40:51 +01:00
Thomas Patzke 7622b17415 Moved test rule to final location/naming scheme 2019-01-14 23:58:25 +01:00
Thomas Patzke 2fd88c837d Added generic sigma rule support to WDATP backend 
* Process creation rules
 2019-01-14 23:54:05 +01:00
Thomas Patzke 4e83bfeb16 Fixed merge bugs 2019-01-14 22:54:26 +01:00
Thomas Patzke a9cf14438c Merge branch 'master' into project-1 2019-01-14 22:36:15 +01:00
Thomas Patzke 8336b47530 Merge branch 'master' of https://github.com/Neo23x0/sigma 2019-01-14 22:12:37 +01:00
Thomas Patzke cc4b806b94 Sigma tools release 0.7.1 2019-01-14 00:26:03 +01:00
Thomas Patzke 5cba0b9946 Merge pull request #223 from m0jtaba/master 
extending the qradar backend to allow for timeframe query
 2019-01-13 23:55:55 +01:00
Thomas Patzke ed1ee80f2d Merge pull request #221 from adrienverge/fix/yamllint 
Fix yamllint config
 2019-01-13 23:55:14 +01:00
Thomas Patzke 7634128143 Generate list of converted file in conversion to generic rules 2019-01-13 23:53:11 +01:00
Thomas Patzke e585858128 Optimization in conversion to generic rules 
* only create necessary output files in directory output mode
* delete empty detections and empty detection sections
* Merge equal documents
* Merge reduced collections into one YAML document in common case
 2019-01-13 23:45:11 +01:00
Florian Roth 9a6b3b5389 Rule: PowerShell script run in AppData folders 2019-01-12 12:03:36 +01:00
Florian Roth 604d88cf1e Rule: WMI Event Subscription 2019-01-12 12:03:36 +01:00
Florian Roth 63f96d58b4 Rule: Renamed PowerShell.exe 2019-01-12 12:03:36 +01:00
Florian Roth b7eb79f8da Rule: UserInitMprLogonScript persistence method 2019-01-12 12:03:36 +01:00
Florian Roth d4a1fe786a Rule: Dridex pattern 2019-01-12 12:03:36 +01:00
Mo Amiri aa37ef2559 extending the qradar backend to allow for timeframe query 2019-01-11 03:33:49 +00:00
Adrien Vergé 44f18db80d Fix YAML errors reported by yamllint 
Especially the config for ArcSight, that was invalid:

    tools/config/arcsight.yml
      89:5      error    duplication of key "product" in mapping  (key-duplicates)
      90:5      error    duplication of key "conditions" in mapping  (key-duplicates)

    rules/windows/builtin/win_susp_commands_recon_activity.yml
      10:9      error    too many spaces after colon  (colons)
 2019-01-10 09:51:39 +01:00
Adrien Vergé b5531be4bf Really run yamllint (it wasn't checking any rule) 
Fix the yamllint config in `.yamllint` to "extend" the default rule.
Previously, it didn't extend anything and only disabled a rule, which
means no rule at all were checked.

Also disable some rules in this file, because they report many errors in
the Sigma code base.

In the future, I suggest fixing these errors and re-enabling standard
rules like `trailing-spaces` or `indentation`.

Fixes #220.
 2019-01-10 09:51:33 +01:00
Thomas Patzke 9f56b9e99b Output all YAML documents if one changed 
Some Sigma rule collections contain YAML documents that reduce to almost
nothing because they only contain EventID definitions. Previous behavior
would filter the part with the remaining selection.
 2019-01-08 23:27:16 +01:00
Thomas Patzke bf9a567afd Fixed issues in converter 2019-01-06 23:57:09 +01:00
Thomas Patzke faeaf1dfef Added first version of generic sigma rules conversion tool 2019-01-06 23:46:23 +01:00
Florian Roth 0c3b0e25a8 Merge pull request #217 from TareqAlKhatib/private_ips 
Corrected class B private IP range to prevent false negatives
 2019-01-04 12:11:25 +01:00
Tareq AlKhatib 8b94860ee6 Corrected class B private IP range to prevent false negatives 2019-01-04 12:50:41 +03:00
Florian Roth ee417dd2ea Merge pull request #216 from TareqAlKhatib/duplicate_outlook 
Removed Outlook detection which is a subset of the Office one
 2019-01-02 22:56:59 +01:00
Tareq AlKhatib 925ffae9b8 Removed Outlook detection which is a subset of the Office one 2019-01-02 07:47:44 +03:00
Florian Roth 55f8993a96 Merge pull request #215 from TareqAlKhatib/ole_vs_rc 
Fixed the RC section to use rc.exe instead of oleview.exe
 2019-01-01 14:01:42 +01:00
Tareq AlKhatib 0a5e79b1e0 Fixed the RC section to use rc.exe instead of oleview.exe 2019-01-01 13:30:26 +03:00
Florian Roth 4e21289bdc Merge pull request #214 from TareqAlKhatib/reference_vs_references 
Corrected reference to references as per Sigma's standard
 2018-12-28 10:55:30 +01:00
Tareq AlKhatib f318f328d6 Corrected reference to references as per Sigma's standard 2018-12-25 16:25:12 +03:00
Thomas Patzke f7e53929fa Added Python 3.7 to CI testing 2018-12-21 14:17:02 +01:00
Thomas Patzke 73b0c3a25b Fixed wildcard issue for es-dsl backend 
Moved field mapping code into mixin shared by es-qs and es-dsl.
 2018-12-21 14:10:45 +01:00
Florian Roth c8c419f205 Rule: Hacktool Rubeus 2018-12-19 09:31:22 +01:00
Thomas Patzke 75c7d65240 Merge pull request #211 from Cyb3rWard0g/master 
Field-Index Mapping File & SIGMA Rules Field names fix
 2018-12-19 00:38:06 +01:00
Thomas Patzke ffd43823cf Fixed wildcard issue in es-qs backend and depending 
See GitHub issue #194. Fix for es-dsl is pending.
 2018-12-19 00:33:12 +01:00
Florian Roth a7fa20546a Rule: proxy user agents updated with MacControl user agent 2018-12-17 14:18:03 +01:00
Florian Roth 99f773dcf6 Rule: false positive reduction in rule 2018-12-17 10:02:55 +01:00
Florian Roth 172236e130 Rule: updated ATT&CK tags in MavInject rule 2018-12-12 09:17:58 +01:00
Florian Roth 188d3a83b8 Rule: docs: reference update in MavInject rule 2018-12-12 08:37:00 +01:00
Florian Roth 6206692bce Merge pull request #212 from Neo23x0/commandline-issue 
Bugfix: wrong field for 4688 process creation events
 2018-12-12 08:24:07 +01:00
Florian Roth 49eb03cda8 Rule: MavInject process injection 2018-12-12 08:18:43 +01:00
Florian Roth b0cb0abc01 Bugfix: wrong field for 4688 process creation events 2018-12-11 16:10:15 +01:00
Florian Roth b5d78835b6 Removed overlapping rule with sysmon_office_shell.yml 2018-12-11 13:37:47 +01:00
Roberto Rodriguez a0486edeea Field-Index Mapping File & SIGMA Rules Field names fix 
+ Updated HELK field-index mapping file
+ After going through all the fields with 'fieldlist' output, I found a few rules that fixed.
 2018-12-11 09:27:26 +03:00
Thomas Patzke 68866433e8 Merge branch 'juju4-devel-sumo' 2018-12-10 22:37:58 +01:00
Thomas Patzke 4175d0cdd5 Fixed config and added index field 
* Added index field _index to backend implementation
* Fixed index values in config
 2018-12-10 22:37:39 +01:00
Thomas Patzke b520897176 Added CI testing for SumoLogic backend 2018-12-10 22:36:08 +01:00
Thomas Patzke 4e3f6c366b Merge pull request #208 from Cyb3rWard0g/master 
Elastalert-HELK integration Updates
 2018-12-10 22:13:37 +01:00
Roberto Rodriguez 93d1d700d4 Merge remote-tracking branch 'upstream/master' 2018-12-10 07:04:30 +03:00
juju4 1f707cb37c Adding Sumologic backend 2018-12-09 17:55:51 -05:00
Thomas Patzke 2091c90538 Fixed ElastAlert *_key options 
* Always use .keyword field instead of analyzed one
* Fixed 'null' value if group field was not set
 2018-12-09 22:33:23 +01:00
Roberto Rodriguez 9567ce588d Merge remote-tracking branch 'upstream/master' 2018-12-09 09:27:43 +03:00
Roberto Rodriguez 8c577a329f Improve Rule & Updated HELK SIGMA Standardization Config 
Rule should be focusing on the 'process_command_line' field and not just on any value of any event generated by powershell.exe.

SIGMA HELK standardization config updated to match latest HELK Common Information Model
 2018-12-08 11:30:21 +03:00
Roberto Rodriguez a35f945c71 Update win_disable_event_logging.yml 
Description value breaking SIGMA Elastalert Backend
 2018-12-06 05:09:41 +03:00
Florian Roth 2e5a739c6c fix: fixed author string (cannot be list according to sigma specs) 2018-12-05 11:59:10 +01:00
Florian Roth 9b15b64a9a fix: fixed author string (cannot be list according to sigma specs) 2018-12-05 11:44:20 +01:00
Thomas Patzke abc941b57c Merge pull request #204 from Cyb3rWard0g/master 
Elastalert Integration Updates to SIGMA Rules
 2018-12-05 09:33:40 +01:00
Thomas Patzke 246ad7c59a Revert "Fixed wildcards in es-qs backend" 
This reverts commit 49d464f979.

The partial fix for issue #194 broke the generation of many other rules,
see #203.
 2018-12-05 09:07:07 +01:00
Roberto Rodriguez 87ce07088f Update sysmon_plugx_susp_exe_locations.yml 
Duplicate rule title: https://github.com/Neo23x0/sigma/search?q=Executable+used+by+PlugX+in+Uncommon+Location&unscoped_q=Executable+used+by+PlugX+in+Uncommon+Location

This impats Elastalert integration since you cannot have two rules with the same name
 2018-12-05 07:58:13 +03:00
Roberto Rodriguez bff7ec52db Update av_relevant_files.yml 
Duplicate rule title: https://github.com/Neo23x0/sigma/search?q=Antivirus+Exploitation+Framework+Detection&unscoped_q=Antivirus+Exploitation+Framework+Detection

This affetcs Elastalert integration
 2018-12-05 07:53:53 +03:00
Roberto Rodriguez 104ee6c33b Update win_susp_commands_recon_activity.yml 
Rule missing "by CommandLine" which marchs the query_key value of the elastalert format to NULL.
 2018-12-05 05:55:36 +03:00
Roberto Rodriguez 328762ed67 Update powershell_xor_commandline.yml 
Ducplicate names again for https://github.com/Neo23x0/sigma/search?q=Suspicious+Encoded+PowerShell+Command+Line&unscoped_q=Suspicious+Encoded+PowerShell+Command+Line . This brakes elastalert integration since each rule needs to have its own unique name.
 2018-12-05 05:51:41 +03:00
Roberto Rodriguez 6dc36c8749 Update win_eventlog_cleared.yml 
Experimental Rule is a duplicate of https://github.com/Neo23x0/sigma/blob/bfc7012043317632265a897c8a4901f266cda992/rules/windows/builtin/win_susp_eventlog_cleared.yml. I renamed it experimental just in case. I believe one of them should be removed. I caught it while transforming every rule to elastalert format
 2018-12-05 05:40:00 +03:00
Roberto Rodriguez c8990962d2 Update win_rare_service_installs.yml 
same count() by ServiceFileName < 5 aded to make sigmac work with elastalert integration
 2018-12-05 05:33:56 +03:00
Roberto Rodriguez f0b23af10d Update win_rare_schtasks_creations.yml 
Count(taskName) not being taken by elastalert integration with Sigmac
 2018-12-05 05:10:08 +03:00
Thomas Patzke f9d9d653dc Merge pull request #199 from sisecbe/patch-1 
Distinct count in aggragation function
 2018-12-04 23:42:16 +01:00
Thomas Patzke 3288f6425b Merge branch 'SherifEldeeb-master' 2018-12-04 23:38:02 +01:00
Thomas Patzke 900db72557 Merge branch 'master' of https://github.com/SherifEldeeb/sigma into SherifEldeeb-master 2018-12-04 23:35:23 +01:00
Florian Roth 3861dd5912 Rule: APT29 campaign against US think tanks 
https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/
 2018-12-04 17:04:03 +01:00
Florian Roth 2bf0170956 Merge pull request #202 from tuckner/master 
Fixed backslash escape
 2018-12-03 22:22:53 +01:00
tuckner 2c5c92ab0a fixed backslash escape 2018-12-03 15:09:29 -06:00
Florian Roth a805d18bba Merge pull request #198 from kpolley/consistent_filetype 
changed .yaml files to .yml for consistency
 2018-12-03 09:00:14 +01:00
Florian Roth 7e05b2546a Merge pull request #201 from 41thexplorer/master 
Adding new rules detecting recently active APTs
 2018-12-03 08:59:46 +01:00
AL 9f1df6164b adding new rules detecting recently active APTs 2018-12-03 09:42:29 +02:00
Florian Roth 2ebbdebe46 rule: Cobalt Strike beacon detection via Remote Threat Creation 
https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f
 2018-11-30 10:25:05 +01:00
Thomas Patzke e502550d76 Merge branch 'lsoumille-master' 2018-11-29 00:03:12 +01:00
Thomas Patzke f6ad36f530 Fixed rule 2018-11-29 00:00:18 +01:00
Thomas Patzke 1118b80288 Added elastalert backend to CI testing 2018-11-29 00:00:00 +01:00
Thomas Patzke 0a5caae5df Merge branch 'master' of https://github.com/lsoumille/sigma into lsoumille-master 2018-11-28 23:53:15 +01:00
Florian Roth 99e0a4defb fix: SPARK config duplicate identifier 2018-11-27 14:05:13 +01:00
lsoumille 50c74b94bc add elastalert backend support 2018-11-23 20:39:15 +01:00
sisecbe c848c473a3 Error when empty fields attribute 2018-11-23 15:37:42 +01:00
sisecbe 31eae25756 Indentation error 2018-11-23 15:20:17 +01:00
sisecbe e43909678e Added the fields attribute parser 
Make a table with the fields present in the fields attribute
 2018-11-23 15:11:12 +01:00
sisecbe c2eb87133d Distinct count in aggragation function 
Added dc() instead of count() when group-by field is present. Because count() doesn't do a distinct count in Splunk. Must be the dc() function instead.
 2018-11-23 15:04:08 +01:00
Florian Roth 7ba1fe4309 Turla PNG Dropper Service Name 2018-11-23 08:46:20 +01:00
Florian Roth e7762c71ce Merge remote-tracking branch 'origin/master' 2018-11-22 19:14:12 +01:00
Florian Roth ec83ab5e13 APT28 Zebrocy rule 
https://app.any.run/tasks/54acca9a-394e-4384-a0c8-91a96d36c81d
 2018-11-22 19:14:07 +01:00
Thomas Patzke aa1a953a65 Moved node dumping code to generic location 2018-11-21 23:22:38 +01:00
Thomas Patzke 26d888aec3 Removed "not null" handling code 
Feature was removed some time ago.
 2018-11-21 22:56:48 +01:00
Thomas Patzke a1940c6eaa Simplified rule 2018-11-21 22:34:04 +01:00
Thomas Patzke 9e28669c33 Backend es-qs return quotes on empty or whitespace-only string 2018-11-21 22:29:12 +01:00
Kyle Polley 60538e2e12 changed .yaml files to .yml for consistency 2018-11-20 21:07:36 -08:00
Thomas Patzke 49d464f979 Fixed wildcards in es-qs backend 2018-11-20 23:23:54 +01:00
Florian Roth a31acd6571 fix: fixed procdump rule 2018-11-17 09:10:26 +01:00
Florian Roth fd06cde641 Rule: Detect base64 encoded PowerShell shellcode 
https://twitter.com/cyb3rops/status/1063072865992523776
 2018-11-17 09:10:09 +01:00
Sherif Eldeeb 23eddafb39 Replace "logsource: description" with "definition" to match the specs 2018-11-15 09:00:06 +03:00
Sherif Eldeeb cd5950749e revert to upstream 2018-11-15 08:45:25 +03:00
Sherif Eldeeb 742192b452 Merge pull request #4 from Neo23x0/master 
fetch updates from upstream
 2018-11-15 08:32:33 +03:00
Florian Roth b92c032c2d Linux JexBoss back connect shell 2018-11-08 23:21:36 +01:00
Florian Roth fc7a750f0f Added RSA NetWitness to the supported targets 2018-11-07 22:56:51 +01:00
Thomas Patzke 102b56dfe3 Merge branch 'tuckner-master' 2018-11-07 22:53:15 +01:00
Thomas Patzke 396a030ed1 Removed duplicate code 2018-11-07 22:52:12 +01:00
Thomas Patzke 6b8ddd6ac0 Added CI test for NetWitness backend 2018-11-07 22:36:34 +01:00
Thomas Patzke 116a0e9f03 Merge branch 'master' of https://github.com/tuckner/sigma into tuckner-master 2018-11-07 22:27:41 +01:00
Thomas Patzke fe79be894b Merge branch 'master' of https://github.com/Neo23x0/sigma 2018-11-07 14:01:21 +01:00
Thomas Patzke 5053cc4e95 Fixed optimizing of not conditions with subexpressions 
Optimization pass traversal is cut at ConditionNOT nodes.
 2018-11-07 13:54:45 +01:00
Thomas Patzke a88b1e81ec Optimizer debugging code cleanup 
* Removed commented debugging code
* Output to stdin
* Coverage exception for _dumpNode
 2018-11-07 13:49:08 +01:00
Florian Roth 0ee515db47 Merge pull request #192 from neu5ron/patch-2 
Update win_alert_ad_user_backdoors.yml
 2018-11-07 08:34:16 +01:00
Nate Guagenti 9bfdcba400 Update win_alert_ad_user_backdoors.yml 
add another detection rule for delegation via the attack described in harmj0y's blog:
https://www.harmj0y.net/blog/redteaming/another-word-on-delegation/
 2018-11-05 21:08:19 -05:00
Thomas Patzke 42ed8acec9 Improved test coverage 
* Adding tests
* Removal of coverage measurement for debugging code
 2018-11-04 23:28:40 +01:00
Thomas Patzke 418f8d10a3 Wrap conditions generated by mappings into sub-expression 2018-11-04 23:00:04 +01:00
Thomas Patzke 0e4842962b Added tests 2018-11-04 22:16:20 +01:00
tuckner bd5b823725 Removed specific NetWintess config from test 2018-10-31 14:32:13 -05:00
tuckner ca6ba4a85b Added NetWitness backend and tests 2018-10-31 14:24:14 -05:00
tuckner 26f73d60fa Added NetWitness backend and tests 2018-10-31 14:07:59 -05:00
Florian Roth 37294d023f Suspicious svchost.exe executions 2018-10-30 09:37:40 +01:00
Florian Roth 580692aab4 Improved procdump on lsass rule 2018-10-30 09:37:40 +01:00
Thomas Patzke eacfaa7460 Check for forbidden null values in list items in Splunk backend 2018-10-27 01:07:03 +02:00
Thomas Patzke 423a73efd5 Dropped .py suffix 2018-10-22 23:02:05 +02:00
Thomas Patzke 1b1f22c5c2 Added sigma2misp to README 2018-10-22 23:02:05 +02:00
Thomas Patzke b2d6d73034 Added requirements 2018-10-22 22:43:59 +02:00
Thomas Patzke 16e3838a90 Renamed script 2018-10-19 21:23:33 +02:00
Thomas Patzke 6b14930302 Recursive path traversal 2018-10-19 21:21:33 +02:00
Thomas Patzke 67b416379f Improved import of multiple rules 2018-10-19 19:53:00 +02:00
Thomas Patzke 60b6f5d50a Merge branch 'samsson-patch-9' 2018-10-18 16:21:11 +02:00
Thomas Patzke ff98991c80 Fixed rule 2018-10-18 16:20:51 +02:00
Thomas Patzke a2da73053d Merge branch 'patch-9' of https://github.com/samsson/sigma into samsson-patch-9 2018-10-18 16:16:57 +02:00
Thomas Patzke 96d6d520b7 Merge branch 'pivotforensics-master' 2018-10-18 16:14:53 +02:00
Thomas Patzke 0fd8b986fd Added CI tests 2018-10-18 16:14:16 +02:00
Thomas Patzke 0cc8b77307 Merge branch 'master' of https://github.com/pivotforensics/sigma into pivotforensics-master 2018-10-18 15:56:26 +02:00
Thomas Patzke 732de3458f Merge pull request #186 from megan201296/patch-15 
Update sysmon_cmstp_com_object_access.yml
 2018-10-18 15:49:06 +02:00
Thomas Patzke fdd0823e07 Merge pull request #187 from megan201296/patch-16 
Additional MITRE ATT&CK Tagging
 2018-10-18 15:38:11 +02:00
Thomas Patzke 60765d903a Merge branch 'ntim-master' 2018-10-18 15:34:34 +02:00
Thomas Patzke 5609728a8a included XPack Watcher JSON output in CI tests 2018-10-18 14:56:21 +02:00
ntim e501c4a5b9 Added additional output type 'json' to the xpack-watcher backend which prints each watcher as compress json, one watcher per line 2018-10-17 10:38:56 +02:00
Thomas Patzke 44ff9d154e Increased test coverage for mapping corner cases 2018-10-16 14:53:12 +02:00
Thomas Patzke 265ce115a0 Fixed conditional field mapping usage in mapping chains 2018-10-16 13:57:51 +02:00
Thomas Patzke a61b3d352a Added test cases 
* Generic log sources
* Splunk index queries
 2018-10-15 15:24:18 +02:00
Michael H 5b33713ef8 Quick fix for string formatting bug 2018-10-13 20:21:37 -05:00
Michael H 38ec257f7e Re-doing LogName formatting 2018-10-13 20:18:57 -05:00
Michael H 9f48265eb1 Adding re.sub for LogName that accounts for expression grouping 2018-10-13 20:09:54 -05:00
Michael H 7e184f01c6 Removing invalid fieldmapping 2018-10-13 19:53:39 -05:00
Michael H ab2ebae6b0 Merge branch 'master' of https://github.com/Neo23x0/sigma 2018-10-13 19:41:18 -05:00
Florian Roth 3c3b14a26b rule: new malware UA 2018-10-10 15:27:58 +02:00
Florian Roth fd34437575 fix: fixed date in rule 2018-10-10 15:27:58 +02:00
megan201296 fdd264d946 Update sysmon_susp_powershell_rundll32.yml 2018-10-09 19:11:47 -05:00
megan201296 440b0ddffe Update sysmon_susp_powershell_parent_combo.yml 2018-10-09 19:11:17 -05:00
megan201296 b0983047eb Update sysmon_powersploit_schtasks.yml 2018-10-09 19:10:37 -05:00
megan201296 2f533c54b3 Update sysmon_powershell_network_connection.yml 2018-10-09 19:10:17 -05:00
megan201296 1b92a158b5 Add MITRE ATT&CK Tagging 2018-10-09 19:09:19 -05:00
megan201296 ffbb968fcd Update sysmon_cmstp_com_object_access.yml 
Edit tule logic for `and` instead of `or
 2018-10-09 19:03:30 -05:00
Florian Roth 182781229c Merge pull request #184 from megan201296/patch-14 
Remove duplicate value
 2018-10-09 09:37:54 +02:00
megan201296 7997cb3001 Remove duplicate value 2018-10-08 13:00:59 -05:00
Michael H bbb67fbba4 Adding support for reading sigma rule from stdin in sigmac 2018-10-07 10:11:47 -05:00
Michael H aabaa0257b Merge branch 'master' of https://github.com/Neo23x0/sigma 2018-10-06 20:12:15 -05:00
Michael H 4b85a34b34 Added CSV option to powershell backend 2018-10-06 20:08:20 -05:00
Thomas Patzke e28bc35cad Apply field mappings in generation of log source condition 2018-10-06 23:38:35 +02:00
Florian Roth 54678fcb36 Rule: CertUtil UA 
https://twitter.com/ItsReallyNick/status/1047151134501216258
 2018-10-06 16:47:37 +02:00
Thomas Patzke 4eeb07a736 Merge pull request #181 from droe/optimizer-comments 
Improve the comments on the optimizer
 2018-10-03 23:11:10 +02:00
Daniel Roethlisberger fc45df144c Improve the comments on the optimizer 2018-10-03 13:44:03 +02:00
Thomas Patzke 143f8644c6 Merge pull request #180 from droe/refactor-optimizer 
Move optimizer to sigma.parser.condition to enable it for all backends
 2018-10-03 00:34:14 +02:00
Daniel Roethlisberger 87aa1b5521 Move optimizer to sigma.parser.condition to enable it for all backends 2018-10-03 00:24:31 +02:00
Thomas Patzke 2ac19d32a1 Merge pull request #178 from droe/ast_optimizer 
Optimize the boolean expressions in the AST before generating output
 2018-10-02 23:06:55 +02:00
Daniel Roethlisberger cd3661b60c Fix optimization of NOT corner cases 2018-10-02 22:48:33 +02:00
Thomas Patzke 14c5dcf413 Merge pull request #179 from droe/tempfile-mktemp 
Use mktemp if tempfile is not available, fixes `make` for macOS
 2018-10-02 22:44:48 +02:00
Daniel Roethlisberger 85ad10d558 Use mktemp if tempfile is not available, fixes make for macOS 2018-10-02 22:17:03 +02:00
Daniel Roethlisberger bed88cf813 Make uniq work for lists within definitions 2018-10-02 22:12:54 +02:00
Daniel Roethlisberger 7165128fa5 Remove None from AST - fixes None-related test failures 2018-10-02 21:44:37 +02:00
Daniel Roethlisberger 2242fc5ac8 Optimize the boolean expressions in the AST before generating output 
Add code optimizing the boolean expressions in the abstract syntax tree
before generating output using the backend.

The main idea behind optimizing the AST is that less repeated terms is
generally better for backend performance.  This is especially relevant
to backends that do not perform any query language optimization down
the road, such as those that generate code.

The following optimizations are currently performed:

-   Removal of empty OR(), AND()
-   OR(X), AND(X)                 =>  X
-   OR(X, X, ...), AND(X, X, ...) =>  OR(X, ...), AND(X, ...)
-   OR(X, OR(Y))                  =>  OR(X, Y)
-   OR(AND(X, ...), AND(X, ...))  =>  AND(X, OR(AND(...), AND(...)))
-   NOT(NOT(X))                   =>  X

A common example for when these suboptimal rules actually occur in
practice is when a rule has multiple alternative detections that are
OR'ed together in the condition, and all of the detections include a
common element, such as the same EventID.

This implementation is not optimized for performance and will perform
poorly on very large expressions.
 2018-10-02 21:14:25 +02:00
Florian Roth 85f0ddd188 Delete win_alert_LSASS_access.yml 2018-10-02 16:48:09 +02:00
Florian Roth 19e2bad96e Delete sysmon_powershell_DLL_execution.yml 2018-10-02 08:56:09 +02:00
Florian Roth daddec9217 Delete sysmon_powershell_AMSI_bypass.yml 2018-10-02 08:55:48 +02:00
Florian Roth aafe9c6dae Delete sysmon_lethalHTA.yml 2018-10-02 08:55:19 +02:00
Florian Roth f29ffc0697 Merge pull request #174 from esebese/patch-1 
sysmon_susp_run_key_img_folder.yml - Rule simplification
 2018-10-01 14:24:54 +02:00
Florian Roth bbddcd0f9a Merge pull request #176 from Karneades/fix-missing-list-handling 
Add missing event id list handling in PowerShell backend
 2018-10-01 14:23:48 +02:00
Karneades 468af42de5 Add missing event id list handling in PowerShell backend 2018-09-29 14:43:28 +02:00
Florian Roth f2d83a5a00 Merge pull request #175 from Karneades/fix-powershell-backend 
Improve default field handling in PowerShell backend
 2018-09-29 14:08:30 +02:00
Karneades c289484c5c Improve default field handling in PowerShell backend 2018-09-29 12:29:44 +02:00
Ensar Şamil dec7568d4c Rule simplification 
Two selection fields are reduced to one. HKCU and HKLM registry value changes are considered, thus wildcards are added. No change at details.
 2018-09-28 10:58:50 +03:00
Florian Roth 1c2431f33b Merge pull request #169 from Karneades/fix-aggregation-exeption 
Add rule filename to "not implemented" exception output
 2018-09-26 11:50:25 +02:00
Florian Roth 451c18628d Merge pull request #170 from Karneades/fix-suspicious-cli 
Add group by to windows multiple suspicious cli rule
 2018-09-26 11:49:57 +02:00
Florian Roth 38d17e5169 Merge pull request #173 from b2az/patch-1 
Missing Character
 2018-09-26 11:49:17 +02:00
Florian Roth a2c6f344ba Lower case T 2018-09-26 11:44:12 +02:00
Braz f35308a4d3 Missing Character 
Parsed the MITRE ATT&CK informations from the rules. My script crashed because the identifier "T" was missing.
Thanks for your work Flo & Tom!
 2018-09-26 11:40:24 +02:00
Florian Roth 815236449b Added PowerShell as target, updated project list 2018-09-24 13:44:14 +02:00
Florian Roth d0a527af5e Merge pull request #172 from Karneades/powershell-backend 
Add initial version of the PowerShell backend
 2018-09-24 13:30:24 +02:00
Florian Roth 14337a2aac Tests: PowerShell backend tests 2018-09-24 13:23:38 +02:00
Florian Roth 2766d8f881 Merge pull request #171 from Karneades/fix-certutil 
Fix CommandLine in rule sysmon_susp_certutil_command
 2018-09-24 07:51:07 +02:00
Karneades c66b00356d Add initial version of PowerShell backend 
* Add PowerShell backend
* Add PowerShell config file

State: Work in progress :)

See https://github.com/Neo23x0/sigma/issues/94
 2018-09-23 21:41:48 +02:00
Florian Roth edf8dde958 Include cases in which certutil.exe is used 2018-09-23 20:57:34 +02:00
Karneades c73a9e4164 Fix CommandLine in rule sysmon/sysmon_susp_certutil_command 
Below is an example of a test - the command line does not
include the path nor the .exe. I think this comes from the
initial detection on the Image path and the later switch to
command line.

We could also use both the Image path and the Command Line.

Message     : Process Create:
              Image: C:\Windows\SysWOW64\certutil.exe
              CommandLine: certutil  xx -decode xxx
              Hashes: SHA1=8186D64DD28CD63CA883B1D3CE5F07AEABAD67C0
              ParentImage: C:\Windows\System32\cmd.exe
              ParentCommandLine: "C:\Windows\system32\cmd.exe"
 2018-09-23 20:28:56 +02:00
Karneades cc82207882 Add group by to win multiple suspicious cli rule 
* For the detection it's important that these cli
  tools are started on the same machine for alerting.
 2018-09-23 19:38:23 +02:00
Karneades fe6f4c7475 Add rule filename to exception output for unsupported aggregation 2018-09-23 19:12:50 +02:00
Thomas Patzke 81515b530c ATT&CK tagging QA 2018-09-20 12:44:44 +02:00
Thomas Patzke 1d12fc290c Added Winlogbeat configuration 2018-09-20 12:08:11 +02:00
Thomas Patzke 2fbf17ff34 Addition and resolution of field mapping chains explicitely checks for list 2018-09-13 16:22:29 +02:00
Thomas Patzke 41a8ef2fd9 Implemented resolve_fieldname in FieldMappingChain 2018-09-13 14:56:31 +02:00
Thomas Patzke 2330306db1 Added merged field mapping and log sources dict to config chain 2018-09-13 14:55:05 +02:00
Thomas Patzke ba76f04fe6 Merging of raw configurations in configuration chains 2018-09-13 13:49:36 +02:00
Thomas Patzke d81946df39 Stacked configurations 
- Added log source rewriting
- Removed log source merging condition type setting
- Simplified SigmaLogsourceConfiguration constructor
- Condition is generated in SigmaParser instead of SigmaLogsourceConfiguration

Missing:
- Merging of raw config dict for backends that rely on this (es-dsl)
 2018-09-12 23:40:22 +02:00
Thomas Patzke 210f7ac044 Rewrote logsource definition merging to set generator 2018-09-12 22:29:51 +02:00
Florian Roth 13276ecf31 Rule: AV alerts - webshells 2018-09-09 11:04:27 +02:00
Florian Roth e5c7dd18de Rule: AV alerts - relevant files 2018-09-09 11:04:27 +02:00
Florian Roth 7311d727ba Rule: AV alerts - password dumper 2018-09-09 11:04:27 +02:00
Florian Roth 84b8eb5154 Rule: AV alerts - exploiting frameworks 2018-09-09 11:04:27 +02:00
Florian Roth 82916f0cff Merge pull request #159 from t0x1c-1/t0x1c-devel 
Suspicious SYSVOL Domain Group Policy Access
 2018-09-08 15:56:54 +02:00
Florian Roth 1294af4a71 Merge pull request #166 from yt0ng/master 
Malleable Amazon Profile
 2018-09-08 15:56:22 +02:00
yt0ng 48254f7a7e Merge pull request #1 from yt0ng/apt/rules 
Malleable Amazon Profile
 2018-09-08 11:54:29 +02:00
Florian Roth 6f5a73b2e2 style: renamed rule files to all lower case 2018-09-08 10:27:19 +02:00
Florian Roth 68896d9294 style: renamed rule files to all lower case 2018-09-08 10:25:20 +02:00
Florian Roth 788678feb8 Merge pull request #165 from JohnLaTwC/patch-1 
Create win_susp_powershell_hidden_b64_cmd.yml
 2018-09-08 10:23:05 +02:00
Florian Roth 5d714ab44e Rule: Added malware UA 2018-09-08 10:22:26 +02:00
Florian Roth d0f2fbb6d6 Merge pull request #161 from megan201296/patch-12 
Fix typo
 2018-09-08 10:21:20 +02:00
Florian Roth 3f444b5fc2 Merge pull request #162 from megan201296/patch-13 
Added .yml extension and fix typo
 2018-09-08 10:21:00 +02:00
Florian Roth 69e65c0bdc Merge pull request #164 from yt0ng/apt/rules 
Adding CMStar user-agent "O/9.27 (W; U; Z)"
 2018-09-08 10:19:41 +02:00
Unknown 7a74e86819 Merge remote-tracking branch 'origin/apt/rules' into apt/rules 2018-09-08 09:35:57 +02:00
Unknown 863736587c Adding ATTCK 2018-09-08 09:34:27 +02:00
Unknown 4bb01a8c24 ATTCK Tags 2018-09-08 09:29:54 +02:00
John Lambert 7ce5b3515b Create win_susp_powershell_hidden_b64_cmd.yml 
Look in process creation events for powershell commands with base64 encoded content containing suspicious keywords. Require hidden flag to reduce FP.
 2018-09-07 20:23:11 -07:00
Unknown d866097c07 CobaltStrike Malleable Amazon browsing traffic profile 2018-09-07 19:52:35 +02:00
Unknown cf48a77d5a Adding CMStar user-agent "O/9.27 (W; U; Z)" 2018-09-07 09:07:24 +02:00
megan201296 3154be82f3 Added .yml extension and fix typo 2018-09-06 20:28:22 -05:00
megan201296 525326d15f Fix typo 2018-09-06 20:20:11 -05:00
Thomas Patzke 13e41f29d6 Added CI test for tag filtering 2018-09-06 01:05:31 +02:00
Thomas Patzke f3c60a6309 Added tag filtering to sigmac 2018-09-06 00:57:54 +02:00
Thomas Patzke 7f875af1ca Fixed WDATP backend 
It never generated any output due to missing return in generate()
method.
 2018-09-06 00:31:40 +02:00
Florian Roth ec1bd77f2e Rule: Proxy UA rule update - from Kaspersky report 
https://securelist.com/attacks-on-industrial-enterprises-using-rms-and-teamviewer/87104/
 2018-09-05 20:39:19 +02:00
Lurkkeli 30fc4bd030 powershell xor commandline 
New rule to detect -bxor usage in a powershell commandline.
 2018-09-05 09:21:15 +02:00
Florian Roth 49f7da6412 style: changed title casing and minor fixes 2018-09-04 16:15:41 +02:00
Florian Roth 3c240be8a8 fix: more duplicate 'tag' keys in rules 2018-09-04 16:15:02 +02:00
Florian Roth 9c878bef79 fix: duplicate 'tag' key in rule 2018-09-04 16:05:21 +02:00
t0x1c-1 afadda8c04 Suspicious SYSVOL Domain Group Policy Access 2018-09-04 15:52:25 +02:00
Florian Roth d94c1d2046 fix: duplicate 'tag' key in rule 2018-09-04 14:56:55 +02:00
Florian Roth 1c87f77223 Rule: Fixed false positive in suspicious UA rule 2018-09-04 11:33:05 +02:00
Florian Roth 9cb78558d3 Rule: excluded false positives in rule 2018-09-03 12:02:42 +02:00
Florian Roth b57f3ded64 Rule: GRR false positives 2018-09-03 11:50:34 +02:00
Florian Roth 2a0fcf6bea Rule: PowerShell encoded command JAB 2018-09-03 10:08:29 +02:00
Florian Roth 7a3890ad76 Rule: SysInternals EULA accept improved and renamed 2018-08-30 13:16:28 +02:00
Florian Roth d83f124f5f Rule: Suspicious communication endpoints 2018-08-30 10:12:12 +02:00
Florian Roth e70395744b Rule: Improved Github communication rule 2018-08-30 10:12:12 +02:00
Thomas Patzke d17cc5c07d Merge pull request #157 from yt0ng/development 
Added Detection of Sysinternals Tools via eulaaccepted registry key
 2018-08-28 22:37:00 +02:00
Unknown 75d72344ca Added Detection of Sysinternals Tools via eulaaccepted registry key 2018-08-28 17:36:22 +02:00
Thomas Patzke a722fcd2b0 Merge pull request #156 from yt0ng/yt0ng-devel 
Adding LSASS Access Detected via Attack Surface Reduction
 2018-08-27 23:50:42 +02:00
Thomas Patzke ee15b451b4 Fixed log source name 2018-08-27 23:45:30 +02:00
Thomas Patzke f2fd3b9443 Merge branch 'master' of https://github.com/Neo23x0/sigma 2018-08-27 23:41:41 +02:00
Thomas Patzke 6e7208553a Revert "removing for new pull request" 
This reverts commit ca7e8d6468.
 2018-08-27 23:39:29 +02:00
Unknown 2f256aa1ef Adding LSASS Access Detected via Attack Surface Reduction 2018-08-27 10:38:45 +02:00
Thomas Patzke 1d7722c1cb Added configuration and field mapping chains 
Missing: field name mapping of log source conditions.
 2018-08-27 00:17:27 +02:00
Thomas Patzke 8308cd6c1a Rule fix 2018-08-26 22:35:35 +02:00
Thomas Patzke 87e39b8768 Fixed rules 2018-08-26 22:30:47 +02:00
Thomas Patzke 60a5922582 Merge branch 'master' of https://github.com/yt0ng/sigma into yt0ng-master 2018-08-26 22:12:19 +02:00
Florian Roth 5b3175d1d6 Rule: Suspicious procdump use on lsass process 2018-08-26 19:53:57 +02:00
yt0ng df9f6688eb Added Deskop Location, RunOnce and ATTCK 
Added C:\Users\tst01\Desktop\unprotected.vbs as seen by FIN7
 2018-08-25 17:32:34 +02:00
yt0ng eda6f3b9ca rules/windows/sysmon/sysmon_powershell_DLL_execution.yml 2018-08-25 16:33:54 +02:00
Florian Roth 6bde2cd08f Update lnx_buffer_overflows.yml 2018-08-25 00:20:34 +02:00
Florian Roth 234a48af19 rule: Linux SSHD exploit CVE-2018-15473 
https://github.com/Rhynorater/CVE-2018-15473-Exploit
 2018-08-24 16:40:41 +02:00
yt0ng c7d4b4853d removing sysmon_powershell_AMSI_bypass.yml 2018-08-23 10:17:19 +02:00
Florian Roth f47a5c2206 fix: Author list to string 2018-08-23 09:40:28 +02:00
Thomas Patzke 49af499353 Merge pull request #151 from nikseetharaman/workflow_compiler 
Add Microsoft Workflow Compiler Sysmon Detection
 2018-08-23 08:24:35 +02:00
Thomas Patzke 9235175e26 Fixed rule 
* Added condition
* Replaced Description wirh Image attribute and improved search pattern
 2018-08-23 08:20:28 +02:00
Thomas Patzke 96cedc31f9 Merge pull request #152 from james0d0a/master 
Qradar backend: added aggregation and AQL database flow support
 2018-08-23 08:14:56 +02:00
Thomas Patzke 73535e58a5 Merge pull request #153 from megan201296/patch-10 
Add ATT&CK Matrix tags
 2018-08-23 08:06:58 +02:00
Thomas Patzke d647a7de07 Merge pull request #154 from megan201296/patch-11 
Add MITRE ATT&CK tagging
 2018-08-23 08:06:39 +02:00
Florian Roth 5de3cd71a4 Merge pull request #149 from yt0ng/development 
Detects Request to amsiInitFailed that can be used to disable AMSI Scanning
 2018-08-22 17:19:10 +02:00
Florian Roth 040ba0338d fix: Added Event ID in second selection 2018-08-22 17:03:13 +02:00
Florian Roth 0c729d1eea Already used in different rule 2018-08-22 17:02:03 +02:00
Florian Roth 6ee31f6cd1 Update win_susp_commands_recon_activity.yml 
Merged recon commands from @yt0ng's rule
 2018-08-22 17:00:00 +02:00
megan201296 3f5c32c6da Add MITRE ATT&CK tagging 2018-08-22 09:35:06 -05:00
megan201296 76aabe7e05 Add ATT&CK Matrix tags 2018-08-22 09:30:55 -05:00
James Dickenson 29bed766dd removed re-introduced output class from qradar backend. fixed list handling error. 2018-08-21 22:45:12 -07:00
James Dickenson 468f040c0a Merge branch 'qradar-dev' 2018-08-20 21:54:30 -07:00
Nik Seetharaman e371d945ed Add Microsoft Workflow Compiler Sysmon Detection 2018-08-18 00:53:28 -05:00
yt0ng ca7e8d6468 removing for new pull request 2018-08-17 18:42:10 +02:00
yt0ng 5bb6f566ba ::Merge remote-tracking branch 'upstream/master' 2018-08-17 18:39:36 +02:00
yt0ng 8ecf167e85 Powershell AMSI Bypass via .NET Reflection 
[Ref].Assembly.GetType('http://System.Management .Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

seen in recent activity https://www.hybrid-analysis.com/sample/0ced17419e01663a0cd836c9c2eb925e3031ffb5b18ccf35f4dea5d586d0203e?environmentId=120
 2018-08-17 18:26:04 +02:00
James Dickenson 9a61f40cef added support flor flow data in qradar backend 2018-08-16 21:44:17 -07:00
yt0ng 07e411fe6b Oilrig Information gathering 
whoami & hostname & ipconfig /all & net user /domain 2>&1 & net group /domain 2>&1 & net group "domain admins" /domain 2>&1 & net group "Exchange Trusted Subsystem" /domain 2>&1 & net accounts /domain 2>&1 & net user 2>&1 & net localgroup administrators 2>&1 & netstat -an 2>&1 & tasklist 2>&1 & sc query 2>&1 & systeminfo 2>&1 & reg query "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" 2>&1
 2018-08-15 14:29:59 +02:00
Florian Roth 4e91462838 fix: Bugfix in Adwind rule 2018-08-15 12:33:03 +02:00
Florian Roth 92dc08a304 rule: Added recon command 2018-08-15 12:33:03 +02:00
Florian Roth 7c05b85bcd rule: Added malware UA 2018-08-15 12:33:03 +02:00
Thomas Patzke 320bb9f8c4 Added rewrite config to generic sysmon configuration 2018-08-14 21:34:54 +02:00
Thomas Patzke 430972231f Added generic sysmon configuration with process_execution config 2018-08-14 21:34:54 +02:00
Thomas Patzke 2715c44173 Converted first Sysmon rule to generic process_execution rule 2018-08-14 21:34:54 +02:00
James Dickenson a8d1831382 Added aggregation support for qradar backend 2018-08-13 23:04:10 -07:00
Thomas Patzke dce4b4825d Fixed aggregations without field name 
Generated query contained field name "None".
 2018-08-10 15:07:07 +02:00
Thomas Patzke 2c0e76be3d Escaped * where required 2018-08-10 13:53:08 +02:00
Thomas Patzke e0b3f91b2a Removed empty line 2018-08-08 23:15:13 +02:00
Thomas Patzke 5b02695b13 Merge pull request #146 from samsson/patch-8 
Hiding files with attrib.exe sysmon rule
 2018-08-08 22:57:30 +02:00
Lurkkeli 7cdc13ef11 Update 2018-08-08 17:05:51 +02:00
Lurkkeli 392351af25 Adding ATT&CK tag 2018-08-08 16:43:54 +02:00
Lurkkeli 4d721f1803 Updating fps 2018-08-08 16:42:26 +02:00
Lurkkeli b9f433414d hiding files with attrib.exe 2018-08-08 16:19:39 +02:00
Thomas Patzke 01215a645e Merge pull request #145 from yt0ng/master 
DNS TXT Answer with possible execution strings
 2018-08-08 15:58:34 +02:00
Thomas Patzke 58afccb2f3 Fixed ATT&CK tagging 2018-08-08 15:58:19 +02:00
yt0ng e44b4f450e DNS TXT Answer with possible execution strings 
https://twitter.com/stvemillertime/status/1024707932447854592
 2018-08-08 15:51:56 +02:00
Thomas Patzke 92c0e0321a Merge pull request #144 from samsson/patch-7 
Added att&ck tags
 2018-08-07 11:19:36 +02:00
Lurkkeli a245820519 added att&ck tag 2018-08-07 08:54:53 +02:00
Lurkkeli 294677a2cc added att&ck tag 2018-08-07 08:50:01 +02:00
Lurkkeli a57e87b345 added att&ck tag 2018-08-07 08:49:05 +02:00
Lurkkeli 99253763af added att&ck tag 2018-08-07 08:45:58 +02:00
Lurkkeli 0bff27ec21 added att&ck tactic 
added att&ck tactic, no specific techniques applicable
 2018-08-07 08:37:51 +02:00
Lurkkeli 198cb63182 added att&ck tactic 
added att&ck tactic, no specific techniques applicable
 2018-08-07 08:36:53 +02:00
Thomas Patzke 518e21fcd2 Merge pull request #134 from nikseetharaman/sysmon_cmstp_com_object_access 
Add CMSTP UAC Bypass via COM Object Access
 2018-08-07 08:33:33 +02:00
Thomas Patzke b9fdf07926 Extended tagging 2018-08-07 08:33:18 +02:00
Lurkkeli b50c13dd1f Update att&ck tag 2018-08-07 08:27:24 +02:00
Thomas Patzke 5d5d42eb9b Merge pull request #140 from yt0ng/master 
Possible Shim Database Persistence via sdbinst.exe
 2018-08-07 08:22:32 +02:00
Thomas Patzke 80eaedab8b Fixed tag and date 2018-08-07 08:22:11 +02:00
Thomas Patzke 3509fbd201 Merge pull request #142 from samsson/patch-5 
Added ATT&CK tag
 2018-08-07 08:20:22 +02:00
Thomas Patzke b049210641 Fixed tags 2018-08-07 08:20:09 +02:00
Lurkkeli 3456f9a74d Update sysmon_susp_wmi_execution.yml 2018-08-07 08:19:58 +02:00
Thomas Patzke b9d0e3172f Merge pull request #143 from samsson/patch-6 
Added ATT&CK tag
 2018-08-07 08:19:01 +02:00
Thomas Patzke 64fa3b162d Tag fixes 2018-08-07 08:18:16 +02:00
Lurkkeli 6472be5e19 Update sysmon_uac_bypass_sdclt.yml 2018-08-07 08:08:53 +02:00
Lurkkeli 21bee17ffd Update sysmon_uac_bypass_eventvwr.yml 2018-08-07 08:07:49 +02:00
yt0ng fc091fe3d7 Added ATTCK Mapping 2018-08-05 14:00:22 +02:00
yt0ng b65cb5eaca Possible Shim Database Persistence via sdbinst.exe 2018-08-05 13:55:04 +02:00
Thomas Patzke f8246e9f49 Removed "not implemented" hints for available options in sigmac 2018-08-04 23:31:29 +02:00
Thomas Patzke 0e986cae4d Fixed log source and field names 2018-08-04 22:58:19 +02:00
Thomas Patzke e6c3313168 Merge branch 'master' of https://github.com/Neo23x0/sigma 2018-08-02 22:45:25 +02:00
Thomas Patzke af9f636199 Removal of backend output classes 
Breaking change: Instead of feeding the output class with the results,
they are now returned as strings (*Backend.generate()) or list
(SigmaCollectionParser.generate()). Users of the library must now take
care of the output to the terminal, files or wherever Sigma rules should
be pushed to.
 2018-08-02 22:41:32 +02:00
Florian Roth acfdb591d0 fiox: Typo in description fixed 2018-07-29 16:22:39 +02:00
Florian Roth 1f845aa1d9 fix: Changed suspicious process creation rule to avoid FPs 2018-07-29 16:22:09 +02:00
Thomas Patzke 1c9d0a176e Moved const_start into class definition 2018-07-28 23:51:33 +02:00
Thomas Patzke 8ceebba0d2 Merging split of config 2018-07-27 23:56:18 +02:00
Thomas Patzke df74460629 Fixed imports after config split 2018-07-27 23:54:18 +02:00
Thomas Patzke e02af9aa37 Merge config split branches 2018-07-27 23:16:50 +02:00
Thomas Patzke eb440b3357 Split config - code removal from configuration 2018-07-27 23:02:35 +02:00
Thomas Patzke 36ada66007 Split config - Copy configuration 2018-07-27 23:01:41 +02:00
Thomas Patzke 920c4b061d Split config - code removal from filter 2018-07-27 22:35:30 +02:00
Nik Seetharaman b938fdb0a3 Add CMSTP UAC Bypass via COM Object Access 2018-07-27 02:28:28 -05:00
Thomas Patzke db07648f33 Merge pull request #133 from james0d0a/attack_tags 
added a few mitre attack tags to windows sysmon rules
 2018-07-27 07:55:56 +02:00
James Dickenson 5fc118dcac added a few mitre attack tags to windows sysmon rules 2018-07-26 21:15:07 -07:00
Thomas Patzke d235a9e017 Split config - Copy filter 2018-07-27 00:23:22 +02:00
Thomas Patzke 50a6a92d20 Split config - code removal from exceptions 2018-07-27 00:17:35 +02:00
Thomas Patzke 405bc4a0d1 Split config - Copy exception 2018-07-27 00:17:13 +02:00
Thomas Patzke 096bc35447 Split config - code removal from mapping 2018-07-27 00:15:14 +02:00
Thomas Patzke 4ffbb25960 Split config - Copy mapping 2018-07-27 00:13:19 +02:00
Thomas Patzke cad6e8d314 Merge parser split branch 2018-07-27 00:02:59 +02:00
Thomas Patzke 1c4c67053c Fixes for parser split 
* Fixed imports
* Rename
 2018-07-27 00:02:07 +02:00
Thomas Patzke 88a4a5d36a Merge parser split branches 2018-07-26 23:42:09 +02:00
Thomas Patzke 595327ace4 Split parser - code removal from condition 2018-07-26 23:40:22 +02:00
Thomas Patzke c8043368bd Split parser - code removal from rule 2018-07-26 22:43:49 +02:00
Florian Roth a9fcecab88 Merge pull request #130 from samsson/patch-4 
Fixed typo / Created a rule
 2018-07-26 22:34:46 +02:00
Thomas Patzke 294ca20350 Split parser - code removal from collection 2018-07-26 22:28:33 +02:00
Thomas Patzke 3a0de01bad Split parser - code removal from base 2018-07-26 22:22:21 +02:00
Thomas Patzke b9425d13df Split parser - code removal from exceptions 2018-07-26 22:18:21 +02:00
Thomas Patzke e550bf5c3b Split parser - Copy base 2018-07-26 22:15:04 +02:00
Thomas Patzke a2329de03c Split parser - Copy rule 2018-07-26 22:07:38 +02:00
Florian Roth 016b15a2a9 Added quotation marks 
I've added quotation marks to make it clearer (leading dash looks weird)
 2018-07-26 18:10:21 +02:00
Lurkkeli 7796492c2b Update powershell_NTFS_Alternate_Data_Streams 2018-07-26 08:54:08 -07:00
Thomas Patzke 5e3211928f Merge pull request #132 from dspautz/master 
Add tags to APT rules
 2018-07-25 09:57:35 +02:00
David Spautz f039f95f4d Add tags to APT rules 2018-07-25 09:50:01 +02:00
Florian Roth 089498b0b3 Merge pull request #131 from yt0ng/master 
Possible SafetyKatz Dump of debug.bin
 2018-07-25 07:41:38 +02:00
Florian Roth dd857c4470 Cosmetics 
If it's only 1 value we write it like this to avoid it being interpreted as a list with 1 element and to avoid an extra line.
 2018-07-25 07:37:17 +02:00
Florian Roth cf7f5c7473 Changes 
I think that this is what you've wanted, right? If both keywords appear in a single log entry, right? 
Don't you think that this still causes false positives? Could "set-content" and "stream" be more common than expected?
 2018-07-25 07:35:59 +02:00
yt0ng b415fc8d42 Possible SafetyKatz Dump of debug.bin 
https://github.com/GhostPack/SafetyKatz
 2018-07-24 23:51:46 +02:00
Lurkkeli db82322d17 Update powershell_NTFS_Alternate_Data_Streams 2018-07-24 20:03:07 +02:00
Lurkkeli 0e9c5bb14a Update sysmon_rundll32_net_connections.yml 2018-07-24 20:01:47 +02:00
Lurkkeli fd8c5c5bf6 Update powershell_NTFS_Alternate_Data_Streams 2018-07-24 20:00:21 +02:00
Lurkkeli ad580635ea Create powershell_NTFS_Alternate_Data_Streams 2018-07-24 19:49:08 +02:00
Thomas Patzke afe8bd6a57 Merge pull request #129 from nbareil/patch-1 
use yaml.safe_load()
 2018-07-24 11:22:24 +02:00
Nicolas Bareil 6728a5ccaa use yaml.safe_load() 2018-07-24 11:14:01 +02:00
Thomas Patzke 0fa914139c Merge pull request #128 from ntim/master 
Tagged windows powershell, other and malware rules.
 2018-07-24 11:05:50 +02:00
ntim c99dc9f643 Tagged windows powershell, other and malware rules. 2018-07-24 10:56:41 +02:00
Thomas Patzke bfc7012043 Merge pull request #127 from dspautz/master 
Add tags to windows builtin rules
 2018-07-24 08:24:39 +02:00
Thomas Patzke 0d8bc922a3 Merge branch 'master' into master 2018-07-24 08:23:37 +02:00
Thomas Patzke 1601b00862 Merge pull request #125 from james0d0a/attack_tags 
windows builtin mitre attack tags
 2018-07-24 08:18:47 +02:00
Thomas Patzke 01e7675e24 Merge pull request #124 from samsson/patch-1 
ATT&CK tagging
 2018-07-24 07:58:50 +02:00
Thomas Patzke 30d255ab6f Fixed tag 2018-07-24 07:58:25 +02:00
Thomas Patzke baaf8006bc Merge pull request #123 from yt0ng/sysmon 
added additional binaries and attack tactics/techniques
 2018-07-24 07:57:30 +02:00
Thomas Patzke ee330bf7fb Merge pull request #121 from sekuryti/sekuryti-CVE-2018-2894--rule-changes 
Update web_cve_2018_2894_weblogic_exploit.yml
 2018-07-24 07:56:53 +02:00
David Spautz e275d44462 Add tags to windows builtin rules 2018-07-24 07:50:32 +02:00
James Dickenson c4edc26267 windows builtin mitre attack tags 2018-07-23 21:34:20 -07:00
Thomas Patzke 1abb13c5d9 Split parser - Copy condition 2018-07-24 00:13:37 +02:00
Thomas Patzke a8501cb446 Split parser - Copy exceptions 2018-07-24 00:08:23 +02:00
Thomas Patzke 983ee6eeb9 Splitting parser - copying collections 2018-07-24 00:06:02 +02:00
Thomas Patzke 54f5870658 Removed debugging code 2018-07-24 00:04:24 +02:00
Thomas Patzke b76fa884ec Changed copyright notices accordingly 2018-07-24 00:01:16 +02:00
Lurkkeli 1898157df5 ATT&CK tagging 
Added tag for technique t1015
 2018-07-23 23:57:15 +02:00
yt0ng 16160dfc80 added additional binaries and attack tactics/techniques 2018-07-23 15:47:56 +02:00
Florian Roth 1134051fba Update web_cve_2018_2894_weblogic_exploit.yml 
Ah, we could do it this way *.js*
 2018-07-23 06:19:25 -06:00
Florian Roth 03a64cca74 Update web_cve_2018_2894_weblogic_exploit.yml 
We try to avoid false positives
 2018-07-23 06:18:38 -06:00
MATTHEW CARR dfb77e936d Update web_cve_2018_2894_weblogic_exploit.yml 
To detect all possible extensions .jspx, .jsw, .jsv, and .jspf
 2018-07-23 07:41:47 +02:00
Florian Roth 0f1b440b91 Rule: widened the CVE-2018-2894 WebLogic rule 
https://twitter.com/lo_security/status/1021148314308358144
 2018-07-22 20:36:10 -06:00
Florian Roth ffb0cf5ed5 Rule: CVE-2018-2894 Oracle WebLogic exploit and webshell drop 2018-07-22 15:09:45 -06:00
Florian Roth 5f48fa64ff Merge pull request #120 from suleymanozarslan/master 
Further ATT&CK tagging
 2018-07-22 12:11:31 -06:00
Suleyman Ozarslan e6cbc17c12 ATT&CK tagging of Scheduled Task Creation 2018-07-22 15:56:47 +03:00
Suleyman Ozarslan 8d9b12be07 ATT&CK tagging of Default PowerSploit Schtasks Persistence 2018-07-22 15:53:56 +03:00
Süleyman Özarslan 28705b3790 Merge pull request #2 from Neo23x0/master 
merge
 2018-07-22 15:47:36 +03:00
Thomas Patzke fbde251ebc Added missing exception import in ES backend 2018-07-22 09:26:25 +02:00
Thomas Patzke 91e6b8ca6b Merging refactoring changes into master 2018-07-22 09:23:07 +02:00
Thomas Patzke cf175d7b7e Removal from sigma.backends.qradar 2018-07-22 09:14:50 +02:00
Thomas Patzke 097660c678 Splitting backends - Copy qradar.py 2018-07-22 09:12:29 +02:00
Thomas Patzke c8e21b3f24 Fixing after split 
* Fixing imports
* Discovery in new sub modules
 2018-07-21 01:09:02 +02:00
Thomas Patzke b85aec6157 Merging backend split branches 2018-07-21 00:59:50 +02:00
Thomas Patzke 3e2184ac61 Removal from sigma.backends.elasticsearch 2018-07-21 00:37:36 +02:00
Thomas Patzke 408a961e59 Merge pull request #119 from suleymanozarslan/master 
Further ATT&CK tagging
 2018-07-20 09:06:20 +02:00
Suleyman Ozarslan 080892b5ab ATT&CK tagging of MSHTA Spawning Windows Shell 2018-07-20 09:53:55 +03:00
Suleyman Ozarslan 76f277d5fe ATT&CK tagging of Malicious Named Pipe rule 2018-07-20 09:41:54 +03:00
Suleyman Ozarslan 7e74527344 ATT&CK software tag is added to Bitsadmin Download rule 2018-07-20 09:35:35 +03:00
Süleyman Özarslan 9f607a7c43 Merge pull request #1 from Neo23x0/master 
mere forks
 2018-07-20 09:33:37 +03:00
Florian Roth 1e61adfad1 rule: Changed Registry persistence Explorer RUN key rule 2018-07-19 16:27:19 -06:00
Florian Roth 83d6f12ce3 rule: Registry persistence in Explorer RUN key pointing to suspicious folder 2018-07-19 16:27:19 -06:00
Thomas Patzke f98158f5ad Further ATT&CK tagging 2018-07-19 23:36:13 +02:00
Florian Roth fc08077086 Merge pull request #116 from suleymanozarslan/master 
ATT&CK tagging of Suspicious Certutil Command rule
 2018-07-19 08:25:50 -06:00
Suleyman Ozarslan 05b91847cd ATT&CK tagging of Suspicious Certutil Command rule 2018-07-19 16:42:39 +03:00
Florian Roth cea2dcbd89 docs: Info Graphic version 0.1 LQ / HQ 2018-07-17 19:25:37 -06:00
Florian Roth 9767f22756 docs: Info Graphic version 0.1 - fix 2018-07-17 19:14:40 -06:00
Florian Roth f27252bfaa docs: Info Graphic version 0.1 2018-07-17 19:12:56 -06:00
Thomas Patzke bdea097b80 ATT&CK tagging 2018-07-17 23:58:11 +02:00
Thomas Patzke 926dc7d56b Updated backends in README 2018-07-17 23:34:53 +02:00
Thomas Patzke a9257c32c6 Sigma tools release 0.6 2018-07-17 23:12:23 +02:00
Thomas Patzke 63f9093896 Merge of SOC Prime QRadar backend 2018-07-17 22:57:54 +02:00
Thomas Patzke 52e4910ab6 Added QRadar backend to CI testing 2018-07-17 22:56:31 +02:00
Thomas Patzke 5bd898ed1d Merge branch 'master' of https://github.com/socprime/sigma 2018-07-17 22:45:21 +02:00
Florian Roth 9e92b97661 Merge pull request #111 from nikseetharaman/cmstp_execution 
Add sysmon_cmstp_execution
 2018-07-17 14:39:56 -06:00
nikotin 88a1e2a365 Merge remote-tracking branch 'origin/master' 2018-07-17 15:25:27 +03:00
nikotin b5f27d75be Added Qradar backend 2018-07-17 15:25:06 +03:00
Florian Roth 3f0040b983 Removed duplicate status field 2018-07-16 15:55:31 -06:00
Florian Roth 429474b6d6 Merge pull request #113 from megan201296/patch-9 
fixed typo
 2018-07-16 15:38:52 -06:00
Florian Roth e184f3f5b9 Merge pull request #112 from megan201296/patch-8 
fixed typo
 2018-07-16 15:38:19 -06:00
megan201296 02ea2cf923 fixed typo 2018-07-16 16:20:33 -05:00
megan201296 60310e94c6 fixed typo 2018-07-16 16:13:24 -05:00
socprime eee5a1b1df Merge pull request #2 from Neo23x0/master 
Pull updates
 2018-07-16 18:49:16 +03:00
Nik Seetharaman 3630386230 Add sysmon_cmstp_execution 2018-07-16 02:53:41 +03:00
Florian Roth 7a031709bb Merge pull request #108 from megan201296/patch-5 
fixed typo
 2018-07-14 18:31:40 -06:00
Florian Roth 70ab83eb65 Merge pull request #109 from megan201296/patch-6 
Fixed typo
 2018-07-14 18:31:21 -06:00
Florian Roth be77c893c2 Merge pull request #110 from megan201296/patch-7 
typo fix
 2018-07-14 18:31:07 -06:00
megan201296 be7a3b0774 Update sysmon_susp_mmc_source.yml 2018-07-13 18:49:08 -05:00
megan201296 a6455cc612 typo fix 2018-07-13 18:48:36 -05:00
megan201296 8944be1efd Update sysmon_susp_driver_load.yml 2018-07-13 18:36:12 -05:00
megan201296 a169723005 fixed typo 2018-07-13 13:53:21 -05:00
socprime 86cbab5190 Merge pull request #1 from Neo23x0/master 
Pull updates
 2018-07-11 15:01:43 +03:00
Thomas Patzke c2b1a58813 Removal from sigma.backends.wdatp 2018-07-10 23:49:39 +02:00
Thomas Patzke 45782c6328 Removal from sigma.backends.splunk 2018-07-10 23:48:47 +02:00
Thomas Patzke 46f29d2eb2 Removal from sigma.backends.output 2018-07-10 23:47:41 +02:00
Thomas Patzke 2d4145cfe8 Removal from sigma.backends.discovery 2018-07-10 23:46:52 +02:00
Thomas Patzke 83acff6859 Splitting backends - Copy discovery.py 2018-07-10 23:46:16 +02:00
Thomas Patzke d340487e94 Removal from sigma.backends.base 2018-07-10 23:44:14 +02:00
Thomas Patzke 2e7d366da5 Removal from sigma.backends.mixins 2018-07-10 23:42:38 +02:00
Thomas Patzke bb78c1428e Removal from sigma.backends.logpoint 2018-07-10 23:41:15 +02:00
Thomas Patzke 2edeaee748 Removal from sigma.backends.graylog 2018-07-10 23:40:17 +02:00
Thomas Patzke e5baca0ac4 Removal from sigma.backends.qualys 2018-07-10 23:39:18 +02:00
Thomas Patzke fdfe346adc Removal from sigma.backends.exceptions 2018-07-10 23:37:59 +02:00
Thomas Patzke 7fbc3a35a3 Removal from sigma.backends.cli 2018-07-10 23:33:40 +02:00
Thomas Patzke 881f72e418 Removal from sigma.backends.tools 2018-07-10 23:32:42 +02:00
Thomas Patzke 09ac41949c Removal from sigma.backends.archsight 2018-07-10 23:22:36 +02:00
Thomas Patzke 04b89befce Splitting backends - Copy elasticsearch.py 2018-07-10 23:15:04 +02:00
Thomas Patzke bb9bef4deb Splitting backends - Copy wdatp.py 2018-07-10 23:15:04 +02:00
Thomas Patzke 72480d304b Splitting backends - Copy splunk.py 2018-07-10 23:15:04 +02:00
Thomas Patzke c5d5c52850 Splitting backends - Copy output.py 2018-07-10 23:15:04 +02:00
Thomas Patzke 0c93040da5 Splitting backends - Copy base.py 2018-07-10 23:15:04 +02:00
Thomas Patzke a8e19bb4ba Splitting backends - Copy mixins.py 2018-07-10 23:15:04 +02:00
Thomas Patzke 116fe16512 Splitting backends - Copy logpoint.py 2018-07-10 23:15:04 +02:00
Thomas Patzke b621e9c3a8 Splitting backends - Copy graylog.py 2018-07-10 23:15:04 +02:00
Thomas Patzke a2ee36eac7 Splitting backends - Copy qualys.py 2018-07-10 23:15:04 +02:00
Thomas Patzke 32c70b26d8 Splitting backends - Copy exceptions.py 2018-07-10 23:15:04 +02:00
Thomas Patzke 43d951b173 Splitting backends - Copy cli.py 2018-07-10 23:15:04 +02:00
Thomas Patzke a6cd7a3d6b Splitting backends - Copy tools.py 2018-07-10 23:15:04 +02:00
Thomas Patzke 7a2b1ae790 Splitting backends - Copy arcsight.py 2018-07-10 23:15:04 +02:00
Thomas Patzke 2dc5295abf Removed redundant attribute from rule 2018-07-10 22:50:02 +02:00
Thomas Patzke d064d24fbe Sigmac WDATP backend: renamed action types 2018-07-10 22:49:38 +02:00
Florian Roth 57727d2397 Merge pull request #107 from megan201296/typo-fixes 
Typo fixes
 2018-07-10 10:29:10 -06:00
megan201296 24d2d0b258 Fixed typo 2018-07-10 09:14:37 -05:00
megan201296 d6ea0a49fc Fixed typoes 2018-07-10 09:14:07 -05:00
megan201296 3ec67393cd Fixed typo 2018-07-10 09:13:41 -05:00
Florian Roth 66481c27a9 Merge pull request #106 from megan201296/patch-4 
Fixed typo
 2018-07-09 12:43:39 -06:00
megan201296 b0bc3b66ed Fixed typo 2018-07-09 13:32:16 -05:00
Florian Roth a030db2c94 Merge pull request #105 from megan201296/patch-3 
removed duplicates
 2018-07-09 12:18:32 -06:00
megan201296 120479abb7 removed duplicates 2018-07-09 12:32:41 -05:00
Florian Roth aed6939411 Merge pull request #104 from megan201296/patch-2 
Fixed typo
 2018-07-09 11:07:48 -06:00
megan201296 c4bd267151 Fixed typo 2018-07-09 12:02:42 -05:00
Florian Roth 1574f1ea47 Merge pull request #103 from megan201296/patch-1 
Fixed spelling mistake
 2018-07-09 08:32:09 -06:00
megan201296 a7ccfcb50d Fixed spelling mistake 2018-07-09 09:13:31 -05:00
Florian Roth c8fef4d093 fix: removed unnecessary lists 2018-07-07 15:43:56 -06:00
Florian Roth dea019f89d fix: some threat levels adjusted 2018-07-07 13:00:23 -06:00
Florian Roth 9ce8630a27 Merge pull request #102 from yt0ng/patch-4 
MSHTA spwaned by SVCHOST as seen in LethalHTA
 2018-07-07 12:59:00 -06:00
yt0ng 6a014a3dc8 MSHTA spwaned by SVCHOST as seen in LethalHTA 
"Furthermore it can be detected by an mshta.exe process spawned by svchost.exe."
 2018-07-06 19:52:58 +02:00
Florian Roth ed470feb21 Merge pull request #99 from yt0ng/master 
Detects ImageLoad by uncommon Image
 2018-07-06 10:11:02 -06:00
yt0ng b21afc3bc8 user subTee was removed from Twitter 2018-07-04 17:29:05 +02:00
yt0ng f84c33d005 Known powershell scripts names for exploitation 
Detects the creation of known powershell scripts for exploitation
 2018-07-04 17:24:18 +02:00
Florian Roth 7867838540 fix: typo in rule description 2018-07-03 05:05:44 -06:00
Florian Roth e7465d299f fix: false positive with MsMpEng.exe and svchost.exe as child process 2018-07-03 05:05:44 -06:00
Thomas Patzke 0cdfc776de Sigma tools release 0.5 2018-07-03 00:07:43 +02:00
Thomas Patzke 3e40a48ce1 Merge branch 'SaltyHash123-master' 2018-07-02 23:31:43 +02:00
Thomas Patzke 0bacba05aa Added backend 'splunkxml' to CI tests 2018-07-02 23:20:02 +02:00
Thomas Patzke 67158ba1d2 Merge branch 'master' of https://github.com/SaltyHash123/sigma into SaltyHash123-master 2018-07-02 23:14:04 +02:00
yt0ng 42941ee105 Detects ImageLoad by uncommon Image 
Process Hollowing Described by SubTee using notepad https://twitter.com/subTee/status/1012657434702123008
 2018-07-01 15:47:17 +02:00
Florian Roth 48582a1c93 Bugfix in Flash Downloader Rule 2018-06-30 23:39:38 +02:00
Florian Roth 2a74a62c67 Config file for SPARK scanner 2018-06-29 16:42:16 +02:00
Florian Roth c3bf968462 High FP Rule 2018-06-29 16:01:46 +02:00
Florian Roth c26c3ee426 Trying to fix rule 2018-06-28 16:39:47 +02:00
Florian Roth fa98595ad6 Added SPARK Sigma rule scan feature to list 2018-06-28 16:28:07 +02:00
Florian Roth 9e0abc5f0b Adjusted rules to the new specs reg "not null" usage 2018-06-28 09:30:31 +02:00
Florian Roth 336f4c83e0 Merge pull request #97 from scherma/patch-1 
False positive circumstance
 2018-06-27 23:18:56 +02:00
scherma 19ba5df207 False positive circumstance 2018-06-27 21:14:38 +01:00
Florian Roth 86e6518764 Changed (any) statements to (not null) to comply with the newest specs 2018-06-27 20:57:58 +02:00
Florian Roth a61052fc0a Rule fixes 2018-06-27 18:47:52 +02:00
Florian Roth 9705366060 Adjusted some rules 2018-06-27 16:54:44 +02:00
Florian Roth fc72bd16af Fixed bugs 2018-06-27 09:20:41 +02:00
Thomas Patzke c3d582bc13 Cleanup 2018-06-26 23:37:21 +02:00
Florian Roth 5843fe2590 Update README.md 2018-06-25 18:59:36 +02:00
Florian Roth 467b8c80f4 Update README.md 2018-06-25 18:58:05 +02:00
Florian Roth 2ae57166ac Updated README 2018-06-25 18:29:02 +02:00
Florian Roth 3283c52c0f Added WDATP in the list of supported backends 2018-06-25 18:09:21 +02:00
Florian Roth f4b150def8 Rule: Powershell remote thread creation in Rundll32 2018-06-25 15:23:19 +02:00
Florian Roth 1a1011b0ad Merge pull request #96 from yt0ng/master 
Detects the creation of a schtask via PowerSploit Default Configuration
 2018-06-23 17:15:14 +02:00
yt0ng c59d0c7dca Added additional options 2018-06-23 15:54:31 +02:00
yt0ng cc3fd9f5d0 Detects the creation of a schtask via PowerSploit Default Configuration 
https://github.com/0xdeadbeefJERKY/PowerSploit/blob/8690399ef70d2cad10213575ac67e8fa90ddf7c3/Persistence/Persistence.psm1
 2018-06-23 15:45:58 +02:00
Roey 14464f8c79 Added support of splunk dashboards (xml) 2018-06-22 14:17:58 +02:00
Florian Roth 28a7e64212 Rule: Sysprep on AppData folder 2018-06-22 14:02:55 +02:00
Thomas Patzke 7d1b801858 Merge branch 'devel-sigmac-wdatp' 2018-06-22 00:43:23 +02:00
Thomas Patzke d8e036f737 sigmac: Parameter for ignoring "not supported" errors 
Used to pass tests with complete rule set that would fail for backends
which target systems don't support required features.
 2018-06-22 00:23:59 +02:00
Thomas Patzke 31727b3b25 Added Windows Defender ATP backend 
Missing:
* Aggregations
 2018-06-22 00:03:10 +02:00
Thomas Patzke df6ad82770 Removed redundant attribute from rule 
EventID 4657 already implies the modification.
 2018-06-21 23:59:55 +02:00
Thomas Patzke e72c0d5de4 SingleTextQueryBackend ignores empty components in composed queries 
Example: one component of a AND-composition is ignored if invoked
generate* call returns None.
 2018-06-21 23:59:41 +02:00
Thomas Patzke d8a7bcad39 Reordered rule generation 
Generation of query parts before and after main query gives access to
information possibly gathered while main query generation.
 2018-06-21 23:50:13 +02:00
Florian Roth b05856eae1 Rule: Update suspicious TLD downloads 2018-06-13 00:08:46 +02:00
Florian Roth 3d52030391 Changed help text for -r flag 2018-06-13 00:08:46 +02:00
Florian Roth 946c946366 Rule: NTLM logon 2018-06-13 00:08:46 +02:00
Florian Roth 7edd95744a Windows NTLM 2018-06-13 00:08:46 +02:00
Florian Roth e23cdafb85 Rule: Fixed missing description 2018-06-13 00:08:46 +02:00
Florian Roth c9658074dd Removed "not yet implemented" comment from -r flag 2018-06-13 00:08:46 +02:00
Florian Roth df2745ec6c Merge pull request #92 from yt0ng/patch-2 
Update proxy_ua_apt.yml
 2018-06-10 10:29:16 +02:00
Florian Roth f6f718c54f Cosmetics 2018-06-10 10:28:59 +02:00
yt0ng 3166bf5b05 Update proxy_ua_apt.yml 
user Agent seen in https://www.hybrid-analysis.com/sample/a80e29c0757bee05338fd5c22a542d852ad86c477068e3eb4aacc1c3e59e2eef?environmentId=100
 2018-06-10 10:17:02 +02:00
Thomas Patzke dbc25b6bfa Integrated Qualys backend to CI testing 2018-06-07 23:33:47 +02:00
Thomas Patzke f6d5e5dd99 Sigmac parameter -I now ignores all backend errors 
New backends introduced further exceptions and the intention of -I is to
get a successful run.
 2018-06-07 23:33:12 +02:00
Thomas Patzke 8ddb369df3 Integration of Qualys backend 
* Changed description text to one-liner
* Output to intended class
* Minor code optimizations
 2018-06-07 23:31:09 +02:00
Thomas Patzke ce9db548ff Integration of ArcSight backend 
* Rename
* Changed description to one line to beautify output of backend list
* Small bugfix in handling of numeric values
 2018-06-07 23:04:36 +02:00
Thomas Patzke 17c894005c Merge branch 'master' of https://github.com/socprime/sigma into socprime-backends 2018-06-07 22:18:51 +02:00
nikotin d13e8d7bd3 Added ArcSight & Qualys backends 2018-06-07 16:18:23 +03:00
Florian Roth bd61f223ee Sofacy Zebrocy samples 2018-06-06 23:24:18 +02:00
Florian Roth 667b3b4935 Rule: Added 2 more Sofacy User-Agents 2018-06-06 22:38:50 +02:00
Florian Roth 9640806678 Rules: Telegram Bot API access 2018-06-05 16:25:43 +02:00
Florian Roth 9c817a493b Rule: DCSync 2018-06-03 16:00:57 +02:00
Florian Roth d1d4473505 Rule: ADS with executable 
https://twitter.com/0xrawsec/status/1002478725605273600
 2018-06-03 02:08:57 +02:00
Florian Roth 4eabc5ea5c Sigmac Usage 2018-06-01 10:33:11 +02:00
Florian Roth 8e500d2caa Bugfix in rule 2018-05-29 14:11:12 +02:00
Florian Roth 0d97522b5a Merge pull request #88 from noraj/patch-1 
enhance web server paths
 2018-05-29 11:54:46 +02:00
Alexandre ZANNI 74da324d8f remove old public_html 
remove old public_html
 2018-05-29 11:44:38 +02:00
Alexandre ZANNI a1de770b64 enhance web server paths 
- specify when it is apache only
- add Per-user path
- add archlinux paths
 2018-05-29 11:41:36 +02:00
Florian Roth f9596c1ae0 MISP added 2018-05-28 09:15:48 +02:00
Florian Roth fc8a21fac5 Evt2Sigma 2018-05-28 09:13:08 +02:00
Florian Roth 51c6d0a767 Rule: Proxy User-Agent VPNFilter 2018-05-24 00:34:07 +02:00
Florian Roth 65cc78f9e8 Windows Config Update - DNS logs 2018-05-22 16:59:58 +02:00
Florian Roth 2db00b8559 Rule: whoami execution 2018-05-22 16:59:58 +02:00
Thomas Patzke bd23946f06 Merge of Graylog backend pull request 2018-05-18 15:55:02 +02:00
Thomas Patzke 21040f04cc Added CI test for Graylog backend 2018-05-18 15:53:25 +02:00
Thomas Patzke b28480495e Merge branch 'master' of https://github.com/DefenceLogic/sigma into DefenceLogic-master 2018-05-18 15:49:19 +02:00
Thomas Patzke 079c04f28d Fixed rule scope 2018-05-18 14:23:52 +02:00
Paul Dutot 715a88542d Graylog backend added 2018-05-17 15:51:25 +01:00
Paul Dutot 05e108a4d1 Merge pull request #1 from Neo23x0/master 
Updating Fork
 2018-05-17 10:49:54 +01:00
Florian Roth 1fd4172832 Merge pull request #84 from mgreen27/patch-1 
Update_WebDAV
 2018-05-17 09:40:32 +02:00
Florian Roth 57dc02aa9f Merge pull request #85 from HacknowledgeCH/es-dsl-patch 
patched es-dsl
 2018-05-17 09:39:55 +02:00
milkmix 37ee355a77 patched es-dsl 2018-05-17 08:44:50 +02:00
Matthew Green 16365b7793 Update_WebDAV 
Made the name a bit generic as WebDAV can be used by several download cradles.
Added in HttpMethod as a select as GET requests makes for a great filter point with much less false positives.
 2018-05-16 13:05:15 +10:00
Thomas Patzke 33ffd2683e Disabled failing pypy3 build 2018-05-13 22:52:25 +02:00
Thomas Patzke 738d03c751 Fixed position of line separation if rulecomment and verbose is active 2018-05-13 22:36:51 +02:00
Thomas Patzke 6a3fcdc68c Unified 0x values with other rules 2018-05-13 22:28:43 +02:00
Florian Roth 429ae0729a README Update 2018-05-12 08:33:31 +02:00
Florian Roth 1aaed07dd7 Rule: Suspicious base64 encoded part of DNS query 2018-05-10 14:08:52 +02:00
Florian Roth 62b490396d Rule: Cobalt Strike DNS Beaconing 2018-05-10 14:08:52 +02:00
Thomas Patzke f60e7e125f Sigma tools release 0.4 
* Various bug fixes in quoting of specific characters
* New backend es-dsl
 2018-05-01 00:50:07 +02:00
Thomas Patzke 7647587a8b Fixed quoting of backslashes in generated queries 2018-05-01 00:45:59 +02:00
Thomas Patzke de2ed08695 Merge branch 'ci-es' 2018-05-01 00:34:11 +02:00
Thomas Patzke a1c32123f1 Setup ES 6.2.4 in Travis CI 2018-05-01 00:23:48 +02:00
Thomas Patzke e411039b56 Fixed escaping of \u in Elasticsearch Query String queries 2018-05-01 00:05:16 +02:00
Florian Roth ae6df590a9 Delphi downloader https://goo.gl/rMVUSM 2018-04-24 23:23:21 +02:00
Florian Roth 49877a6ed0 Moved and renamed rule 2018-04-18 16:53:11 +02:00
Florian Roth 3c1c9d2b31 Merge pull request #81 from yt0ng/sigma-yt0ng 
added SquiblyTwo Detection
 2018-04-18 16:39:37 +02:00
Florian Roth 8420d3174a Reordered 2018-04-18 16:34:16 +02:00
yt0ng c637c2e590 Adding Detections for renamed wmic and format 
https://subt0x11.blogspot.ch/2018/04/wmicexe-whitelisting-bypass-hacking.html
https://twitter.com/mattifestation/status/986280382042595328
 2018-04-18 15:02:52 +02:00
Florian Roth 9b8df865b1 Extended rule 2018-04-18 12:13:45 +02:00
yt0ng a4fb39a336 also for http 2018-04-18 08:19:47 +02:00
yt0ng 169a4404c2 added SquiblyTwo Detection 2018-04-17 21:33:26 +02:00
Florian Roth 6d293d498d Merge pull request #80 from marvi/marvi-patch-1 
"author" should be a string and not a list.
 2018-04-17 08:27:29 +02:00
Markus Härnvi cf237cf658 "author" should be a string and not a list, according to the specification 2018-04-16 23:42:51 +02:00
Florian Roth d8bbf26f2c Added msiexec to rule in order to cover new threats 
https://twitter.com/DissectMalware/status/984252467474026497
 2018-04-12 09:12:50 +02:00
Thomas Patzke 15a6c5efb5 Detailed error messages for failed queries 2018-04-12 00:20:54 +02:00
Thomas Patzke aeda30a389 Python rewrite of es-qs query test 2018-04-11 23:59:44 +02:00
Florian Roth 58517907ad Improved rule to provide support for for old sysmon \REGISTRY syntax 2018-04-11 20:15:17 +02:00
Florian Roth 0ffd226293 Moved new rule to sysmon folder 2018-04-11 20:11:54 +02:00
Florian Roth 52d405bb1b Improved shell spawning rule 2018-04-11 20:09:42 +02:00
Florian Roth ef7fb4cff1 Merge pull request #78 from Karneades/patch-1 
Add rule for Windows registry persistence mechanisms
 2018-04-11 19:35:55 +02:00
Florian Roth b065c2c35c Simplified rule 2018-04-11 19:03:35 +02:00
Karneades fa6677a41d Remove @ in author 
Be nice to Travis: "error    syntax error: found character '@' that cannot start any token"
 2018-04-11 15:21:42 +02:00
Karneades be3c27981f Add rule for Windows registry persistence mechanisms 2018-04-11 15:13:00 +02:00
Thomas Patzke 788111f174 Fixes for Elasticsearch query correctness CI tests 
* Quoting in rule
* Reading queries without special processing of backslashes

Unfortunately, backslashes still cause breaks caused by Bash handling of
them.
 2018-04-09 22:33:29 +02:00
Florian Roth 56172ae174 Corrected CrackMapExec rule 2018-04-09 08:40:03 +02:00
Florian Roth a9c7fe202e Rule: Windows shell spawning suspicious program 2018-04-09 08:37:30 +02:00
Florian Roth 8ddd40e18e PowerShell Cradle - WebDAV UA 2018-04-09 08:37:30 +02:00
Florian Roth e53826e167 Extended Sysmon Office Shell rule 2018-04-09 08:37:30 +02:00
Florian Roth 6eb8cdfeab TSCookie UA 2018-04-09 08:37:30 +02:00
Thomas Patzke 05928d4f8f Merge pull request #76 from HacknowledgeCH/es-dsl 
es-dsl backend
 2018-04-08 23:39:23 +02:00
Thomas Patzke f113832c04 Merge pull request #69 from jmallette/rules 
Create cmdkey recon rule
 2018-04-08 23:23:30 +02:00
Thomas Patzke 35d43c5ed9 Merge pull request #77 from yt0ng/sigma-yt0ng 
added NCSC CrackMapExecWin Description in apt_dragonfly.yml
 2018-04-08 23:21:49 +02:00
root 69671733a8 added NCSC CrackMapExecWin Description in apt_dragonfly.yml 2018-04-08 17:10:00 +02:00
milkmix 0b3b0c3aaf imported es-dsl code from repo 2018-04-06 17:36:11 +02:00
Thomas Patzke 24d94d39b8 CI: Testing backend es-qs against Elasticsearch 2018-04-04 00:32:48 +02:00
Thomas Patzke 4183b1b59e Sigma tools release 0.3.3 2018-03-29 11:17:03 +02:00
Thomas Patzke 22ee6f4521 sigmac: escaped wildcards (\* and \?) are passed in generated query 2018-03-29 11:15:20 +02:00
Thomas Patzke 17c1c1adff Added field name mappings to HELK configuration 2018-03-27 14:41:02 +02:00
Thomas Patzke a3e02ea70f Various rule fixes 
* Field name: LogonProcess -> LogonProcessName
* Field name: Message -> AuditPolicyChanges
* Field name: ProcessCommandLine -> CommandLine
* Removed Type match in Kerberos RC4 encryption rule
  Problematic because text representation not unified and audit failures are possibly interesting events
* Removed field 'Severity' from rules (Redundant)
* Rule decomposition of win_susp_failed_logons_single_source) because of different field names
* Field name: SubjectAccountName -> SubjectUserName
* Field name: TargetProcess -> TargetImage
* Field name: TicketEncryption -> TicketEncryptionType
* Field name: TargetFileName -> TargetFilename
 2018-03-27 14:35:49 +02:00
Thomas Patzke b1bfa64231 Removed redundant 'EventLog' conditions 2018-03-26 00:36:40 +02:00
Thomas Patzke f68af2a5da Added reference to Kerberos RC4 rule 2018-03-25 23:19:01 +02:00
Thomas Patzke dacc6ae3d3 Fieldname case: Commandline -> CommandLine 2018-03-25 23:08:28 +02:00
Florian Roth e141a834ff Rule: Ping hex IP address 
https://github.com/vysec/Aggressor-VYSEC/blob/master/ping.cna
 2018-03-23 17:00:00 +01:00
Florian Roth c10da5b734 Improved Chafer activity rule 2018-03-23 10:50:40 +01:00
Florian Roth a797a281ac Rule: Chafer / OilRig activity Mar 18 
https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/
 2018-03-23 08:59:16 +01:00
Thomas Patzke 3962520848 Merge branch 'devel-sigmac' 2018-03-22 00:05:51 +01:00
Thomas Patzke 5f8b60cc24 sigmac: Improved fieldlist backend 
* Unique list of fields for multiple rules
* Aggregation support
 2018-03-22 00:03:51 +01:00
Florian Roth f220e61adc Fixed second selection in rule 2018-03-21 10:47:14 +01:00
Florian Roth 70c2f973a3 Rule: Smbexec.py Service Installation 2018-03-21 10:44:37 +01:00
Florian Roth 3c968d4ec6 Fixed rule for any ControlSets 2018-03-21 10:44:37 +01:00
Thomas Patzke 5c0f811f4a Sigma tools release 0.3.2 2018-03-21 01:15:19 +01:00
Thomas Patzke 0018503501 sigmac: Fixed rulecommend backend option 2018-03-21 01:13:10 +01:00
Thomas Patzke 7360a68741 Sigma tools release 0.3.1 2018-03-21 00:59:23 +01:00
Thomas Patzke 4a9849b161 sigmac: improved backend options 
* parsing in main class
* help
 2018-03-21 00:53:44 +01:00
Thomas Patzke bd20ffdad9 sigmac/kibana: curl URL quoted 2018-03-21 00:22:00 +01:00
Thomas Patzke 177e2acf8e Updated README 2018-03-20 23:54:00 +01:00
Florian Roth 97204d8dc0 Renamed rule 2018-03-20 15:04:11 +01:00
Florian Roth e9fcfcba7f Improved NetNTLM downgrade rule 2018-03-20 15:03:55 +01:00
Florian Roth a7eb4d3e34 Renamed rule 2018-03-20 11:12:35 +01:00
Florian Roth b84bbd327b Rule: NetNTLM Downgrade Attack 
https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
 2018-03-20 11:07:21 +01:00
Florian Roth a6d293e31d Improved tscon rule 2018-03-20 10:54:04 +01:00
Florian Roth 8fb6bc7a8a Rule: Suspicious taskmgr as LOCAL_SYSTEM 2018-03-19 16:36:39 +01:00
Florian Roth af8be8f064 Several rule updates 2018-03-19 16:36:15 +01:00
Florian Roth 648ac5a52e Rules: tscon.exe anomalies 
http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
 2018-03-17 19:14:13 +01:00
Thomas Patzke 3f5f3a8d50 sigmac: Remove problematic characters from rule identifiers 2018-03-17 00:44:50 +01:00
Thomas Patzke f6858c436a sigmac: Kibana curl output generates one index pattern line per pattern 2018-03-16 23:53:12 +01:00
Thomas Patzke 578118315c Merge branch 'devel-sigmac' into helk 2018-03-16 23:48:13 +01:00
Thomas Patzke e162ba0155 Added HELK configuration 2018-03-16 23:42:31 +01:00
Florian Roth ff45901ea3 Merge pull request #71 from Karneades/patch-1 
Add missing binaries
 2018-03-16 11:49:37 +01:00
Karneades 49c12f1df8 Add missing binaries 2018-03-16 10:52:43 +01:00
Florian Roth a257b7d9d7 Rule: Stickykey improved 2018-03-16 09:10:07 +01:00
Florian Roth 8b31767d31 Rule: PsExec usage 2018-03-15 19:54:22 +01:00
Florian Roth 0460e7f18a Rule: Suspicious process started from taskmgr 2018-03-15 19:54:03 +01:00
Florian Roth f5494c6f5f Rule: StickyKey-ike backdoor usage 2018-03-15 19:53:34 +01:00
Florian Roth d9d27fec74 Improved EquationGroup dll load rule 2018-03-11 01:22:04 +01:00
Thomas Patzke d8bd65f9ff sigmac: Added testcase for Kibana curl script output 2018-03-11 00:30:20 +01:00
Thomas Patzke 13ec4c3e3b sigmac: Kibana curl importer script 2018-03-11 00:25:12 +01:00
Florian Roth 74c2f91a7d Extended the Slingshot APT rule 2018-03-10 16:44:18 +01:00
Florian Roth 66d52cfeef Rule: Defrag deactivation 2018-03-10 15:49:50 +01:00
Florian Roth ef75f2a248 Minor adjustment in: EquationGroup dll_u load 2018-03-10 12:24:49 +01:00
Florian Roth e9d16bfae1 Bugfix in: EquationGroup dll_u load 2018-03-10 12:22:53 +01:00
Florian Roth 5ae5c9de19 Rule: Outlook spawning shells to detect Turla like C&C via Outlook 2018-03-10 09:04:11 +01:00
Florian Roth 6a65a7a1bf EquationGroup dll_u load 2018-03-10 09:04:11 +01:00
jmallette aff46be8a3 Create cmdkey recon rule 2018-03-08 13:25:05 -05:00
Thomas Patzke ada1ca94ea JPCERT rules 
* Addition of ntdsutil.exe rule
* Added new link to existing rules
 2018-03-08 00:10:19 +01:00
Thomas Patzke 8ee24bf150 WMI persistence rules derived from blog article 
https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/#so-to-summarize
 2018-03-07 23:05:10 +01:00
Thomas Patzke 1dc3ae1a8e Fixed merge_sigma failing test 2018-03-07 00:20:35 +01:00
Thomas Patzke 54d9e52527 Sigma tools release 0.3 2018-03-06 23:21:13 +01:00
Thomas Patzke 3b8b04fe09 Merge branch 'devel-sigmac' 2018-03-06 23:19:45 +01:00
Thomas Patzke 8041f77abd Merged similar rules 2018-03-06 23:19:11 +01:00
Thomas Patzke 84645f4e59 Simplified rule conditions with new condition constructs 2018-03-06 23:14:43 +01:00
Thomas Patzke 7141729ffc sigma/parser: Introduced new conditions 
* Any definition: 1 of them
* All definitions: all of them
* Any of selected definitions: 1 of def* (wildcard)
* All of selected definitions: all of def* (wildcard)
 2018-03-06 23:13:42 +01:00
Florian Roth b9102d0b0a Improved sigma2elastalert 2018-03-05 12:05:47 +01:00
Florian Roth 1ecfd83a6a Missing separator 2018-03-05 11:30:01 +01:00
Thomas Patzke 6b69f423da Merging sigma2elastalert 2018-03-04 23:27:23 +01:00
Thomas Patzke 17e8f06161 Added notice regarding contributed tools 2018-03-04 23:26:38 +01:00
David ROUTIN 00177560ca Added sigma2elastalert.py 2018-03-04 23:26:06 +01:00
Thomas Patzke 5a97befea0 Sigma tools release 0.2 2018-03-04 23:03:19 +01:00
Thomas Patzke 59eff939f2 Merge branch 'devel-sigmac' 2018-03-04 22:59:41 +01:00
Thomas Patzke 647fc6187a sigmac: Added proper 'Content-Type' header for xpack-watcher backend 2018-03-04 22:58:15 +01:00
Thomas Patzke 4792700726 Fixed rule 2018-03-04 22:07:01 +01:00
Thomas Patzke 01f38adbdb Fixed condition 2018-03-04 20:07:02 +01:00
Florian Roth 6e0cc193c7 Rule: Pony / Fareit UA 2018-03-01 09:28:04 +01:00
Florian Roth 69274d7782 Rule: Sofacy Trojan Loader 2018-03-01 09:27:46 +01:00
Florian Roth 6c6dac4cbb Changed Elise backdoor rule 2018-02-25 17:25:04 +01:00
Florian Roth f2057f0c77 Hurricane Panda activity 
https://www.crowdstrike.com/blog/crowdstrike-discovers-use-64-bit-zero-day-privilege-escalation-exploit-cve-2014-4113-hurricane-panda/
 2018-02-25 17:24:00 +01:00
Florian Roth 1001afb038 Rule: CVE-2015-1641 2018-02-22 16:59:40 +01:00
Florian Roth 25dc3e78be Lowered severity of rule - prone to false positives 2018-02-22 16:59:11 +01:00
Florian Roth 9020a9aa32 Fixed file names "vuln" > "exploit" 2018-02-22 13:29:19 +01:00
Florian Roth 5d763581fa Adding status "experimental" to that rule 2018-02-22 13:28:01 +01:00
Florian Roth 0be687d245 Rule: Detect CVE-2017-0261 exploitation 2018-02-22 13:27:20 +01:00
Florian Roth b88a81a9e1 Rule: Linux > named > suspicious activity 2018-02-20 14:56:28 +01:00
Florian Roth ef0cd4c110 Rules: Extended and fixed (*) sshd rules 2018-02-20 13:44:06 +01:00
Dominik Schaudel cea48d9010 Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module 2018-02-12 21:57:22 +01:00
Florian Roth d6d031fc23 Rule update: Olympic destroyer detection 
http://blog.talosintelligence.com/2018/02/olympic-destroyer.html
 2018-02-12 15:35:47 +01:00
Florian Roth 058d719e2b Rule update: Proxy UA > Loki Bot 2018-02-12 10:08:32 +01:00
Thomas Patzke 6f6d662ae5 Dropped support for Python 3.4 
Dict unpacking in dict initialization not supported in Python 3.4.
 2018-02-11 22:48:40 +01:00
Florian Roth fa4dbc0f2e Rule: QuarksPwDump temp dump file 2018-02-10 15:25:36 +01:00
Florian Roth 0a1c600d7d Rule: Changed msiexec web install rule 2018-02-10 15:25:08 +01:00
Florian Roth 443afcba0a README Update: Rule creation tutorial, smaller fixes 2018-02-10 15:24:43 +01:00
Florian Roth a4e6b3003f Rule: Msiexec web install 2018-02-09 10:13:39 +01:00
Florian Roth 1382edb5e3 Cosmetics 2018-02-09 10:13:39 +01:00
Thomas Patzke 89aa300bbc Improved xpack-watcher actions 
* Log and mail
* Details in message
 2018-02-09 00:03:41 +01:00
Thomas Patzke 8336929d76 XPack Watcher Backend: Improved aggregation capabilities 
* Aggregation with "...count(field)...", "...by field..." and
  combination of both
* Still only count() supported
 2018-02-08 22:17:35 +01:00
Thomas Patzke 4762a1cc30 Removed abandoned SigmaAggregationParser.trans_timeframe() method 2018-02-05 23:30:00 +01:00
Thomas Patzke 841bb65ca0 Merge branch 'master' of https://github.com/Neo23x0/sigma 2018-02-05 22:51:37 +01:00
Thomas Patzke 69efb05c5f First draft of Rx schema 2018-02-04 00:27:09 +01:00
Florian Roth 34e0352a21 Rule: Proxy UAs - malware - Ghost419 
https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/
 2018-02-03 14:47:04 +01:00
Thomas Patzke 01d6b2be3a Merge branch 'master' of https://github.com/Neo23x0/sigma 2018-02-01 22:49:52 +01:00
Thomas Patzke ec3f0f6d60 Fixed before/after logic 
If nothing was generated "None" was printed.
 2018-02-01 22:49:02 +01:00
Florian Roth 635d052fcc Renamed rule - not APT32 related 2018-01-31 23:52:24 +01:00
Florian Roth 4152442bfa Changed reference to references in Elise rule 2018-01-31 23:13:00 +01:00
Florian Roth f1b339504e Rule: APT32 Elise 2018-01-31 23:12:00 +01:00
Sherif Eldeeb 376d0414d8 Condition is a str, not a list 
To be consistent with schema and all the other rules:
- `condition` should be a `str`
- if an `or` condition needs to be applied, use parentheses and literal `or` instead of a `list`
 2018-01-28 16:16:00 +03:00
Sherif Eldeeb 90a8cc9d40 Merge pull request #3 from Neo23x0/master 
Merge pull request #64 from SherifEldeeb/master
 2018-01-28 16:11:19 +03:00
Thomas Patzke f35c50049f Merge pull request #64 from SherifEldeeb/master 
Update rules to reflect schema changes "and add consistency"
 2018-01-28 10:56:27 +01:00
SherifEldeeb 348728bdd9 Cleaning up empty list items 2018-01-28 02:36:39 +03:00
SherifEldeeb 48441962cc Change All "str" references to be "list"to mach schema update 2018-01-28 02:24:16 +03:00
SherifEldeeb 112a0939d7 Change "reference" to "references" to match new schema 2018-01-28 02:12:19 +03:00
Sherif Eldeeb 21bc16393b Merge pull request #1 from Neo23x0/master 
Update
 2018-01-28 02:00:09 +03:00
Thomas Patzke e76ef7da76 Merge branch 'devel-sigmac' 2018-01-27 23:50:00 +01:00
Thomas Patzke 76bdcba71f Added rulecomment option to all single-query output backends 
Prints comment with rule before output.
 2018-01-27 23:48:10 +01:00
Florian Roth 0f2e1c5934 Bugfix: Missing wildcard in IIS module install rule 2018-01-27 16:15:25 +01:00
Florian Roth d93d7d8e7b Rule: IIS nativ-code module command line installation 2018-01-27 11:13:13 +01:00
Florian Roth aca70e57ec Massive Title Cleanup 2018-01-27 10:57:30 +01:00
Florian Roth f31ed7177e Added status 'experimental' to newly created auditd rules 2018-01-23 11:15:02 +01:00
Florian Roth fe80ae7885 Rule: Linux auditd 'program execution in suspicious folders' 2018-01-23 11:13:23 +01:00
Florian Roth 228ca1b765 Rule: Linux auditd 'suspicious commands' 2018-01-23 11:13:23 +01:00
Thomas Patzke 7708a538f4 New PyPI release 2017-12-14 22:40:31 +01:00
Thomas Patzke fc2dd90aaf Skipping dotfiles 2017-12-14 22:39:51 +01:00
Thomas Patzke 497496fdf1 New release 2017-12-13 00:28:50 +01:00
Thomas Patzke f3d19f394e Fixed encoding issues 
Some OS environments don't use UTF-8 as default encoding. Enforced it
for output files and stdout.
 2017-12-13 00:12:56 +01:00
Florian Roth 379b2dd207 New recon activity rule 2017-12-11 09:31:54 +01:00
Florian Roth 8e2aef035c Removed commands - false positive reduction 2017-12-11 09:31:54 +01:00
Florian Roth 1464ab4ab8 Renamed rule: recon activity > net recon activity - to be more specific 2017-12-11 09:31:54 +01:00
Florian Roth 285f5bab4f Removed duplicate string 2017-12-11 09:31:54 +01:00
423 changed files with 17251 additions and 3204 deletions
Expand all files Collapse all files
.travis.yml
+16 -4
View File
@@ -1,12 +1,24 @@
language: python
dist: xenial
python:
- 3.4
- 3.5
# - 3.5 # Deactivated because Travis CI tests failed randomly (Travis's problem)
- 3.6
- pypy3
- 3.7
sudo: true
services:
- elasticsearch
cache: pip
before_install:
- curl -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.2.4.deb && sudo dpkg -i --force-confnew elasticsearch-6.2.4.deb && sudo service elasticsearch restart
install:
- pip install -r tools/requirements-devel.txt
script:
- make test
- make test-backend-es-qs
notifications:
email:
recipients:
- venom14@gmail.com
- thomas@patzke.org
on_success: change
on_failure: always
.yamllint
+8
View File
@@ -1,4 +1,12 @@
---
# https://yamllint.readthedocs.io/en/latest/configuration.html
extends: default
rules:
comments: disable
comments-indentation: disable
document-start: disable
empty-lines: {max: 2, max-start: 2, max-end: 2}
indentation: disable
line-length: disable
new-line-at-end-of-file: disable
trailing-spaces: disable
BREAKING_CHANGES.md
+30
View File
@@ -0,0 +1,30 @@
# Breaking Changes in Sigma
Improvement sometimes makes it inavoidable to break with the past. This file describes the planned and implemented
breaking changes since 2019. Monitor this file if you use Sigma in productive environments.
Columns:
* Date: The date the change was or will be implemented. Planned dates may be sunject of changes.
* Status may be one of:
* Planned: there's the idea, but work hasn't begun.
* Development: the change is currently developed.
* Implemented: the development is finished, but the change was not yet merged to the master.
* Merged: the change has been merged to the master branch. Breaking changes affecting only rules
skip this state.
* Released: the change has been released officially, this means:
* Code or configuration of Sigma tools was pushed as [PyPI release](https://pypi.org/project/sigmatools/)
* Sigma rules were merged to master.
* Issues: GitHub issues in the project repository for further details.
* Commit/Branch:
* a development branch for the states *Development* and *Implemented*.
* a commit reference to the merge commit for states from *Merged*.
* Release: [PyPI release](https://pypi.org/project/sigmatools/) that implements or will implement the change.
* Description: contains a short description of the change.
| Date | Status | Issues | Commit/Branch | Release | Description |
|------------|----------|---------------------|-----------------|---------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2019-10-01 | Planned | - | - | - | Field name cleanup |
| 2019-08-01 | Released | - | config-cleanup | 0.12 | Configuration name cleanup |
| 2019-08-01 | Released | - | devel-modifiers | 0.12 | Pipe character must be escaped with backslash in field value names due to introduction of value modifiers |
| 2019-03-02 | Released | #136 #137 #139 #147 | 56a1ed1 | 0.9 | Introduction of [generic log sources](https://patzke.org/introducing-generic-log-sources-in-sigma.html) and *process_creation* as first generic log source. |
Makefile
+70 -39
View File
@@ -1,7 +1,7 @@
.PHONY: test test-yaml test-sigmac
TMPOUT = $(shell tempfile)
COVSCOPE = tools/sigma/*.py,tools/sigmac,tools/merge_sigma
test: clearcov test-yaml test-sigmac test-merge build finish
.PHONY: test test-rules test-sigmac
TMPOUT = $(shell tempfile||mktemp)
COVSCOPE = tools/sigma/*.py,tools/sigma/backends/*.py,tools/sigmac,tools/merge_sigma
test: clearcov test-rules test-sigmac test-merge build finish
clearcov:
rm -f .coverage
@@ -10,53 +10,84 @@ finish:
coverage report --fail-under=90
rm -f $(TMPOUT)
test-yaml:
test-rules:
yamllint rules
tests/test_rules.py
test-sigmac:
coverage run -a --include=$(COVSCOPE) tools/sigmac
coverage run -a --include=$(COVSCOPE) tools/sigmac -h
coverage run -a --include=$(COVSCOPE) tools/sigmac -l
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t es-qs rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t kibana rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t xpack-watcher rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunk rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t logpoint rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunk -f 'level>=high,level<=critical,status=stable,logsource=windows' rules/ > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunk -f 'level>=high,level<=critical,status=xstable,logsource=windows' rules/ > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunk -f 'level>=high,level<=xcritical,status=stable,logsource=windows' rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunk -f 'level=critical' rules/ > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunk -f 'level=xcritical' rules/ > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunk -f 'foo=bar' rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/elk-windows.yml -t es-qs rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/elk-linux.yml -t es-qs rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/elk-windows.yml -t kibana rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/elk-linux.yml -t kibana rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/elk-windows.yml -t xpack-watcher rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/elk-linux.yml -t xpack-watcher rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/elk-defaultindex.yml -t xpack-watcher rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/splunk-windows-all.yml -t splunk rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/logpoint-windows-all.yml -t logpoint rules/ > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -rvd -t es-qs rules/ > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t es-qs rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t es-qs --shoot-yourself-in-the-foot rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -c winlogbeat tests/test-modifiers.yml > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -O rulecomment -rvdI -c tools/config/winlogbeat.yml -t es-qs rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t kibana -c tools/config/winlogbeat.yml rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t graylog rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t xpack-watcher -O email,index,webhook -c tools/config/winlogbeat.yml rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t elastalert -c tools/config/winlogbeat.yml -O alert_methods=http_post,email -O emails=test@test.invalid -O http_post_url=http://test.invalid rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t elastalert-dsl -c tools/config/winlogbeat.yml -O alert_methods=http_post,email -O emails=test@test.invalid -O http_post_url=http://test.invalid rules/ > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunk rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunk -c tools/config/splunk-windows-index.yml rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunkxml -c tools/config/splunk-windows.yml rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t logpoint -c tools/config/logpoint-windows.yml rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t wdatp rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t ala rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t ala --backend-config tests/backend_config.yml rules/windows/process_creation/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t es-dsl -c tools/config/winlogbeat.yml rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t powershell -c tools/config/powershell.yml -Ocsv rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t arcsight -c tools/config/arcsight.yml rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t qradar -c tools/config/qradar.yml rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t qualys -c tools/config/qualys.yml rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t netwitness -c tools/config/netwitness.yml rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t sumologic -O rulecomment -c tools/config/sumologic.yml rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunk -c tools/config/splunk-windows-index.yml -f 'level>=high,level<=critical,status=stable,logsource=windows,tag=attack.execution' rules/ > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunk -c tools/config/splunk-windows-index.yml -f 'level>=high,level<=critical,status=xstable,logsource=windows' rules/ > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunk -c tools/config/splunk-windows-index.yml -f 'level>=high,level<=xcritical,status=stable,logsource=windows' rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunk -c tools/config/splunk-windows-index.yml -f 'level=critical' rules/ > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunk -c tools/config/splunk-windows-index.yml -f 'level=xcritical' rules/ > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t splunk -c tools/config/splunk-windows-index.yml -f 'foo=bar' rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-windows.yml -t es-qs rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c sysmon -c logstash-windows -t es-qs rules/ > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c sysmon -c logstash-windows -t splunk rules/ > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-windows.yml -c tools/config/generic/sysmon.yml -t es-qs rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-linux.yml -t es-qs rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-windows.yml -t kibana rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-windows.yml -Ooutput=curl -t kibana rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-linux.yml -t kibana rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-linux.yml -Ooutput=curl -t kibana rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-windows.yml -t xpack-watcher rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-linux.yml -t xpack-watcher rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/filebeat-defaultindex.yml -t xpack-watcher rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/splunk-windows.yml -t splunk rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -c tools/config/generic/sysmon.yml -c tools/config/splunk-windows.yml -t splunk rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t grep rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -rvdI -t fieldlist rules/ > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -t xpack-watcher -O output=plain -O es=es -O foobar rules/windows/builtin/win_susp_failed_logons_single_source.yml > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -o $(TMPOUT) tests/collection_repeat.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t xpack-watcher -O output=foobar -O es=es -O foobar rules/windows/builtin/win_susp_failed_logons_single_source.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs tests/not_existing.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs tests/invalid_yaml.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs tests/invalid_sigma-no_identifiers.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs tests/invalid_sigma-no_condition.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs tests/invalid_sigma-invalid_identifier_reference.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs tests/invalid_sigma-invalid_aggregation.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs tests/invalid_sigma-wrong_identifier_definition.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs rules/windows/builtin/win_susp_failed_logons_single_source.yml
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -o /not_possible rules/windows/sysmon/sysmon_mimikatz_detection_lsass.yml
coverage run -a --include=$(COVSCOPE) tools/sigmac -t xpack-watcher -c tools/config/winlogbeat.yml -O output=plain -O es=es -O foobar rules/windows/builtin/win_susp_failed_logons_single_source.yml > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -t kibana -c tests/config-multiple_mapping.yml -c tests/config-multiple_mapping-2.yml tests/mapping-conditional-multi.yml > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -t xpack-watcher -c tools/config/winlogbeat.yml -O output=json -O es=es -O foobar rules/windows/builtin/win_susp_failed_logons_single_source.yml > /dev/null
coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml -o $(TMPOUT) - < tests/collection_repeat.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t xpack-watcher -c tools/config/winlogbeat.yml -O output=foobar -O es=es -O foobar rules/windows/builtin/win_susp_failed_logons_single_source.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml tests/not_existing.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml tests/invalid_yaml.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml tests/invalid_sigma-no_identifiers.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml tests/invalid_sigma-no_condition.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml tests/invalid_sigma-invalid_identifier_reference.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml tests/invalid_sigma-invalid_aggregation.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml tests/invalid_sigma-wrong_identifier_definition.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml rules/windows/builtin/win_susp_failed_logons_single_source.yml
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml -o /not_possible rules/windows/sysmon/sysmon_mimikatz_detection_lsass.yml
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -c not_existing rules/windows/sysmon/sysmon_mimikatz_detection_lsass.yml
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -c tests/invalid_yaml.yml rules/windows/sysmon/sysmon_mimikatz_detection_lsass.yml
! coverage run -a --include=$(COVSCOPE) tools/sigmac -t es-qs -c tests/invalid_config.yml rules/windows/sysmon/sysmon_mimikatz_detection_lsass.yml
! coverage run -a --include=$(COVSCOPE) tools/sigmac -rvI -c tools/config/elk-defaultindex.yml -t kibana rules/ > /dev/null
test-merge:
tests/test-merge.sh
! coverage run -a --include=$(COVSCOPE) tools/merge_sigma.py tests/not_existing.yml > /dev/null
! coverage run -a --include=$(COVSCOPE) tools/merge_sigma tests/not_existing.yml > /dev/null
test-backend-es-qs:
tests/test-backend-es-qs.py
build: tools/sigmac tools/merge_sigma tools/sigma/*.py tools/setup.py tools/setup.cfg
cd tools && python3 setup.py bdist_wheel
README.md
+200 -48
View File
@@ -3,9 +3,10 @@
![sigma_logo](./images/Sigma_0.3.png)
# Sigma
Generic Signature Format for SIEM Systems
# What is Sigma?
# What is Sigma
Sigma is a generic and open signature format that allows you to describe relevant log events in a straight forward manner. The rule format is very flexible, easy to write and applicable to any type of log file. The main purpose of this project is to provide a structured form in which researchers or analysts can describe their once developed detection methods and make them shareable with others.
@@ -17,48 +18,31 @@ This repository contains:
* Open repository for sigma signatures in the `./rules`subfolder
* A converter that generate searches/queries for different SIEM systems [work in progress]
![sigma_description](./images/Sigma-description.png)
## Hack.lu 2017 Talk
[![Sigma - Generic Signatures for Log Events](https://preview.ibb.co/cMCigR/Screen_Shot_2017_10_18_at_15_47_15.png)](https://www.youtube.com/watch?v=OheVuE9Ifhs "Sigma - Generic Signatures for Log Events")
## SANS Webcast on MITRE ATT&CK and Sigma
The SANS webcast on Sigma contains a very good 20 min introduction to the project by John Hubbart from minute 39 onward. (SANS account required; registration is free)
[MITRE ATT&CK and Sigma Alerting Webcast Recording](https://www.sans.org/webcasts/mitre-att-ck-sigma-alerting-110010 "MITRE ATT&CK and Sigma Alerting")
# Use Cases
* Describe your once discovered detection method in Sigma to make it sharable
* Share the signature in the appendix of your analysis along with file hashes and C2 servers
* Describe your detection method in Sigma to make it sharable
* Write and your SIEM searches in Sigma to avoid a vendor lock-in
* Share the signature in the appendix of your analysis along with IOCs and YARA rules
* Share the signature in threat intel communities - e.g. via MISP
* Provide Sigma signatures for malicious behaviour in your own application (Error messages, access violations, manipulations)
* Integrate a new log into your SIEM and check the Sigma repository for available rules
* Write a rule converter for your custom log analysis tool and process new Sigma rules automatically
* Provide a free or commercial feed for Sigma signatures
# Sigma Converter
The converter is currently under development in the *devel-sigmac* branch of this project. It has currently the
following capabilities:
* Parsing of Sigma rule files
* Conversion of searches into Elasticsearch and Splunk queries
Planned main features are:
* Conversion of aggregation expressions (after the pipe character)
* Output of Kibana JSON configurations
Support for further SIEM solutions can be added by developing an corresponsing output backend class.
![sigma_description](./images/Sigma-description.png)
* Provide Sigma signatures for malicious behaviour in your own application
# Why Sigma
Today, everyone collects log data for analysis. People start working on their own, processing numerous white papers, blog posts and log analysis guidelines, extracting the necessary information and build their own searches and dashboard. Some of their searches and correlations are great and very useful but they lack a standardized format in which they can share their work with others.
Others provide excellent analyses for threat groups, sharing file indicators, C2 servers and YARA rules to detect the malicious files, but describe a certain malicious service install or remote thread injection in a separate paragraph. Security analysts, who read that paragraph then extract the necessary information and create rules in their SIEM system. The detection method never finds a way into a repository that is shared, structured and archived.
The lower layers of the OSI layer are well known and described. Every SIEM vendor has rules to detect port scans, ping sweeps and threats like the ['smurf attack'](https://en.wikipedia.org/wiki/Smurf_attack). But the higher layers contain numerous applications and protocols with special characteristics that write their own custom log files. SIEM vendors consider the signatures and correlations as their intelectual property and do not tend to share details on the coverage.
Sigma is meant to be an open standard in which detection mechanisms can be defined, shared and collected in order to improve the detection capabilities on the application layers for everyone.
![sigma_why](./images/Problem_OSI_v01.png)
Others provide excellent analyses, include IOCs and YARA rules to detect the malicious files and network connections, but have no way to describe a specific or generic detection method in log events. Sigma is meant to be an open standard in which such detection mechanisms can be defined, shared and collected in order to improve the detection capabilities for everyone.
## Slides
@@ -72,6 +56,21 @@ The specifications can be found in the [Wiki](https://github.com/Neo23x0/sigma/w
The current specification is a proposal. Feedback is requested.
# Getting Started
## Rule Creation
Florian wrote a short [rule creation tutorial](https://www.nextron-systems.com/2018/02/10/write-sigma-rules/) that can help you getting started.
## Rule Usage
1. Download or clone the respository
2. Check the `./rules` sub directory for an overview on the rule base
3. Run `python sigmac --help` in folder `./tools` to get a help on the rule converter
4. Convert a rule of your choice with `sigmac` like `./sigmac -t splunk -c tools/config/generic/sysmon.yml ./rules/windows/process_creation/win_susp_whoami.yml`
5. Convert a whole rule directory with `python sigmac -t splunk -r ../rules/proxy/`
6. Check the `./tools/config` folder and the [wiki](https://github.com/Neo23x0/sigma/wiki/Converter-Tool-Sigmac) if you need custom field or log source mappings in your environment
# Examples
Windows 'Security' Eventlog: Access to LSASS Process with Certain Access Mask / Object Type (experimental)
@@ -89,49 +88,194 @@ Sysmon: Web Shell Detection
Windows 'Security' Eventlog: Suspicious Number of Failed Logons from a Single Source Workstation
![sigma_rule example5](./images/Sigma_rule_example5.png)
## Sigma Toolchain
# Sigma Tools
## Sigmac
Sigmac converts sigma rules into queries or inputs of the supported targets listed below. It acts as a frontend to the
Sigma library that may be used to integrate Sigma support in other projects. Further, there's `merge_sigma.py` which
merges multiple YAML documents of a Sigma rule collection into simple Sigma rules.
![sigmac_converter](./images/Sigmac-win_susp_rc4_kerberos.png)
### Usage
```
usage: sigmac [-h] [--recurse] [--filter FILTER]
[--target {arcsight,es-qs,es-dsl,kibana,xpack-watcher,elastalert,graylog,logpoint,grep,netwitness,powershell,qradar,qualys,splunk,splunkxml,sumologic,fieldlist,wdatp}]
[--target-list] [--config CONFIG] [--output OUTPUT]
[--backend-option BACKEND_OPTION] [--defer-abort]
[--ignore-backend-errors] [--verbose] [--debug]
[inputs [inputs ...]]
Convert Sigma rules into SIEM signatures.
positional arguments:
inputs Sigma input files ('-' for stdin)
optional arguments:
-h, --help show this help message and exit
--recurse, -r Use directory as input (recurse into subdirectories is
not implemented yet)
--filter FILTER, -f FILTER
Define comma-separated filters that must match (AND-
linked) to rule to be processed. Valid filters:
level<=x, level>=x, level=x, status=y, logsource=z,
tag=t. x is one of: low, medium, high, critical. y is
one of: experimental, testing, stable. z is a word
appearing in an arbitrary log source attribute. t is a
tag that must appear in the rules tag list, case-
insensitive matching. Multiple log source
specifications are AND linked.
--target {arcsight,es-qs,es-dsl,kibana,xpack-watcher,elastalert,graylog,logpoint,grep,netwitness,powershell,qradar,qualys,splunk,splunkxml,sumologic,fieldlist,wdatp}, -t {arcsight,es-qs,es-dsl,kibana,xpack-watcher,elastalert,graylog,logpoint,grep,netwitness,powershell,qradar,qualys,splunk,splunkxml,sumologic,fieldlist,wdatp}
Output target format
--target-list, -l List available output target formats
--config CONFIG, -c CONFIG
Configurations with field name and index mapping for
target environment. Multiple configurations are merged
into one. Last config is authorative in case of
conflicts.
--output OUTPUT, -o OUTPUT
Output file or filename prefix if multiple files are
generated
--backend-option BACKEND_OPTION, -O BACKEND_OPTION
Options and switches that are passed to the backend
--defer-abort, -d Don't abort on parse or conversion errors, proceed
with next rule. The exit code from the last error is
returned
--ignore-backend-errors, -I
Only return error codes for parse errors and ignore
errors for rules that cause backend errors. Useful,
when you want to get as much queries as possible.
--verbose, -v Be verbose
--debug, -D Debugging output
```
### Examples
#### Single Rule Translation
Translate a single rule
```
tools/sigmac -t splunk rules/windows/sysmon/sysmon_susp_image_load.yml
```
#### Rule Set Translation
Translate a whole rule directory and ignore backend errors (`-I`) in rule conversion for the selected backend (`-t splunk`)
```
tools/sigmac -I -t splunk -r rules/windows/sysmon/
```
#### Rule Set Translation with Custom Config
Apply your own config file (`-c ~/my-elk-winlogbeat.yml`) during conversion, which can contain you custom field and source mappings
```
tools/sigmac -t es-qs -c ~/my-elk-winlogbeat.yml -r rules/windows/sysmon
```
#### Generic Rule Set Translation
Use a config file for `process_creation` rules (`-r rules/windows/process_creation`) that instructs sigmac to create queries for a Sysmon log source (`-c tools/config/generic/sysmon.yml`) and the ElasticSearch target backend (`-t es-qs`)
```
tools/sigmac -t es-qs -c tools/config/generic/sysmon.yml -r rules/windows/process_creation
```
#### Generic Rule Set Translation with Custom Config
Use a config file for a single `process_creation` rule (`./rules/windows/process_creation/win_susp_outlook.yml`) that instructs sigmac to create queries for process creation events generated in the Windows Security Eventlog (`-c tools/config/generic/windows-audit.yml`) and a Splunk target backend (`-t splunk`)
```
tools/sigmac -t splunk -c ~/my-splunk-mapping.yml -c tools/config/generic/windows-audit.yml ./rules/windows/process_creation/win_susp_outlook.yml
```
(See @blubbfiction's [blog post](https://patzke.org/a-guide-to-generic-log-sources-in-sigma.html) for more information)
### Supported Targets
* [Splunk](https://www.splunk.com/)
* [ElasticSearch](https://www.elastic.co/)
* [Splunk](https://www.splunk.com/) (plainqueries and dashboards)
* [ElasticSearch Query Strings](https://www.elastic.co/)
* [ElasticSearch Query DSL](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl.html)
* [Kibana](https://www.elastic.co/de/products/kibana)
* [Elastic X-Pack Watcher](https://www.elastic.co/guide/en/x-pack/current/xpack-alerting.html)
* [Logpoint](https://www.logpoint.com)
* [Windows Defender Advanced Threat Protection (WDATP)](https://www.microsoft.com/en-us/windowsforbusiness/windows-atp)
* [Azure Sentinel / Azure Log Analytics](https://azure.microsoft.com/en-us/services/azure-sentinel/)
* [ArcSight](https://software.microfocus.com/en-us/products/siem-security-information-event-management/overview)
* [QRadar](https://www.ibm.com/de-de/marketplace/ibm-qradar-siem)
* [Qualys](https://www.qualys.com/apps/threat-protection/)
* [RSA NetWitness](https://www.rsa.com/en-us/products/threat-detection-response)
* [PowerShell](https://docs.microsoft.com/en-us/powershell/scripting/getting-started/getting-started-with-windows-powershell?view=powershell-6)
* [Grep](https://www.gnu.org/software/grep/manual/grep.html) with Perl-compatible regular expression support
Current work-in-progress
* [Splunk Data Models](https://docs.splunk.com/Documentation/Splunk/7.1.0/Knowledge/Aboutdatamodels)
New targets are continuously developed. You can get a list of supported targets with `sigmac --target-list` or `sigmac -l`.
### Requirements
The usage of Sigmac or the underlying library requires Python >= 3.4 and PyYAML.
The usage of Sigmac (the Sigma Rule Converter) or the underlying library requires Python >= 3.5 and PyYAML.
### Installation
It's available on PyPI. Install with:
```
```bash
pip3 install sigmatools
```
# Next Steps
Alternatively, if used from the Sigma Github repository, the Python dependencies can be installed with:
* Integration of feedback into the rule specifications
* Integration into Threat Intel Exchanges, e.g. [MISP](http://www.misp-project.org/)
```bash
pip3 install -r tools/requirements.txt
```
For development (e.g. execution of integration tests with `make` and packaging), further dependencies are required and can be installed with:
```bash
pip3 install -r tools/requirements-devel.txt
```
## Sigma2MISP
Import Sigma rules to MISP events. Depends on PyMISP.
Parameters that aren't changed frequently (`--url`, `--key`) can be put without the prefixing dashes `--` into a file
and included with `@filename` as parameter on the command line.
Example:
*misp.conf*:
```
url https://host
key foobarfoobarfoobarfoobarfoobarfoobarfoo
```
Load Sigma rule into MISP event 1234:
```
sigma2misp @misp.conf --event 1234 sigma_rule.py
```
Load Sigma rules in directory sigma_rules/ into one newly created MISP event with info set to *Test Event*:
```
sigma2misp @misp.conf --same-event --info "Test Event" -r sigma_rules/
```
## Evt2Sigma
[Evt2Sigma](https://github.com/Neo23x0/evt2sigma) helps you with the rule creation. It generates a Sigma rule from a log entry.
## Contributed Scripts
The directory `contrib` contains scripts that were contributed by the community:
* `sigma2elastalert.py`i by David Routin: A script that converts Sigma rules to Elastalert configurations. This tool
uses *sigmac* and expects it in its path.
These tools are not part of the main toolchain and maintained separately by their authors.
# Next Steps
* Integration of MITRE ATT&CK framework identifier to the rule set
* Integration into Threat Intel Exchanges
* Attempts to convince others to use the rule format in their reports, threat feeds, blog posts, threat sharing platforms
# Projects that use Sigma
# Projects or Products that use Sigma
* [Augmentd](https://augmentd.co/)
* [MISP](http://www.misp-project.org/2017/03/26/MISP.2.4.70.released.html) (since version 2.4.70, March 2017)
* [TA-Sigma-Searches](https://github.com/dstaulcu/TA-Sigma-Searches) (Splunk App)
# Credits
This is a private project mainly developed by Florian Roth and Thomas Patzke with feedback from many fellow analysts and friends. Rules are our own or have been drived from blog posts, tweets or other public sources that are referenced in the rules.
Copyright for Tree Image: [studiobarcelona / 123RF Stock Photo](http://www.123rf.com/profile_studiobarcelona)
* [SOC Prime - Sigma Rule Editor](https://tdm.socprime.com/sigma/)
* [ypsilon](https://github.com/P4T12ICK/ypsilon) - Automated Use Case Testing
* [uncoder.io](https://uncoder.io/) - Online Translator for SIEM Searches
* [SPARK](https://www.nextron-systems.com/2018/06/28/spark-applies-sigma-rules-in-eventlog-scan/) - Scan with Sigma rules on endpoints
* [RANK VASA](https://globenewswire.com/news-release/2019/03/04/1745907/0/en/RANK-Software-to-Help-MSSPs-Scale-Cybersecurity-Offerings.html)
# Licenses
@@ -140,3 +284,11 @@ The content of this repository is released under the following licenses:
* The toolchain (everything under `tools/`) is licensed under the [GNU Lesser General Public License](https://www.gnu.org/licenses/lgpl-3.0.en.html).
* The [Sigma specification](https://github.com/Neo23x0/sigma/wiki) is public domain.
* Everything else, especially the rules contained in the `rules/` directory is released under the [GNU General Public License](https://www.gnu.org/licenses/gpl-3.0.en.html).
# Credits
This is a private project mainly developed by Florian Roth and Thomas Patzke with feedback from many fellow analysts and friends. Rules are our own or have been drived from blog posts, tweets or other public sources that are referenced in the rules.
# Info Graphic
![sigmac_info_graphic](./images/sigma_infographic_lq.png)
contrib/sigma2elastalert.py
Executable
+173
View File
@@ -0,0 +1,173 @@
#!/usr/bin/python
# Copyright 2018 David Routin
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Lesser General Public License for more details.
# You should have received a copy of the GNU Lesser General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
"""
Project: sigma2elastalert.py
Date: 25 Feb 2018
Author: David ROUTIN (@Rewt_1)
Version: 1.0
Description: This script creates elastalert configuration files from Sigma SIEM rules.
"""
import re
import os
import glob
import subprocess
import argparse
import yaml
import traceback
parser = argparse.ArgumentParser()
parser.add_argument("--eshost", help="Elasticsearch host", type=str, required=True)
parser.add_argument("--esport", help="Elasticsearch port", type=str, required=True)
parser.add_argument("--ruledir", help="sigma rule directory path to convert", type=str, required=True)
parser.add_argument("--index", help="Elasticsearch index name egs: \"winlogbeat-*\"", type=str, required=True)
parser.add_argument("--email", help="email address to send mail alert", type=str, required=True)
parser.add_argument("--outdir", help="output directory to create elastalert rules", type=str, required=True)
parser.add_argument("--sigmac", help="Sigmac location", default="../tools/sigmac", type=str)
parser.add_argument("--realerttime", help="Realert time (optional value, default 5 minutes)", type=str, default=5)
parser.add_argument("--debug", help="Show debug output", type=bool, default=False)
args = parser.parse_args()
custom_query_keys = ["sensor", "Hostname", "EventID", "src_ip", "dst_ip"]
template="""es_host: ESHOST
es_port: ESPORT
name: "TITLE"
description: "DESCRIPTION"
index: INDEX
filter:
- query:
query_string:
query: 'QUERY'
realert:
minutes: MINUTES
query_key: UNIQKEYS
type: any
include: UNIQKEYS
alert:
- "email"
# (required, email specific)
# a list of email addresses to send alerts to
email:
- "EMAIL"
"""
def return_json_obj(x,custom_query_keys):
"""
Function used to filter all ES query object as unique value including predefined list from custom_query_keys
:param x: must contains ES query output
:param custom_query_keys: takes the list of predefined element to match in document
:return: a clean list (set) of all the query keys (EventID,TargetUserName...)
"""
# type: (str, list) -> list
y = x.replace(" ", "\n").split()
out = set()
for i in y:
out.update(re.findall("([a-zA-Z]+)\:", i))
for qk in custom_query_keys:
try:
out.remove(qk)
except:
pass
out = list(out)
count = 0
for qk in custom_query_keys:
count += 1
out.insert(count-1, qk)
return out
def rule_element(file_content, elements):
"""
Function used to get specific element from yaml document and return content
:type file_content: str
:type elements: list
:param file_content:
:param elements: list of elements of the yaml document to get "title", "description"
:return: the value of the key in the yaml document
"""
try:
yaml.safe_load(file_content.replace("---",""))
except:
raise Exception('Unsupported')
element_output = ""
for e in elements:
try:
element_output = yaml.safe_load(file_content.replace("---",""))[e]
except:
pass
if element_output is None:
return ""
return element_output
def get_rule_as_esqs(file):
"""
Function used to get Elastic query output from rule fome
:type file: str
:param file: rule filename
:return: string es query
"""
if not os.path.exists(args.sigmac):
print("Cannot find sigmac rule coverter at '%s', please set a correct location via '--sigmac'")
cmd = [args.sigmac, file, "--target", "es-qs"]
output = subprocess.Popen(cmd,stdout=subprocess.PIPE, stderr=subprocess.STDOUT).stdout.read()
if "unsupported" in output:
raise Exception('Unsupported output at this time')
output = output.split("\n")
# Remove empty string from \n
output = [a for a in output if a]
# Handle case of multiple queries returned
if len(output) > 1:
return " OR ".join(output)
return "".join(output)
# Dictionary that contains args set at launch time
convert_args = {
"ESHOST": args.eshost,
"ESPORT": args.esport,
"INDEX": args.index,
"EMAIL": args.email,
"MINUTES": args.realerttime
}
for file in glob.glob(args.ruledir + "/*"):
output_elast_config = template
try:
print("Processing %s ..." % file)
with open(file, "rb") as f:
file_content = f.read()
# Dictionary that contains args with values returned by functions
translate_func = {'QUERY': get_rule_as_esqs(file),
'TITLE': rule_element(file_content, ["title", "name"]),
'DESCRIPTION': rule_element(file_content, ["description"]),
'UNIQKEYS': str(return_json_obj(get_rule_as_esqs(file), custom_query_keys))
}
for entry in convert_args:
output_elast_config = re.sub(entry, str(convert_args[entry]), output_elast_config)
for entry in translate_func:
output_elast_config = re.sub(entry, translate_func[entry], output_elast_config)
print("Converting file " + file)
with open(os.path.join(args.outdir, "sigma-" + file.split("/")[-1]), "w") as f:
f.write(output_elast_config)
except Exception as e:
if args.debug:
traceback.print_exc()
print("error " + str(file) + "----" + str(e))
pass
contrib/sigma2sumologic.py
+261
View File
@@ -0,0 +1,261 @@
#!/usr/bin/python
# Copyright 2018 juju4
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Lesser General Public License for more details.
# You should have received a copy of the GNU Lesser General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
"""
Project: sigma2sumologic.py
Date: 11 Jan 2019
Author: juju4
Version: 1.0
Description: This script executes sumologic search queries from Sigma SIEM rules.
Workflow:
1. Convert rules with sigmac
2. Enrich: add ignore+local custom rules, priority
3. Format
4. Get results and save to txt/xlsx files
Requirements:
$ pip install sumologic-sdk pyyaml pandas openpyxl
"""
import re
import os
import sys
import stat
import glob
import subprocess
import argparse
import yaml
import traceback
import logging
from sumologic import SumoLogic
import time
import datetime
import json
import pandas
logging.basicConfig(level=logging.DEBUG)
logger = logging.getLogger(__name__)
formatter = logging.Formatter('%(asctime)s - %(name)s - p%(process)s {%(pathname)s:%(lineno)d} - %(levelname)s - %(message)s')
handler = logging.FileHandler('sigma2sumo.log')
handler.setFormatter(formatter)
logger.addHandler(handler)
parser = argparse.ArgumentParser(description='Execute sigma rules in sumologic')
parser.add_argument("--conf", help="script yaml config file", type=str, required=True)
parser.add_argument("--accessid", help="Sumologic Access ID", type=str, required=False)
parser.add_argument("--accesskey", help="Sumologic Access Key", type=str, required=False)
parser.add_argument("--endpoint", help="Sumologic url endpoint", type=str, required=False)
parser.add_argument("--ruledir", help="sigma rule directory path to convert", type=str, required=False)
parser.add_argument("--outdir", help="output directory to create rules", type=str, required=False)
parser.add_argument("--sigmac", help="Sigmac location", default="../tools/sigmac", type=str)
parser.add_argument("--realerttime", help="Realert time (optional value, default 5 minutes)", type=str, default=5)
parser.add_argument("--debug", help="Show debug output", type=bool, default=False)
args = parser.parse_args()
LIMIT = 100
delay = 5
def rule_element(file_content, elements):
"""
Function used to get specific element from yaml document and return content
:type file_content: str
:type elements: list
:param file_content:
:param elements: list of elements of the yaml document to get "title", "description"
:return: the value of the key in the yaml document
"""
try:
logger.debug("file_content: %s" % file_content)
yaml.safe_load(file_content.replace("---", ""))
except TypeError:
raise Exception('Unsupported')
element_output = ""
for e in elements:
try:
element_output = yaml.safe_load(file_content.replace("---", ""))[e]
except TypeError:
pass
if element_output is None:
return ""
return element_output
def get_rule_as_sumologic(file):
"""
Function used to get sumologic query output from rule file
:type file: str
:param file: rule filename
:return: string query
"""
if not os.path.exists(args.sigmac):
logger.error("Cannot find sigmac rule coverter at '%s', please set a correct location via '--sigmac'")
cmd = [args.sigmac, file, "--target", "sumologic"]
logger.info('get_rule_as_sumologic cmd: %s' % cmd)
process = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
output, err = process.communicate()
# output is byte-string...
output = output.decode("utf-8")
err = err.decode("utf-8")
logger.info('get_rule_as_sumologic output: %s' % output)
logger.info('get_rule_as_sumologic stderr: %s' % err)
if err or "unsupported" in err:
logger.error('Unsupported output at this time')
raise Exception('Unsupported output at this time')
output = output.split("\n")
# Remove empty string from \n
output = [a for a in output if a]
# Handle case of multiple queries returned
if len(output) > 1:
return " OR ".join(output)
return "".join(output)
if args.help:
parser_print_help()
if args.conf:
with open(args.conf, 'r') as ymlfile:
cfg = yaml.load(ymlfile)
args.accessid = cfg['accessid']
args.accesskey = cfg['accesskey']
args.endpoint = cfg['endpoint']
args.ruledir = cfg['ruledir']
args.outdir = cfg['outdir']
args.sigmac = cfg['sigmac']
try:
args.recursive = cfg['recursive']
except TypeError:
args.recursive = False
if args.recursive:
globpath = args.ruledir + "/**/*.yml"
else:
globpath = args.ruledir + "/*.yml"
logger.debug("args: %s" % args)
logger.debug("globpath: %s" % globpath)
if args.outdir and not os.path.isdir(args.outdir):
os.mkdir(args.outdir, stat.S_IRWXU)
# non-recursive (above, not working...)
# for file in glob.iglob(args.ruledir + "/*.yml"):
# recursive
for file in glob.iglob(globpath, recursive=True):
file_basename = os.path.basename(os.path.splitext(file)[0])
file_basenamepath = os.path.splitext(file)[0]
file_ext = os.path.splitext(file)[1]
try:
if file_ext != '.yml':
continue
logger.info("Processing %s ..." % file_basename)
with open(file, "rb") as f:
file_content = f.read()
logger.info("Rule file: %s" % file)
sumo_query = get_rule_as_sumologic(file)
logger.info(" Checking if custom query file: %s" % file_basenamepath + '.custom')
if os.path.isfile(file_basenamepath + '.custom'):
# FIXME! want to add something in the middle for parsing for example...
logger.info(" Adding custom part to end query from: %s" % file_basenamepath + '.custom')
with open(file_basenamepath + '.custom', "rb") as f:
# FIXME ! manage pipe inside queries
if "| count" in sumo_query:
pos = sumo_query.find('| count')
sumo_query = sumo_query[:pos] + f.read().decode('utf-8') + sumo_query[pos:]
else:
sumo_query += " " + f.read().decode('utf-8')
elif 'count ' not in sumo_query and ('EventID=' in sumo_query):
sumo_query += " | count _sourceCategory, hostname, EventID, msg_summary, _raw"
elif 'count ' not in sumo_query:
sumo_query += " | count _sourceCategory, hostname, _raw"
logger.debug("Final sumo query: %s" % sumo_query)
except Exception as e:
if args.debug:
traceback.print_exc()
logger.exception("error generating sumo query " + str(file) + "----" + str(e))
with open(os.path.join(args.outdir, "sigma-" + file_basename + '-error-generation.txt'), "w") as f:
# f.write(json.dumps(r, indent=4, sort_keys=True) + " ERROR: %s\n\nQUERY: %s" % (e, sumo_query))
f.write(" ERROR for file: %s\n\Exception:\n %s" % (file, e))
continue
try:
# Run query
# https://github.com/SumoLogic/sumologic-python-sdk/blob/master/scripts/search-job.py
sumo = SumoLogic(args.accessid, args.accesskey, args.endpoint)
toTime = datetime.datetime.now().strftime("%Y-%m-%dT%H:%M:%S")
fromTime = datetime.datetime.strptime(toTime, "%Y-%m-%dT%H:%M:%S") - datetime.timedelta(hours=24)
fromTime = fromTime.strftime("%Y-%m-%dT%H:%M:%S")
timeZone = 'UTC'
byReceiptTime = True
sj = sumo.search_job(sumo_query, fromTime, toTime, timeZone, byReceiptTime)
status = sumo.search_job_status(sj)
while status['state'] != 'DONE GATHERING RESULTS':
if status['state'] == 'CANCELLED':
break
time.sleep(delay)
status = sumo.search_job_status(sj)
except Exception as e:
if args.debug:
traceback.print_exc()
logger.exception("error seaching sumo " + str(file) + "----" + str(e))
with open(os.path.join(args.outdir, "sigma-" + file_basename + '-error.txt'), "w") as f:
# f.write(json.dumps(r, indent=4, sort_keys=True) + " ERROR: %s\n\nQUERY: %s" % (e, sumo_query))
f.write(" ERROR: %s\n\nQUERY: %s" % (e, sumo_query))
pass
logger.debug("Sumo search job status: %s" % status['state'])
try:
if status['state'] == 'DONE GATHERING RESULTS':
count = status['recordCount']
# compensate bad limit check
limit = count if count < LIMIT and count != 0 else LIMIT
r = sumo.search_job_records(sj, limit=limit)
logger.debug("Sumo search results: %s" % r)
logger.debug("Saving final sumo query for %s to %s" % (file, os.path.join(args.outdir, "sigma-" + file_basename + '.sumo')))
with open(os.path.join(args.outdir, "sigma-" + file_basename + '.sumo'), "w") as f:
f.write(sumo_query)
if r and r['records'] != []:
logger.info("Saving results")
# as json text file
with open(os.path.join(args.outdir, "sigma-" + file_basename + '.txt'), "w") as f:
f.write(json.dumps(r, indent=4, sort_keys=True))
# as excel file
df = pandas.io.json.json_normalize(r['records'])
with pandas.ExcelWriter(os.path.join(args.outdir, "sigma-" + file_basename + ".xlsx")) as writer:
df.to_excel(writer, 'data')
pandas.DataFrame({'References': [
"timeframe: from %s to %s" % (fromTime, toTime),
"Sumo endpoint: %s" % args.endpoint,
"Sumo query: %s" % sumo_query
]}).to_excel(writer, 'comments')
# and do whatever you want, email alert, report, ticket...
except Exception as e:
if args.debug:
traceback.print_exc()
logger.exception("error saving results " + str(file) + "----" + str(e))
pass
images/Sigmac-win_susp_rc4_kerberos.png
BIN
View File
Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 95 KiB

After

Width:  |  Height:  |  Size: 43 KiB

images/sigma_infographic_hq.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.8 MiB

images/sigma_infographic_lq.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 870 KiB

other/sigma_attack_nav_coverage.json
+2653
View File
@@ -0,0 +1,2653 @@
{
"name": "SIGMA Rule Coverage",
"version": "2.1",
"domain": "mitre-enterprise",
"description": "Accurate to commit #: 81693d81b6823bb5f064919453eac70c1d097d3e\nhttps://github.com/Neo23x0/sigma/commit/81693d81b6823bb5f064919453eac70c1d097d3e",
"filters": {
"stages": [
"act"
],
"platforms": [
"windows",
"linux",
"mac"
]
},
"sorting": 0,
"viewMode": 0,
"hideDisabled": false,
"techniques": [
{
"techniqueID": "T1156",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1134",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1134",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1015",
"tactic": "persistence",
"score": 1,
"color": "",
"comment": "sysmon_stickykey_like_backdoor.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1015",
"tactic": "privilege-escalation",
"score": 1,
"color": "",
"comment": "sysmon_stickykey_like_backdoor.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1087",
"tactic": "discovery",
"score": 5,
"color": "",
"comment": "win_account_discovery.yml\nwin_alert_hacktool_use.yml\nwin_susp_net_recon_activity.yml\nwin_susp_commands_recon_activity.yml\nwin_susp_recon_activity.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1098",
"tactic": "credential-access",
"score": 3,
"color": "",
"comment": "apt_judgement_panda_gtr19.yml\nwin_alert_ad_user_backdoors.yml\nwin_susp_dsrm_password_change.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1098",
"tactic": "persistence",
"score": 3,
"color": "",
"comment": "apt_judgement_panda_gtr19.yml\nwin_alert_ad_user_backdoors.yml\nwin_susp_dsrm_password_change.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1182",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1182",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1103",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1103",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1155",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1155",
"tactic": "lateral-movement",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1017",
"tactic": "lateral-movement",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1138",
"tactic": "persistence",
"score": 1,
"color": "",
"comment": "win_sdbinst_shim_persistence.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1138",
"tactic": "privilege-escalation",
"score": 1,
"color": "",
"comment": "win_sdbinst_shim_persistence.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1010",
"tactic": "discovery",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1123",
"tactic": "collection",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1131",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1119",
"tactic": "collection",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1020",
"tactic": "exfiltration",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1197",
"tactic": "defense-evasion",
"score": 1,
"color": "",
"comment": "win_process_creation_bitsadmin_download.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1197",
"tactic": "persistence",
"score": 1,
"color": "",
"comment": "win_process_creation_bitsadmin_download.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1139",
"tactic": "credential-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1009",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1067",
"tactic": "persistence",
"score": 1,
"color": "",
"comment": "win_susp_bcdedit.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1217",
"tactic": "discovery",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1176",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1110",
"tactic": "credential-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1088",
"tactic": "defense-evasion",
"score": 3,
"color": "",
"comment": "win_cmstp_com_object_access.yml\nsysmon_uac_bypass_eventvwr.yml\nsysmon_uac_bypass_sdclt.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1088",
"tactic": "privilege-escalation",
"score": 3,
"color": "",
"comment": "win_cmstp_com_object_access.yml\nsysmon_uac_bypass_eventvwr.yml\nsysmon_uac_bypass_sdclt.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1191",
"tactic": "defense-evasion",
"score": 2,
"color": "",
"comment": "win_cmstp_com_object_access.yml\nsysmon_cmstp_execution.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1191",
"tactic": "execution",
"score": 2,
"color": "",
"comment": "win_cmstp_com_object_access.yml\nsysmon_cmstp_execution.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1042",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1146",
"tactic": "defense-evasion",
"score": 1,
"color": "",
"comment": "lnx_shell_clear_cmd_history.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1115",
"tactic": "collection",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1116",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1059",
"tactic": "execution",
"score": 12,
"color": "",
"comment": "apt_babyshark.yml\napt_equationgroup_dll_u_load.yml\napt_equationgroup_lnx.yml\napt_sofacy.yml\napt_sofacy_zebrocy.yml\napt_turla_commands.yml\napt_zxshell.yml\ncrime_fireball.yml\nwin_alert_hacktool_use.yml\nwin_office_shell.yml\nwin_susp_cmd_http_appdata.yml\nwin_susp_outlook.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1043",
"tactic": "command-and-control",
"score": 1,
"color": "",
"comment": "sysmon_malware_backconnect_ports.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1092",
"tactic": "command-and-control",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1223",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1223",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1109",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1109",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1122",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1122",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1090",
"tactic": "command-and-control",
"score": 2,
"color": "",
"comment": "win_netsh_fw_add.yml\nwin_netsh_port_fwd.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1196",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1196",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1136",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1003",
"tactic": "credential-access",
"score": 23,
"color": "",
"comment": "apt_bear_activity_gtr19.yml\nwin_alert_lsass_access.yml\nwin_alert_mimikatz_keywords.yml\nwin_dcsync.yml\nwin_impacket_secretdump.yml\nwin_mal_creddumper.yml\nwin_mal_wceaux_dll.yml\nwin_susp_lsass_dump.yml\nwin_susp_sam_dump.yml\nav_password_dumper.yml\nwin_cmdkey_recon.yml\nwin_hack_rubeus.yml\nwin_malware_notpetya.yml\nwin_susp_ntdsutil.yml\nwin_susp_procdump.yml\nwin_susp_sysvol_access.yml\nwin_susp_vssadmin_ntds_activity.yml\nsysmon_ghostpack_safetykatz.yml\nsysmon_lsass_memdump.yml\nsysmon_mimikatz_detection_lsass.yml\nsysmon_mimikatz_inmemory_detection.yml\nsysmon_password_dumper_lsass.yml\nsysmon_quarkspw_filedump.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1081",
"tactic": "credential-access",
"score": 1,
"color": "",
"comment": "apt_bear_activity_gtr19.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1214",
"tactic": "credential-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1094",
"tactic": "command-and-control",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1024",
"tactic": "command-and-control",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1207",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1038",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1038",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1038",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1073",
"tactic": "defense-evasion",
"score": 9,
"color": "",
"comment": "win_susp_dhcp_config.yml\nwin_susp_dhcp_config_failed.yml\nwin_susp_dns_config.yml\nwin_plugx_susp_exe_locations.yml\nwin_susp_control_dll_load.yml\nwin_susp_gup.yml\nsysmon_dhcp_calloutdll.yml\nsysmon_dns_serverlevelplugindll.yml\nsysmon_susp_image_load.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1002",
"tactic": "exfiltration",
"score": 1,
"color": "",
"comment": "apt_judgement_panda_gtr19.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1132",
"tactic": "command-and-control",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1022",
"tactic": "exfiltration",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1001",
"tactic": "command-and-control",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1074",
"tactic": "collection",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1030",
"tactic": "exfiltration",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1213",
"tactic": "collection",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1005",
"tactic": "collection",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1039",
"tactic": "collection",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1025",
"tactic": "collection",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1140",
"tactic": "defense-evasion",
"score": 4,
"color": "",
"comment": "win_susp_mshta_execution.yml\nwin_susp_certutil_command.yml\nwin_susp_cli_escape.yml\nwin_susp_ping_hex_ip.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1089",
"tactic": "defense-evasion",
"score": 2,
"color": "",
"comment": "win_alert_enable_weak_encryption.yml\nwin_susp_msmpeng_crash.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1175",
"tactic": "lateral-movement",
"score": 1,
"color": "",
"comment": "win_susp_mmc_source.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1172",
"tactic": "command-and-control",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1189",
"tactic": "initial-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1157",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1157",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1173",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1114",
"tactic": "collection",
"score": 1,
"color": "",
"comment": "win_alert_hacktool_use.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1106",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1129",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1048",
"tactic": "exfiltration",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1041",
"tactic": "exfiltration",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1011",
"tactic": "exfiltration",
"score": 1,
"color": "",
"comment": "sysmon_ssp_added_lsa_config.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1052",
"tactic": "exfiltration",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1190",
"tactic": "initial-access",
"score": 1,
"color": "",
"comment": "web_cve_2018_2894_weblogic_exploit.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1203",
"tactic": "execution",
"score": 2,
"color": "",
"comment": "av_exploiting.yml\nwin_exploit_cve_2017_8759.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1212",
"tactic": "credential-access",
"score": 3,
"color": "",
"comment": "win_net_ntlm_downgrade.yml\nwin_susp_kerberos_manipulation.yml\nwin_susp_samr_pwset.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1211",
"tactic": "defense-evasion",
"score": 2,
"color": "",
"comment": "win_susp_msmpeng_crash.yml\nwin_exploit_cve_2017_11882.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1068",
"tactic": "privilege-escalation",
"score": 1,
"color": "",
"comment": "apt_hurricane_panda.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1210",
"tactic": "lateral-movement",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1133",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1181",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1181",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1008",
"tactic": "command-and-control",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1107",
"tactic": "defense-evasion",
"score": 2,
"color": "",
"comment": "win_susp_backup_delete.yml\nwin_susp_sdelete.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1222",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1006",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1044",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1044",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1083",
"tactic": "discovery",
"score": 1,
"color": "",
"comment": "apt_turla_commands.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1187",
"tactic": "credential-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1144",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1061",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1148",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1200",
"tactic": "initial-access",
"score": 1,
"color": "",
"comment": "win_usb_device_plugged.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1158",
"tactic": "defense-evasion",
"score": 1,
"color": "",
"comment": "win_attrib_hiding_files.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1158",
"tactic": "persistence",
"score": 1,
"color": "",
"comment": "win_attrib_hiding_files.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1147",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1143",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1179",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1179",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1179",
"tactic": "credential-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1062",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1183",
"tactic": "privilege-escalation",
"score": 1,
"color": "",
"comment": "sysmon_win_reg_persistence.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1183",
"tactic": "persistence",
"score": 1,
"color": "",
"comment": "sysmon_win_reg_persistence.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1183",
"tactic": "defense-evasion",
"score": 1,
"color": "",
"comment": "sysmon_win_reg_persistence.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1054",
"tactic": "defense-evasion",
"score": 1,
"color": "",
"comment": "win_disable_event_logging.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1066",
"tactic": "defense-evasion",
"score": 1,
"color": "",
"comment": "win_susp_sdelete.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1070",
"tactic": "defense-evasion",
"score": 4,
"color": "",
"comment": "win_susp_eventlog_cleared.yml\nwin_susp_security_eventlog_cleared.yml\nwin_malware_notpetya.yml\nwin_susp_bcdedit.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1202",
"tactic": "defense-evasion",
"score": 2,
"color": "",
"comment": "win_office_shell.yml\nwin_susp_outlook.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1056",
"tactic": "collection",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1056",
"tactic": "credential-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1141",
"tactic": "credential-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1130",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1118",
"tactic": "defense-evasion",
"score": 1,
"color": "",
"comment": "win_possible_applocker_bypass.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1118",
"tactic": "execution",
"score": 1,
"color": "",
"comment": "win_possible_applocker_bypass.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1208",
"tactic": "credential-access",
"score": 2,
"color": "",
"comment": "win_susp_rc4_kerberos.yml\nwin_spn_enum.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1215",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1142",
"tactic": "credential-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1161",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1149",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1171",
"tactic": "credential-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1177",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1177",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1159",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1160",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1160",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1152",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1152",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1152",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1168",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1168",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1162",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1037",
"tactic": "lateral-movement",
"score": 1,
"color": "",
"comment": "sysmon_logon_scripts_userinitmprlogonscript.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1037",
"tactic": "persistence",
"score": 1,
"color": "",
"comment": "sysmon_logon_scripts_userinitmprlogonscript.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1185",
"tactic": "collection",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1036",
"tactic": "defense-evasion",
"score": 14,
"color": "",
"comment": "apt_ta17_293a_ps.yml\nwin_exploit_cve_2015_1641.yml\nwin_powershell_b64_shellcode.yml\nwin_susp_calc.yml\nwin_susp_csc.yml\nwin_susp_execution_path.yml\nwin_susp_exec_folder.yml\nwin_susp_procdump.yml\nwin_susp_prog_location_process_starts.yml\nwin_susp_run_locations.yml\nwin_susp_svchost.yml\nwin_susp_taskmgr_localsystem.yml\nwin_susp_taskmgr_parent.yml\nwin_system_exe_anomaly.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1031",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1112",
"tactic": "defense-evasion",
"score": 3,
"color": "",
"comment": "apt_chafer_mar18.yml\nwin_mal_ursnif.yml\nsysmon_dhcp_calloutdll.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1170",
"tactic": "defense-evasion",
"score": 4,
"color": "",
"comment": "apt_babyshark.yml\nwin_lethalhta.yml\nwin_mshta_spawn_shell.yml\nwin_possible_applocker_bypass.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1170",
"tactic": "execution",
"score": 4,
"color": "",
"comment": "apt_babyshark.yml\nwin_lethalhta.yml\nwin_mshta_spawn_shell.yml\nwin_possible_applocker_bypass.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1104",
"tactic": "command-and-control",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1188",
"tactic": "command-and-control",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1026",
"tactic": "command-and-control",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1079",
"tactic": "command-and-control",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1096",
"tactic": "defense-evasion",
"score": 1,
"color": "",
"comment": "powershell_ntfs_ads_access.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1128",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1046",
"tactic": "discovery",
"score": 1,
"color": "",
"comment": "win_vul_java_remote_debugging.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1126",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1135",
"tactic": "discovery",
"score": 1,
"color": "",
"comment": "apt_turla_commands.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1040",
"tactic": "credential-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1040",
"tactic": "discovery",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1050",
"tactic": "persistence",
"score": 7,
"color": "",
"comment": "apt_apt29_tor.yml\napt_carbonpaper_turla.yml\napt_stonedrill.yml\napt_turla_service_png.yml\nwin_mal_service_installs.yml\nwin_rare_service_installs.yml\nsysmon_susp_driver_load.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1050",
"tactic": "privilege-escalation",
"score": 7,
"color": "",
"comment": "apt_apt29_tor.yml\napt_carbonpaper_turla.yml\napt_stonedrill.yml\napt_turla_service_png.yml\nwin_mal_service_installs.yml\nwin_rare_service_installs.yml\nsysmon_susp_driver_load.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1027",
"tactic": "defense-evasion",
"score": 2,
"color": "",
"comment": "win_susp_ping_hex_ip.yml\nsysmon_ads_executable.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1137",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1075",
"tactic": "lateral-movement",
"score": 4,
"color": "",
"comment": "win_alert_hacktool_use.yml\nwin_overpass_the_hash.yml\nwin_pass_the_hash.yml\nwin_susp_ntlm_auth.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1097",
"tactic": "lateral-movement",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1174",
"tactic": "credential-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1201",
"tactic": "discovery",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1034",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1034",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1120",
"tactic": "discovery",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1069",
"tactic": "discovery",
"score": 1,
"color": "",
"comment": "win_susp_net_recon_activity.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1150",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1150",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1150",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1205",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1205",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1205",
"tactic": "command-and-control",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1013",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1013",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1086",
"tactic": "execution",
"score": 28,
"color": "",
"comment": "apt_apt29_thinktanks.yml\napt_babyshark.yml\napt_empiremonkey.yml\npowershell_downgrade_attack.yml\npowershell_exe_calling_ps.yml\npowershell_malicious_commandlets.yml\npowershell_malicious_keywords.yml\npowershell_prompt_credentials.yml\npowershell_psattack.yml\npowershell_shellcode_b64.yml\npowershell_suspicious_download.yml\npowershell_suspicious_invocation_generic.yml\npowershell_suspicious_invocation_specific.yml\npowershell_suspicious_keywords.yml\npowershell_xor_commandline.yml\nwin_powershell_amsi_bypass.yml\nwin_powershell_dll_execution.yml\nwin_powershell_download.yml\nwin_powershell_renamed_ps.yml\nwin_powershell_suspicious_parameter_variation.yml\nwin_susp_powershell_enc_cmd.yml\nwin_susp_powershell_hidden_b64_cmd.yml\nwin_susp_powershell_parent_combo.yml\nwin_susp_ps_appdata.yml\nsysmon_powershell_exploit_scripts.yml\nsysmon_powershell_network_connection.yml\nsysmon_powersploit_schtasks.yml\nsysmon_susp_powershell_rundll32.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1145",
"tactic": "credential-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1057",
"tactic": "discovery",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1186",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1093",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1055",
"tactic": "defense-evasion",
"score": 8,
"color": "",
"comment": "powershell_shellcode_b64.yml\nwin_exploit_cve_2017_0261.yml\nwin_malware_dridex.yml\nwin_mavinject_proc_inj.yml\nsysmon_cactustorch.yml\nsysmon_cobaltstrike_process_injection.yml\nsysmon_malware_verclsid_shellcode.yml\nsysmon_mal_namedpipes.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1055",
"tactic": "privilege-escalation",
"score": 8,
"color": "",
"comment": "powershell_shellcode_b64.yml\nwin_exploit_cve_2017_0261.yml\nwin_malware_dridex.yml\nwin_mavinject_proc_inj.yml\nsysmon_cactustorch.yml\nsysmon_cobaltstrike_process_injection.yml\nsysmon_malware_verclsid_shellcode.yml\nsysmon_mal_namedpipes.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1012",
"tactic": "discovery",
"score": 1,
"color": "",
"comment": "apt_babyshark.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1163",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1164",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1108",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1108",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1060",
"tactic": "persistence",
"score": 2,
"color": "",
"comment": "sysmon_susp_reg_persist_explorer_run.yml\nsysmon_susp_run_key_img_folder.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1121",
"tactic": "defense-evasion",
"score": 1,
"color": "",
"comment": "win_possible_applocker_bypass.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1121",
"tactic": "execution",
"score": 1,
"color": "",
"comment": "win_possible_applocker_bypass.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1117",
"tactic": "defense-evasion",
"score": 1,
"color": "",
"comment": "win_susp_regsvr32_anomalies.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1117",
"tactic": "execution",
"score": 1,
"color": "",
"comment": "win_susp_regsvr32_anomalies.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1219",
"tactic": "command-and-control",
"score": 2,
"color": "",
"comment": "av_exploiting.yml\nwin_susp_tscon_localsystem.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1076",
"tactic": "lateral-movement",
"score": 4,
"color": "",
"comment": "win_rdp_localhost_login.yml\nwin_rdp_reverse_tunnel.yml\nwin_susp_tscon_rdp_redirect.yml\nsysmon_rdp_reverse_tunnel.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1105",
"tactic": "command-and-control",
"score": 4,
"color": "",
"comment": "apt_pandemic.yml\nwin_susp_certutil_command.yml\nsysmon_win_binary_github_com.yml\nsysmon_win_binary_susp_com.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1105",
"tactic": "lateral-movement",
"score": 4,
"color": "",
"comment": "apt_pandemic.yml\nwin_susp_certutil_command.yml\nsysmon_win_binary_github_com.yml\nsysmon_win_binary_susp_com.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1021",
"tactic": "lateral-movement",
"score": 1,
"color": "",
"comment": "win_netsh_port_fwd_3389.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1018",
"tactic": "discovery",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1091",
"tactic": "lateral-movement",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1091",
"tactic": "initial-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1014",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1085",
"tactic": "defense-evasion",
"score": 11,
"color": "",
"comment": "apt_equationgroup_dll_u_load.yml\napt_sofacy.yml\napt_tropictrooper.yml\napt_unidentified_nov_18.yml\napt_zxshell.yml\ncrime_fireball.yml\nwin_malware_notpetya.yml\nwin_susp_control_dll_load.yml\nwin_susp_rundll32_activity.yml\nsysmon_rundll32_net_connections.yml\nsysmon_susp_powershell_rundll32.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1085",
"tactic": "execution",
"score": 11,
"color": "",
"comment": "apt_equationgroup_dll_u_load.yml\napt_sofacy.yml\napt_tropictrooper.yml\napt_unidentified_nov_18.yml\napt_zxshell.yml\ncrime_fireball.yml\nwin_malware_notpetya.yml\nwin_susp_control_dll_load.yml\nwin_susp_rundll32_activity.yml\nsysmon_rundll32_net_connections.yml\nsysmon_susp_powershell_rundll32.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1178",
"tactic": "privilege-escalation",
"score": 1,
"color": "",
"comment": "win_susp_add_sid_history.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1198",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1198",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1184",
"tactic": "lateral-movement",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1053",
"tactic": "execution",
"score": 8,
"color": "",
"comment": "apt_chafer_mar18.yml\napt_slingshot.yml\nwin_atsvc_task.yml\nwin_GPO_scheduledtasks.yml\nwin_rare_schtasks_creations.yml\nwin_rare_schtask_creation.yml\nwin_susp_schtask_creation.yml\nsysmon_powersploit_schtasks.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1053",
"tactic": "persistence",
"score": 8,
"color": "",
"comment": "apt_chafer_mar18.yml\napt_slingshot.yml\nwin_atsvc_task.yml\nwin_GPO_scheduledtasks.yml\nwin_rare_schtasks_creations.yml\nwin_rare_schtask_creation.yml\nwin_susp_schtask_creation.yml\nsysmon_powersploit_schtasks.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1053",
"tactic": "privilege-escalation",
"score": 8,
"color": "",
"comment": "apt_chafer_mar18.yml\napt_slingshot.yml\nwin_atsvc_task.yml\nwin_GPO_scheduledtasks.yml\nwin_rare_schtasks_creations.yml\nwin_rare_schtask_creation.yml\nwin_susp_schtask_creation.yml\nsysmon_powersploit_schtasks.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1029",
"tactic": "exfiltration",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1113",
"tactic": "collection",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1180",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1064",
"tactic": "defense-evasion",
"score": 10,
"color": "",
"comment": "apt_cloudhopper.yml\nwin_malware_script_dropper.yml\nwin_mal_adwind.yml\nwin_mal_lockergoga.yml\nwin_shell_spawn_susp_program.yml\nwin_susp_rasdial_activity.yml\nwin_susp_script_execution.yml\nwin_wmi_spwns_powershell.yml\nsysmon_cactustorch.yml\nsysmon_susp_file_characteristics.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1064",
"tactic": "execution",
"score": 10,
"color": "",
"comment": "apt_cloudhopper.yml\nwin_malware_script_dropper.yml\nwin_mal_adwind.yml\nwin_mal_lockergoga.yml\nwin_shell_spawn_susp_program.yml\nwin_susp_rasdial_activity.yml\nwin_susp_script_execution.yml\nwin_wmi_spwns_powershell.yml\nsysmon_cactustorch.yml\nsysmon_susp_file_characteristics.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1063",
"tactic": "discovery",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1101",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1167",
"tactic": "credential-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1035",
"tactic": "execution",
"score": 3,
"color": "",
"comment": "win_hack_smbexec.yml\nwin_tool_psexec.yml\nwin_psexesvc_start.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1058",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1058",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1166",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1166",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1051",
"tactic": "lateral-movement",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1023",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1218",
"tactic": "defense-evasion",
"score": 1,
"color": "",
"comment": "win_mavinject_proc_inj.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1218",
"tactic": "execution",
"score": 1,
"color": "",
"comment": "win_mavinject_proc_inj.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1216",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1216",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1045",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1153",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1151",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1151",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1193",
"tactic": "initial-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1192",
"tactic": "initial-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1194",
"tactic": "initial-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1071",
"tactic": "command-and-control",
"score": 1,
"color": "",
"comment": "net_susp_dns_txt_exec_strings.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1032",
"tactic": "command-and-control",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1095",
"tactic": "command-and-control",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1165",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1165",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1169",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1206",
"tactic": "privilege-escalation",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1195",
"tactic": "initial-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1019",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1082",
"tactic": "discovery",
"score": 1,
"color": "",
"comment": "win_susp_commands_recon_activity.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1016",
"tactic": "discovery",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1049",
"tactic": "discovery",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1033",
"tactic": "discovery",
"score": 1,
"color": "",
"comment": "win_susp_whoami.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1007",
"tactic": "discovery",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1124",
"tactic": "discovery",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1080",
"tactic": "lateral-movement",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1221",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1072",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1072",
"tactic": "lateral-movement",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1209",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1099",
"tactic": "defense-evasion",
"score": 1,
"color": "",
"comment": "win_susp_time_modification.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1154",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1154",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1127",
"tactic": "defense-evasion",
"score": 2,
"color": "",
"comment": "win_possible_applocker_bypass.yml\nwin_workflow_compiler.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1127",
"tactic": "execution",
"score": 2,
"color": "",
"comment": "win_possible_applocker_bypass.yml\nwin_workflow_compiler.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1199",
"tactic": "initial-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1111",
"tactic": "credential-access",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1065",
"tactic": "command-and-control",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1204",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1078",
"tactic": "defense-evasion",
"score": 6,
"color": "",
"comment": "win_admin_rdp_login.yml\nwin_alert_active_directory_user_control.yml\nwin_susp_failed_logons_single_source.yml\nwin_susp_failed_logon_reasons.yml\nwin_susp_interactive_logons.yml\nwin_user_added_to_local_administrators.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1078",
"tactic": "persistence",
"score": 6,
"color": "",
"comment": "win_admin_rdp_login.yml\nwin_alert_active_directory_user_control.yml\nwin_susp_failed_logons_single_source.yml\nwin_susp_failed_logon_reasons.yml\nwin_susp_interactive_logons.yml\nwin_user_added_to_local_administrators.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1078",
"tactic": "privilege-escalation",
"score": 6,
"color": "",
"comment": "win_admin_rdp_login.yml\nwin_alert_active_directory_user_control.yml\nwin_susp_failed_logons_single_source.yml\nwin_susp_failed_logon_reasons.yml\nwin_susp_interactive_logons.yml\nwin_user_added_to_local_administrators.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1078",
"tactic": "initial-access",
"score": 6,
"color": "",
"comment": "win_admin_rdp_login.yml\nwin_alert_active_directory_user_control.yml\nwin_susp_failed_logons_single_source.yml\nwin_susp_failed_logon_reasons.yml\nwin_susp_interactive_logons.yml\nwin_user_added_to_local_administrators.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1125",
"tactic": "collection",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1102",
"tactic": "command-and-control",
"score": 3,
"color": "",
"comment": "proxy_cobalt_amazon.yml\nproxy_cobalt_ocsp.yml\nproxy_cobalt_onedrive.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1102",
"tactic": "defense-evasion",
"score": 3,
"color": "",
"comment": "proxy_cobalt_amazon.yml\nproxy_cobalt_ocsp.yml\nproxy_cobalt_onedrive.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1100",
"tactic": "persistence",
"score": 6,
"color": "",
"comment": "web_cve_2018_2894_weblogic_exploit.yml\nav_webshell.yml\nwin_susp_execution_path_webserver.yml\nwin_susp_iss_module_install.yml\nwin_webshell_detection.yml\nwin_webshell_spawn.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1100",
"tactic": "privilege-escalation",
"score": 6,
"color": "",
"comment": "web_cve_2018_2894_weblogic_exploit.yml\nav_webshell.yml\nwin_susp_execution_path_webserver.yml\nwin_susp_iss_module_install.yml\nwin_webshell_detection.yml\nwin_webshell_spawn.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1077",
"tactic": "lateral-movement",
"score": 5,
"color": "",
"comment": "apt_turla_commands.yml\nwin_admin_share_access.yml\nwin_hack_smbexec.yml\nwin_lm_namedpipe.yml\nwin_susp_psexec.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1047",
"tactic": "execution",
"score": 4,
"color": "",
"comment": "win_wmi_persistence.yml\nwin_bypass_squiblytwo.yml\nwin_susp_wmi_execution.yml\nwin_wmi_persistence_script_event_consumer.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1084",
"tactic": "persistence",
"score": 3,
"color": "",
"comment": "sysmon_wmi_event_subscription.yml\nsysmon_wmi_persistence_commandline_event_consumer.yml\nsysmon_wmi_persistence_script_event_consumer_write.yml",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1028",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1028",
"tactic": "lateral-movement",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1004",
"tactic": "persistence",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1220",
"tactic": "defense-evasion",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
},
{
"techniqueID": "T1220",
"tactic": "execution",
"score": 0,
"color": "",
"comment": "",
"enabled": true,
"metadata": []
}
],
"gradient": {
"colors": [
"#ffffff",
"#66b1ff"
],
"minValue": 0,
"maxValue": 2
},
"legendItems": [],
"metadata": [],
"showTacticRowBackground": false,
"tacticRowBackground": "#dddddd",
"selectTechniquesAcrossTactics": true
}
other/sigma_attack_nav_coverage.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 373 KiB

rules/application/app_python_sql_exceptions.yml
+1 -1
View File
@@ -1,7 +1,7 @@
title: Python SQL Exceptions
description: Generic rule for SQL exceptions in Python according to PEP 249
author: Thomas Patzke
reference:
references:
- https://www.python.org/dev/peps/pep-0249/#exceptions
logsource:
category: application
rules/application/app_sqlinjection_errors.yml
+3 -2
View File
@@ -2,7 +2,8 @@ title: Suspicious SQL Error Messages
status: experimental
description: Detects SQL error messages that indicate probing for an injection attack
author: Bjoern Kimminich
reference: http://www.sqlinjection.net/errors
references:
- http://www.sqlinjection.net/errors
logsource:
category: application
product: sql
@@ -15,7 +16,7 @@ detection:
# SQL Server
- Unclosed quotation mark
# SQLite
- near "*": syntax error
- 'near "*": syntax error'
- SELECTs to the left and right of UNION do not have the same number of result columns
condition: keywords
falsepositives:
rules/application/appframework_django_exceptions.yml
+1 -1
View File
@@ -1,7 +1,7 @@
title: Django framework exceptions
description: Detects suspicious Django web application framework exceptions that could indicate exploitation attempts
author: Thomas Patzke
reference:
references:
- https://docs.djangoproject.com/en/1.11/ref/exceptions/
- https://docs.djangoproject.com/en/1.11/topics/logging/#django-security
logsource:
rules/application/appframework_ruby_on_rails_exceptions.yml
+1 -1
View File
@@ -1,7 +1,7 @@
title: Ruby on Rails framework exceptions
description: Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts
author: Thomas Patzke
reference:
references:
- http://edgeguides.rubyonrails.org/security.html
- http://guides.rubyonrails.org/action_controller_overview.html
- https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception
rules/application/appframework_spring_exceptions.yml
+1 -1
View File
@@ -1,7 +1,7 @@
title: Spring framework exceptions
description: Detects suspicious Spring framework exceptions that could indicate exploitation attempts
author: Thomas Patzke
reference:
references:
- https://docs.spring.io/spring-security/site/docs/current/apidocs/overview-tree.html
logsource:
category: application
rules/apt/apt_apt29_thinktanks.yml
+20
View File
@@ -0,0 +1,20 @@
title: APT29
description: 'This method detects a suspicious powershell command line combination as used by APT29 in a campaign against US think tanks'
references:
- https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/
tags:
- attack.execution
- attack.g0016
- attack.t1086
author: Florian Roth
date: 2018/12/04
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine: '*-noni -ep bypass $*'
condition: selection
falsepositives:
- unknown
level: critical
rules/apt/apt_apt29_tor.yml
Regular → Executable
+14 -13
View File
@@ -1,31 +1,32 @@
---
action: global
title: APT29 Google Update Service Install
description: 'This method detects malicious services mentioned in APT29 report by FireEye. The legitimate path for the Google update service is C:\Program Files (x86)\Google\Update\GoogleUpdate.exe so the service names and executable locations used by APT29 are specific enough to be detected in log files.'
reference: https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html
references:
- https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html
tags:
- attack.persistence
- attack.g0016
- attack.t1050
logsource:
product: windows
service: system
detection:
service:
service_install:
EventID: 7045
ServiceName: 'Google Update'
timeframe: 5m
condition: service | near process
condition: service_install | near process
falsepositives:
- Unknown
level: high
---
# Windows Audit Log
logsource:
category: process_creation
product: windows
detection:
process:
EventID: 4688
NewProcessName:
- 'C:\Program Files(x86)\Google\GoogleService.exe'
- 'C:\Program Files(x86)\Google\GoogleUpdate.exe'
---
# Sysmon
detection:
process:
EventID: 1
Image:
- 'C:\Program Files(x86)\Google\GoogleService.exe'
- 'C:\Program Files(x86)\Google\GoogleUpdate.exe'
rules/apt/apt_babyshark.yml
+28
View File
@@ -0,0 +1,28 @@
title: Baby Shark Activity
status: experimental
description: Detects activity that could be related to Baby Shark malware
references:
- https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
tags:
- attack.execution
- attack.t1059
- attack.t1086
- attack.discovery
- attack.t1012
- attack.defense_evasion
- attack.t1170
logsource:
category: process_creation
product: windows
author: Florian Roth
date: 2019/02/24
detection:
selection:
CommandLine:
- reg query "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default"
- powershell.exe mshta.exe http*
- cmd.exe /c taskkill /im cmd.exe
condition: selection
falsepositives:
- unknown
level: high
rules/apt/apt_bear_activity_gtr19.yml
+24
View File
@@ -0,0 +1,24 @@
title: Judgement Panda Exfil Activity
description: Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike
references:
- https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
author: Florian Roth
date: 2019/02/21
tags:
- attack.credential_access
- attack.t1081
- attack.t1003
logsource:
category: process_creation
product: windows
detection:
selection1:
Image: '*\xcopy.exe'
CommandLine: '* /S /E /C /Q /H \\*'
selection2:
Image: '*\adexplorer.exe'
CommandLine: '* -snapshot "" c:\users\\*'
condition: selection1 or selection2
falsepositives:
- unknown
level: critical
rules/apt/apt_carbonpaper_turla.yml
Regular → Executable
+6 -1
View File
@@ -1,6 +1,11 @@
title: Turla Service Install
description: 'This method detects a service install of malicious services mentioned in Carbon Paper - Turla report by ESET'
reference: https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/
references:
- https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/
tags:
- attack.persistence
- attack.g0010
- attack.t1050
logsource:
product: windows
service: system
rules/apt/apt_chafer_mar18.yml
Executable
+73
View File
@@ -0,0 +1,73 @@
---
action: global
title: Chafer Activity
description: Detects Chafer activity attributed to OilRig as reported in Nyotron report in March 2018
references:
- https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/
tags:
- attack.persistence
- attack.g0049
- attack.t1053
- attack.s0111
- attack.defense_evasion
- attack.t1112
date: 2018/03/23
modified: 2019/03/01
author: Florian Roth, Markus Neis
detection:
condition: 1 of them
falsepositives:
- Unknown
level: critical
---
logsource:
product: windows
service: system
detection:
selection_service:
EventID: 7045
ServiceName:
- 'SC Scheduled Scan'
- 'UpdatMachine'
---
logsource:
product: windows
service: security
detection:
selection_service:
EventID: 4698
TaskName:
- 'SC Scheduled Scan'
- 'UpdatMachine'
---
logsource:
product: windows
service: sysmon
detection:
selection_reg1:
EventID: 13
TargetObject:
- '*SOFTWARE\Microsoft\Windows\CurrentVersion\UMe'
- '*SOFTWARE\Microsoft\Windows\CurrentVersion\UT'
EventType: 'SetValue'
selection_reg2:
EventID: 13
TargetObject: '*\Control\SecurityProviders\WDigest\UseLogonCredential'
EventType: 'SetValue'
Details: 'DWORD (0x00000001)'
---
logsource:
category: process_creation
product: windows
detection:
selection_process1:
CommandLine:
- '*\Service.exe i'
- '*\Service.exe u'
- '*\microsoft\Taskbar\autoit3.exe'
- 'C:\wsc.exe*'
selection_process2:
Image: '*\Windows\Temp\DB\\*.exe'
selection_process3:
CommandLine: '*\nslookup.exe -q=TXT*'
ParentImage: '*\Autoit*'
rules/apt/apt_cloudhopper.yml
Regular → Executable
+8 -4
View File
@@ -1,13 +1,17 @@
title: Detects an Execution of WMIExec VBS Script
title: WMIExec VBS Script
description: Detects suspicious file execution by wscript and cscript
author: Florian Roth
reference: https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
references:
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
tags:
- attack.execution
- attack.g0045
- attack.t1064
logsource:
category: process_creation
product: windows
service: sysmon
detection:
selection:
EventID: 1
Image: '*\cscript.exe'
CommandLine: '*.vbs /shell *'
condition: selection
rules/apt/apt_dragonfly.yml
Executable
+19
View File
@@ -0,0 +1,19 @@
title: CrackMapExecWin
description: Detects CrackMapExecWin Activity as Described by NCSC
status: experimental
references:
- https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control
tags:
- attack.g0035
author: Markus Neis
logsource:
category: process_creation
product: windows
detection:
selection:
Image:
- '*\crackmapexec.exe'
condition: selection
falsepositives:
- None
level: critical
rules/apt/apt_elise.yml
Executable
+24
View File
@@ -0,0 +1,24 @@
title: Elise Backdoor
status: experimental
description: Detects Elise backdoor acitivty as used by APT32
references:
- https://community.rsa.com/community/products/netwitness/blog/2018/01/30/apt32-continues-asean-targeting
tags:
- attack.g0030
- attack.g0050
- attack.s0081
author: Florian Roth
date: 2018/01/31
logsource:
category: process_creation
product: windows
detection:
selection1:
Image: 'C:\Windows\SysWOW64\cmd.exe'
CommandLine: '*\Windows\Caches\NavShExt.dll *'
selection2:
CommandLine: '*\AppData\Roaming\MICROS~1\Windows\Caches\NavShExt.dll,Setting'
condition: 1 of them
falsepositives:
- Unknown
level: critical
rules/apt/apt_empiremonkey.yml
+32
View File
@@ -0,0 +1,32 @@
---
action: global
title: Empire Monkey
description: Detects EmpireMonkey APT reported Activity
references:
- https://app.any.run/tasks/a4107649-8cb0-41af-ad75-113152d4d57b
tags:
- attack.t1086
- attack.execution
date: 2019/04/02
author: Markus Neis
detection:
condition: 1 of them
falsepositives:
- Very Unlikely
level: critical
---
logsource:
category: process_creation
product: windows
detection:
selection_cutil:
CommandLine:
- '*/i:%APPDATA%\logs.txt scrobj.dll'
Image:
- '*\cutil.exe'
selection_regsvr32:
CommandLine:
- '*/i:%APPDATA%\logs.txt scrobj.dll'
Description:
- Microsoft(C) Registerserver
rules/apt/apt_equationgroup_c2.yml
Regular → Executable
+8 -5
View File
@@ -1,21 +1,24 @@
title: Equation Group C2 Communication
description: Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools
reference:
references:
- 'https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation'
- 'https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195'
tags:
- attack.command_and_control
- attack.g0020
author: Florian Roth
logsource:
product: firewall
category: firewall
detection:
outgoing:
dst:
dst_ip:
- '69.42.98.86'
- '89.185.234.145'
incoming:
src:
src_ip:
- '69.42.98.86'
- '89.185.234.145'
condition: outgoing or incoming
condition: 1 of them
falsepositives:
- Unknown
level: high
rules/apt/apt_equationgroup_dll_u_load.yml
Executable
+26
View File
@@ -0,0 +1,26 @@
title: Equation Group DLL_U Load
author: Florian Roth
description: Detects a specific tool and export used by EquationGroup
references:
- https://github.com/adamcaudill/EquationGroupLeak/search?utf8=%E2%9C%93&q=dll_u&type=
- https://securelist.com/apt-slingshot/84312/
- https://twitter.com/cyb3rops/status/972186477512839170
tags:
- attack.execution
- attack.g0020
- attack.t1059
- attack.defense_evasion
- attack.t1085
logsource:
category: process_creation
product: windows
detection:
selection1:
Image: '*\rundll32.exe'
CommandLine: '*,dll_u'
selection2:
CommandLine: '* -export dll_u *'
condition: 1 of them
falsepositives:
- Unknown
level: critical
rules/apt/apt_equationgroup_lnx.yml
Regular → Executable
+6 -2
View File
@@ -1,6 +1,11 @@
title: Equation Group Indicators
description: Detects suspicious shell commands used in various Equation Group scripts and tools
reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1
references:
- https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1
tags:
- attack.execution
- attack.g0020
- attack.t1059
author: Florian Roth
logsource:
product: linux
@@ -63,7 +68,6 @@ detection:
- 'chmod 755 /usr/vmsys/bin/pipe'
- 'chmod -R 755 /usr/vmsys'
- 'chmod 755 $opbin/*tunnel'
- '< /dev/console | uudecode && uncompress'
- 'chmod 700 sendmail'
- 'chmod 0700 sendmail'
- '/usr/bin/wget http*sendmail;chmod +x sendmail;'
rules/apt/apt_hurricane_panda.yml
Executable
+23
View File
@@ -0,0 +1,23 @@
title: Hurricane Panda Activity
author: Florian Roth
status: experimental
description: Detects Hurricane Panda Activity
references:
- https://www.crowdstrike.com/blog/crowdstrike-discovers-use-64-bit-zero-day-privilege-escalation-exploit-cve-2014-4113-hurricane-panda/
tags:
- attack.privilege_escalation
- attack.g0009
- attack.t1068
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine:
- '* localgroup administrators admin /add'
- '*\Win64.exe*'
condition: selection
falsepositives:
- Unknown
level: high
rules/apt/apt_judgement_panda_gtr19.yml
+33
View File
@@ -0,0 +1,33 @@
title: Judgement Panda Exfil Activity
description: Detects Judgement Panda activity as described in Global Threat Report 2019 by Crowdstrike
references:
- https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
author: Florian Roth
date: 2019/02/21
tags:
- attack.lateral_movement
- attack.g0010
- attack.credential_access
- attack.t1098
- attack.exfiltration
- attack.t1002
logsource:
category: process_creation
product: windows
detection:
selection1:
CommandLine:
- '*\ldifde.exe -f -n *'
- '*\7za.exe a 1.7z *'
- '* eprod.ldf'
- '*\aaaa\procdump64.exe*'
- '*\aaaa\netsess.exe*'
- '*\aaaa\7za.exe*'
- '*copy .\1.7z \\*'
- '*copy \\client\c$\aaaa\*'
selection2:
Image: C:\Users\Public\7za.exe
condition: selection1 or selection2
falsepositives:
- unknown
level: critical
rules/apt/apt_oceanlotus_registry.yml
+27
View File
@@ -0,0 +1,27 @@
title: OceanLotus Registry Activity
status: experimental
description: Detects registry keys created in OceanLotus (also known as APT32) attacks
references:
- https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/
tags:
- attack.t1112
author: megan201296
date: 2019/04/14
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 13
TargetObject:
- '*\SOFTWARE\Classes\CLSID\{E08A0F4B-1F65-4D4D-9A09-BD4625B9C5A1}\Model'
- '*\SOFTWARE\App\AppXbf13d4ea2945444d8b13e2121cb6b663\Application'
- '*\SOFTWARE\App\AppXbf13d4ea2945444d8b13e2121cb6b663\DefaultIcon'
- '*\SOFTWARE\App\AppX70162486c7554f7f80f481985d67586d\Application'
- '*\SOFTWARE\App\AppX70162486c7554f7f80f481985d67586d\DefaultIcon'
- '*\SOFTWARE\App\AppX37cc7fdccd644b4f85f4b22d5a3f105a\Application'
- '*\SOFTWARE\App\AppX37cc7fdccd644b4f85f4b22d5a3f105a\DefaultIcon'
condition: selection
falsepositives:
- Unknown
level: critical
rules/apt/apt_pandemic.yml
Regular → Executable
+25 -14
View File
@@ -1,24 +1,17 @@
---
action: global
title: Pandemic Registry Key
status: experimental
description: Detects Pandemic Windows Implant
reference:
references:
- https://wikileaks.org/vault7/#Pandemic
- https://twitter.com/MalwareJake/status/870349480356454401
tags:
- attack.lateral_movement
- attack.t1105
author: Florian Roth
logsource:
product: windows
service: sysmon
detection:
selection1:
EventID: 13
TargetObject:
- '\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\services\null\Instance*'
- '\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\null\Instance*'
- '\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\null\Instance*'
selection2:
EventID: 1
Command: 'loaddll -a *'
condition: selection1 or selection2
condition: 1 of them
fields:
- EventID
- CommandLine
@@ -29,4 +22,22 @@ fields:
falsepositives:
- unknown
level: critical
---
logsource:
product: windows
service: sysmon
detection:
selection1:
EventID: 13
TargetObject:
- '\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\services\null\Instance*'
- '\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\null\Instance*'
- '\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\null\Instance*'
---
logsource:
category: process_creation
product: windows
detection:
selection2:
Command: 'loaddll -a *'
rules/apt/apt_slingshot.yml
Executable
+33
View File
@@ -0,0 +1,33 @@
---
action: global
title: Defrag Deactivation
author: Florian Roth
description: Detects the deactivation of the Scheduled defragmentation task as seen by Slingshot APT group
references:
- https://securelist.com/apt-slingshot/84312/
tags:
- attack.persistence
- attack.t1053
- attack.s0111
detection:
condition: 1 of them
falsepositives:
- Unknown
level: medium
---
logsource:
category: process_creation
product: windows
detection:
selection1:
CommandLine:
- '*schtasks* /delete *Defrag\ScheduledDefrag*'
---
logsource:
product: windows
service: security
definition: 'Requirements: Audit Policy : Audit Other Object Access Events > Success'
detection:
selection2:
EventID: 4701
TaskName: '\Microsoft\Windows\Defrag\ScheduledDefrag'
rules/apt/apt_sofacy.yml
Executable
+27
View File
@@ -0,0 +1,27 @@
title: Sofacy Trojan Loader Activity
author: Florian Roth
status: experimental
description: Detects Trojan loader acitivty as used by APT28
references:
- https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/
- https://www.reverse.it/sample/e3399d4802f9e6d6d539e3ae57e7ea9a54610a7c4155a6541df8e94d67af086e?environmentId=100
- https://twitter.com/ClearskySec/status/960924755355369472
tags:
- attack.g0007
- attack.execution
- attack.t1059
- attack.defense_evasion
- attack.t1085
- car.2013-10-002
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine:
- 'rundll32.exe %APPDATA%\\*.dat",*'
- 'rundll32.exe %APPDATA%\\*.dll",#1'
condition: selection
falsepositives:
- Unknown
level: critical
rules/apt/apt_sofacy_zebrocy.yml
+19
View File
@@ -0,0 +1,19 @@
title: Sofacy Zebrocy
author: Florian Roth
description: Detects Sofacy's Zebrocy malware execution
references:
- https://app.any.run/tasks/54acca9a-394e-4384-a0c8-91a96d36c81d
tags:
- attack.execution
- attack.g0020
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine: '*cmd.exe /c SYSTEMINFO & TASKLIST'
condition: selection
falsepositives:
- Unknown
level: critical
rules/apt/apt_stonedrill.yml
Regular → Executable
+6 -1
View File
@@ -1,7 +1,12 @@
title: StoneDrill Service Install
description: 'This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky'
author: Florian Roth
reference: https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/
references:
- https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/
tags:
- attack.persistence
- attack.g0064
- attack.t1050
logsource:
product: windows
service: system
rules/apt/apt_ta17_293a_ps.yml
Regular → Executable
+9 -4
View File
@@ -1,14 +1,19 @@
title: Ps.exe Renamed SysInternals Tool
description: Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documentied in TA17-293A report
reference: https://www.us-cert.gov/ncas/alerts/TA17-293A
description: Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report
references:
- https://www.us-cert.gov/ncas/alerts/TA17-293A
tags:
- attack.defense_evasion
- attack.g0035
- attack.t1036
- car.2013-05-009
author: Florian Roth
date: 2017/10/22
logsource:
category: process_creation
product: windows
service: sysmon
detection:
selection:
EventID: 1
CommandLine: 'ps.exe -accepteula'
condition: selection
falsepositives:
rules/apt/apt_tropictrooper.yml
+17
View File
@@ -0,0 +1,17 @@
title: TropicTrooper Campaign November 2018
author: "@41thexplorer, Windows Defender ATP"
status: stable
description: Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia
references:
- https://cloudblogs.microsoft.com/microsoftsecure/2018/11/28/windows-defender-atp-device-risk-score-exposes-new-cyberattack-drives-conditional-access-to-protect-networks/
tags:
- attack.execution
- attack.t1085
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine: '*abCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCc*'
condition: selection
level: high
rules/apt/apt_turla_commands.yml
Regular → Executable
+16 -10
View File
@@ -3,35 +3,41 @@ action: global
title: Turla Group Lateral Movement
status: experimental
description: Detects automated lateral movement by Turla group
reference: https://securelist.com/the-epic-turla-operation/65545/
references:
- https://securelist.com/the-epic-turla-operation/65545/
tags:
- attack.g0010
- attack.execution
- attack.t1059
- attack.lateral_movement
- attack.t1077
- attack.discovery
- attack.t1083
- attack.t1135
author: Markus Neis
date: 2017/11/07
logsource:
product: windows
service: sysmon
category: process_creation
product: windows
falsepositives:
- Unknown
---
detection:
selection:
EventID: 1
CommandLine:
- 'net use \\%DomainController%\C$ "P@ssw0rd" *'
- 'dir c:\*.doc* /s'
- 'dir %TEMP%\*.exe'
- 'dir c:\\*.doc* /s'
- 'dir %TEMP%\\*.exe'
condition: selection
level: critical
---
detection:
netCommand1:
EventID: 1
CommandLine: 'net view /DOMAIN'
netCommand2:
EventID: 1
CommandLine: 'net session'
netCommand3:
EventID: 1
CommandLine: 'net share'
timeframe: 1m
condition: netCommand1 | near netCommand1 and netCommand1
condition: netCommand1 | near netCommand2 and netCommand3
level: medium
rules/apt/apt_turla_namedpipes.yml
Regular → Executable
+5 -2
View File
@@ -1,13 +1,16 @@
title: Turla Group Named Pipes
status: experimental
description: Detects a named pipe used by Turla group samples
reference: Internal Research
references:
- Internal Research
date: 2017/11/06
tags:
- attack.g0010
author: Markus Neis
logsource:
product: windows
service: sysmon
description: 'Note that you have to configure logging for PipeEvents in Symson config'
definition: 'Note that you have to configure logging for PipeEvents in Symson config'
detection:
selection:
EventID:
rules/apt/apt_turla_service_png.yml
+21
View File
@@ -0,0 +1,21 @@
title: Turla PNG Dropper Service
description: 'This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018'
references:
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/
author: Florian Roth
date: 2018/11/23
tags:
- attack.persistence
- attack.g0010
- attack.t1050
logsource:
product: windows
service: system
detection:
selection:
EventID: 7045
ServiceName: 'WerFaultSvc'
condition: selection
falsepositives:
- unlikely
level: critical
rules/apt/apt_unidentified_nov_18.yml
+33
View File
@@ -0,0 +1,33 @@
---
action: global
title: Unidentified Attacker November 2018
status: stable
description: A sigma rule detecting an unidetefied attacker who used phishing emails to target high profile orgs on November 2018. The Actor shares some TTPs with YYTRIUM/APT29 campaign in 2016.
references:
- https://twitter.com/DrunkBinary/status/1063075530180886529
author: "@41thexplorer, Windows Defender ATP"
date: 2018/11/20
modified: 2018/12/11
tags:
- attack.execution
- attack.t1085
detection:
condition: 1 of them
level: high
---
logsource:
category: process_creation
product: windows
detection:
selection1:
CommandLine: '*cyzfc.dat, PointFunctionCall'
---
# Sysmon: File Creation (ID 11)
logsource:
product: windows
service: sysmon
detection:
selection2:
EventID: 11
TargetFilename:
- '*ds7002.lnk*'
rules/apt/apt_zxshell.yml
Regular → Executable
+9 -3
View File
@@ -1,13 +1,19 @@
title: ZxShell Malware
description: Detects a ZxShell start by the called and well-known function name
author: Florian Roth
reference: https://www.hybrid-analysis.com/sample/5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16?environmentId=100
references:
- https://www.hybrid-analysis.com/sample/5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16?environmentId=100
tags:
- attack.g0001
- attack.execution
- attack.t1059
- attack.defense_evasion
- attack.t1085
logsource:
category: process_creation
product: windows
service: sysmon
detection:
selection:
EventID: 1
Command:
- 'rundll32.exe *,zxFunction*'
- 'rundll32.exe *,RemoteDiskXXXXX'
rules/apt/crime_fireball.yml
Regular → Executable
+8 -4
View File
@@ -1,17 +1,21 @@
title: Detects Fireball - Archer Install
title: Fireball Archer Install
status: experimental
description: Detects Archer malware invocation via rundll32
author: Florian Roth
date: 2017/06/03
reference:
references:
- https://www.virustotal.com/en/file/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022/analysis/
- https://www.hybrid-analysis.com/sample/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022?environmentId=100
tags:
- attack.execution
- attack.t1059
- attack.defense_evasion
- attack.t1085
logsource:
category: process_creation
product: windows
service: sysmon
detection:
selection:
EventID: 1
CommandLine: '*\rundll32.exe *,InstallArcherSvc'
condition: selection
fields:
rules/compliance/cleartext_protocols.yml
+109
View File
@@ -0,0 +1,109 @@
action: global
title: Cleartext Protocol Usage
description: Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels. Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.
references:
- https://www.cisecurity.org/controls/cis-controls-list/
- https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
- https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
author: Alexandr Yampolskyi, SOC Prime
status: stable
date: 2019/03/26
falsepositives:
- unknown
level: low
tags:
- CSC4
- CSC4.5
- CSC14
- CSC14.4
- CSC16
- CSC16.5
- NIST CSF 1.1 PR.AT-2
- NIST CSF 1.1 PR.MA-2
- NIST CSF 1.1 PR.PT-3
- NIST CSF 1.1 PR.AC-1
- NIST CSF 1.1 PR.AC-4
- NIST CSF 1.1 PR.AC-5
- NIST CSF 1.1 PR.AC-6
- NIST CSF 1.1 PR.AC-7
- NIST CSF 1.1 PR.DS-1
- NIST CSF 1.1 PR.DS-2
- NIST CSF 1.1 PR.PT-3
- NIST CSF 1.1 PR.PT-3
- ISO 27002-2013 A.9.2.1
- ISO 27002-2013 A.9.2.2
- ISO 27002-2013 A.9.2.3
- ISO 27002-2013 A.9.2.4
- ISO 27002-2013 A.9.2.5
- ISO 27002-2013 A.9.2.6
- ISO 27002-2013 A.9.3.1
- ISO 27002-2013 A.9.4.1
- ISO 27002-2013 A.9.4.2
- ISO 27002-2013 A.9.4.3
- ISO 27002-2013 A.9.4.4
- ISO 27002-2013 A.8.3.1
- ISO 27002-2013 A.9.1.1
- ISO 27002-2013 A.10.1.1
- PCI DSS 3.2 2.1
- PCI DSS 3.2 8.1
- PCI DSS 3.2 8.2
- PCI DSS 3.2 8.3
- PCI DSS 3.2 8.7
- PCI DSS 3.2 8.8
- PCI DSS 3.2 1.3
- PCI DSS 3.2 1.4
- PCI DSS 3.2 4.3
- PCI DSS 3.2 7.1
- PCI DSS 3.2 7.2
- PCI DSS 3.2 7.3
---
logsource:
product: netflow
detection:
selection:
destination.port:
- 8080
- 21
- 80
- 23
- 50000
- 1521
- 27017
- 1433
- 11211
- 3306
- 15672
- 5900
- 5901
- 5902
- 5903
- 5904
condition: selection
---
logsource:
product: firewall
detection:
selection1:
destination.port:
- 8080
- 21
- 80
- 23
- 50000
- 1521
- 27017
- 3306
- 1433
- 11211
- 15672
- 5900
- 5901
- 5902
- 5903
- 5904
selection2:
action:
- forward
- accept
- 2
condition: selection1 AND selection2
rules/compliance/default_credentials_usage.yml
+107
View File
@@ -0,0 +1,107 @@
title: Default Credentials Usage
description: Before deploying any new asset, change all default passwords to have values consistent with administrative level accounts. Sigma detects default credentials usage. Sigma for Qualys vulnerability scanner. Scan type - Vulnerability Management.
author: Alexandr Yampolskyi, SOC Prime
status: stable
references:
- https://www.cisecurity.org/controls/cis-controls-list/
- https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
- https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
- https://community.qualys.com/docs/DOC-6406-reporting-toolbox-focused-search-lists
date: 2019/03/26
logsource:
product: qualys
detection:
selection:
host.scan.vuln:
- 10693
- 11507
- 11633
- 11804
- 11821
- 11847
- 11867
- 11931
- 11935
- 11950
- 12541
- 12558
- 12559
- 12560
- 12562
- 12563
- 12565
- 12587
- 12590
- 12599
- 12702
- 12705
- 12706
- 12907
- 12928
- 12929
- 13053
- 13178
- 13200
- 13218
- 13241
- 13253
- 13274
- 13296
- 13301
- 13327
- 13373
- 13374
- 13409
- 13530
- 13532
- 20065
- 20073
- 20081
- 27202
- 27358
- 38702
- 38719
- 42045
- 42417
- 43029
- 43220
- 43221
- 43222
- 43223
- 43225
- 43246
- 43431
- 43484
- 86857
- 87098
- 87106
condition: selection
falsepositives:
- unknown
level: medium
tags:
- CSC4
- CSC4.2
- NIST CSF 1.1 PR.AC-4
- NIST CSF 1.1 PR.AT-2
- NIST CSF 1.1 PR.MA-2
- NIST CSF 1.1 PR.PT-3
- ISO 27002-2013 A.9.1.1
- ISO 27002-2013 A.9.2.2
- ISO 27002-2013 A.9.2.3
- ISO 27002-2013 A.9.2.4
- ISO 27002-2013 A.9.2.5
- ISO 27002-2013 A.9.2.6
- ISO 27002-2013 A.9.3.1
- ISO 27002-2013 A.9.4.1
- ISO 27002-2013 A.9.4.2
- ISO 27002-2013 A.9.4.3
- ISO 27002-2013 A.9.4.4
- PCI DSS 3.2 2.1
- PCI DSS 3.2 7.1
- PCI DSS 3.2 7.2
- PCI DSS 3.2 7.3
- PCI DSS 3.2 8.1
- PCI DSS 3.2 8.2
- PCI DSS 3.2 8.3
- PCI DSS 3.2 8.7
rules/compliance/group_modification_logging.yml
+57
View File
@@ -0,0 +1,57 @@
title: Group Modification Logging
description: Configure systems to issue a log entry and alert when an account is added to or removed from any group assigned administrative privileges. Sigma detects Event ID 4728 indicates a ‘Member is added to a Security Group’. Event ID 4729 indicates a ‘Member is removed from a Security enabled-group’. Event ID 4730 indicates a‘Security Group is deleted’. The case is not applicable for Unix OS. Supported OS - Windows 2008 R2 and 7, Windows 2012 R2 and 8.1, Windows 2016 and 10 Windows Server 2019, Windows Server 2000, Windows 2003 and XP.
author: Alexandr Yampolskyi, SOC Prime
status: stable
references:
- https://www.cisecurity.org/controls/cis-controls-list/
- https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
- https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=632
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634
date: 2019/03/26
logsource:
product: windows
service: security
detection:
selection:
EventID:
- 4728
- 4729
- 4730
- 633
- 632
- 634
condition: selection
falsepositives:
- unknown
level: low
tags:
- CSC4
- CSC4.8
- NIST CSF 1.1 PR.AC-4
- NIST CSF 1.1 PR.AT-2
- NIST CSF 1.1 PR.MA-2
- NIST CSF 1.1 PR.PT-3
- ISO 27002-2013 A.9.1.1
- ISO 27002-2013 A.9.2.2
- ISO 27002-2013 A.9.2.3
- ISO 27002-2013 A.9.2.4
- ISO 27002-2013 A.9.2.5
- ISO 27002-2013 A.9.2.6
- ISO 27002-2013 A.9.3.1
- ISO 27002-2013 A.9.4.1
- ISO 27002-2013 A.9.4.2
- ISO 27002-2013 A.9.4.3
- ISO 27002-2013 A.9.4.4
- PCI DSS 3.2 2.1
- PCI DSS 3.2 7.1
- PCI DSS 3.2 7.2
- PCI DSS 3.2 7.3
- PCI DSS 3.2 8.1
- PCI DSS 3.2 8.2
- PCI DSS 3.2 8.3
- PCI DSS 3.2 8.7
rules/compliance/host_without_firewall.yml
+29
View File
@@ -0,0 +1,29 @@
title: Host Without Firewall
description: Host Without Firewall. Alert means not complied. Sigma for Qualys vulnerability scanner. Scan type - Vulnerability Management.
author: Alexandr Yampolskyi, SOC Prime
references:
- https://www.cisecurity.org/controls/cis-controls-list/
- https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
- https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
date: 2019/03/19
status: stable
level: low
logsource:
product: Qualys
detection:
selection:
event.category: Security Policy
host.scan.vuln_name: Firewall Product Not Detected*
condition: selection
tags:
- CSC9
- CSC9.4
- NIST CSF 1.1 PR.AC-5
- NIST CSF 1.1 PR.AC-6
- NIST CSF 1.1 PR.AC-7
- NIST CSF 1.1 DE.AE-1
- ISO 27002-2013 A.9.1.2
- ISO 27002-2013 A.13.2.1
- ISO 27002-2013 A.13.2.2
- ISO 27002-2013 A.14.1.2
- PCI DSS 3.2 1.4
rules/compliance/workstation_was_locked.yml
+45
View File
@@ -0,0 +1,45 @@
title: Locked Workstation
description: Automatically lock workstation sessions after a standard period of inactivity. The case is not applicable for Unix OS. Supported OS - Windows 2008 R2 and 7, Windows 2012 R2 and 8.1, Windows 2016 and 10 Windows Server 2019.
author: Alexandr Yampolskyi, SOC Prime
status: stable
references:
- https://www.cisecurity.org/controls/cis-controls-list/
- https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
- https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4800
date: 2019/03/26
logsource:
product: windows
service: security
detection:
selection:
EventID:
- 4800
condition: selection
falsepositives:
- unknown
level: low
tags:
- CSC16
- CSC16.11
- ISO27002-2013 A.9.1.1
- ISO27002-2013 A.9.2.1
- ISO27002-2013 A.9.2.2
- ISO27002-2013 A.9.2.3
- ISO27002-2013 A.9.2.4
- ISO27002-2013 A.9.2.5
- ISO27002-2013 A.9.2.6
- ISO27002-2013 A.9.3.1
- ISO27002-2013 A.9.4.1
- ISO27002-2013 A.9.4.3
- ISO27002-2013 A.11.2.8
- PCI DSS 3.1 7.1
- PCI DSS 3.1 7.2
- PCI DSS 3.1 7.3
- PCI DSS 3.1 8.7
- PCI DSS 3.1 8.8
- NIST CSF 1.1 PR.AC-1
- NIST CSF 1.1 PR.AC-4
- NIST CSF 1.1 PR.AC-6
- NIST CSF 1.1 PR.AC-7
- NIST CSF 1.1 PR.PT-3
rules/linux/auditd/lnx_auditd_alter_bash_profile.yml
+30
View File
@@ -0,0 +1,30 @@
title: Detects Suspicious edit of .bash_profile and .bashrc on Linux systems
status: experimental
description: Detects change of user environment. Adversaries can insert code into these files to gain persistence each time a user logs in or opens a new shell.
references:
- 'MITRE Attack technique T1156; .bash_profile and .bashrc. '
date: 2019/05/12
tags:
- attack.s0003
- attack.t1156
- attack.persistence
author: Peter Matkovski
logsource:
product: linux
service: auditd
detection:
selection:
type: 'PATH'
name:
- '/home/*/.bashrc'
- '/home/*/.bash_profile'
- '/home/*/.profile'
- '/etc/profile'
- '/etc/shells'
- '/etc/bashrc'
- '/etc/csh.cshrc'
- '/etc/csh.login'
condition: selection
falsepositives:
- Admin or User activity
level: medium
rules/linux/auditd/lnx_auditd_susp_cmds.yml
+31
View File
@@ -0,0 +1,31 @@
title: Detects Suspicious Commands on Linux systems
status: experimental
description: Detects relevant commands often related to malware or hacking activity
references:
- 'Internal Research - mostly derived from exploit code including code in MSF'
date: 2017/12/12
author: Florian Roth
logsource:
product: linux
service: auditd
detection:
cmd1:
type: 'EXECVE'
a0: 'chmod'
a1: '777'
cmd2:
type: 'EXECVE'
a0: 'chmod'
a1: 'u+s'
cmd3:
type: 'EXECVE'
a0: 'cp'
a1: '/bin/ksh'
cmd4:
type: 'EXECVE'
a0: 'cp'
a1: '/bin/sh'
condition: 1 of them
falsepositives:
- Admin activity
level: medium
rules/linux/auditd/lnx_auditd_susp_exe_folders.yml
+40
View File
@@ -0,0 +1,40 @@
title: Program Executions in Suspicious Folders
status: experimental
description: Detects program executions in suspicious non-program folders related to malware or hacking activity
references:
- 'Internal Research'
date: 2018/01/23
author: Florian Roth
logsource:
product: linux
service: auditd
detection:
selection:
type: 'SYSCALL'
exe:
# Temporary folder
- '/tmp/*'
# Web server
- '/var/www/*' # Standard
- '/home/*/public_html/*' # Per-user
- '/usr/local/apache2/*' # Classical Apache
- '/usr/local/httpd/*' # Old SuSE Linux 6.* Apache
- '/var/apache/*' # Solaris Apache
- '/srv/www/*' # SuSE Linux 9.*
- '/home/httpd/html/*' # Redhat 6 or older Apache
- '/srv/http/*' # ArchLinux standard
- '/usr/share/nginx/html/*' # ArchLinux nginx
# Data dirs of typically exploited services (incomplete list)
- '/var/lib/pgsql/data/*'
- '/usr/local/mysql/data/*'
- '/var/lib/mysql/*'
- '/var/vsftpd/*'
- '/etc/bind/*'
- '/var/named/*'
condition: selection
falsepositives:
- Admin activity (especially in /tmp folders)
- Crazy web applications
level: medium
rules/linux/lnx_buffer_overflows.yml
+4 -3
View File
@@ -1,8 +1,9 @@
title: Buffer Overflow Attempts
description: Detects buffer overflow attempts in Linux system log files
reference: https://github.com/ossec/ossec-hids/blob/master/etc/rules/attack_rules.xml
description: Detects buffer overflow attempts in Unix system log files
references:
- https://github.com/ossec/ossec-hids/blob/master/etc/rules/attack_rules.xml
logsource:
product: linux
product: unix
detection:
keywords:
- 'attempt to execute code on stack by'
rules/linux/lnx_clamav.yml
+2 -1
View File
@@ -1,6 +1,7 @@
title: Relevant ClamAV Message
description: Detects relevant ClamAV messages
reference: https://github.com/ossec/ossec-hids/blob/master/etc/rules/clam_av_rules.xml
references:
- https://github.com/ossec/ossec-hids/blob/master/etc/rules/clam_av_rules.xml
logsource:
product: linux
service: clamav
rules/linux/lnx_shell_clear_cmd_history.yml
+27
View File
@@ -0,0 +1,27 @@
title: Clear Command History
status: experimental
description: Clear command history in linux which is used for defense evasion.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1146/T1146.yaml
- https://attack.mitre.org/techniques/T1146/
author: Patrick Bareiss
date: 2019/03/24
logsource:
product: linux
detection:
keywords:
- 'rm *bash_history'
- 'echo "" > *bash_history'
- 'cat /dev/null > *bash_history'
- 'ln -sf /dev/null *bash_history'
- 'truncate -s0 *bash_history'
# - 'unset HISTFILE' # prone to false positives
- 'export HISTFILESIZE=0'
- 'history -c'
condition: keywords
falsepositives:
- Unknown
level: high
tags:
- attack.defense_evasion
- attack.t1146
rules/linux/lnx_shell_priv_esc_prep.yml
+64
View File
@@ -0,0 +1,64 @@
title: Privilege Escalation Preparation
status: experimental
description: Detects suspicious shell commands indicating the information gathering phase as preparation for the Privilege Escalation.
references:
- https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/
- https://patrick-bareiss.com/detect-privilege-escalation-preparation-in-linux-with-sigma/
author: Patrick Bareiss
date: 2019/04/05
tags:
- attack.privilege_escalation
- attack.t1068
level: medium
logsource:
product: linux
detection:
keywords:
# distribution type and kernel version
- 'cat /etc/issue'
- 'cat /etc/*-release'
- 'cat /proc/version'
- 'uname -a'
- 'uname -mrs'
- 'rpm -q kernel'
- 'dmesg | grep Linux'
- 'ls /boot | grep vmlinuz-'
# environment variables
- 'cat /etc/profile'
- 'cat /etc/bashrc'
- 'cat ~/.bash_profile'
- 'cat ~/.bashrc'
- 'cat ~/.bash_logout'
# applications and services as root
- 'ps -aux | grep root'
- 'ps -ef | grep root'
# scheduled tasks
- 'crontab -l'
- 'cat /etc/cron*'
- 'cat /etc/cron.allow'
- 'cat /etc/cron.deny'
- 'cat /etc/crontab'
# search for plain text user/passwords
- 'grep -i user *'
- 'grep -i pass *'
# networking
- 'ifconfig'
- 'cat /etc/network/interfaces'
- 'cat /etc/sysconfig/network'
- 'cat /etc/resolv.conf'
- 'cat /etc/networks'
- 'iptables -L'
- 'lsof -i'
- 'netstat -antup'
- 'netstat -antpx'
- 'netstat -tulpn'
- 'arp -e'
- 'route'
# sensitive files
- 'cat /etc/passwd'
- 'cat /etc/group'
- 'cat /etc/shadow'
timeframe: 30m
condition: keywords | count() by host > 6
falsepositives:
- Troubleshooting on Linux Machines
rules/linux/lnx_shell_susp_commands.yml
+28 -19
View File
@@ -1,11 +1,13 @@
title: Suspicious Activity in Shell Commands
description: Detects suspicious shell commands used in various exploit codes (see references)
reference:
references:
- http://www.threatgeek.com/2017/03/widespread-exploitation-attempts-using-cve-2017-5638.html
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb#L121
- http://pastebin.com/FtygZ1cg
- https://artkond.com/2017/03/23/pivoting-guide/
author: Florian Roth
date: 2017/08/21
modified: 2019/02/05
logsource:
product: linux
detection:
@@ -15,30 +17,37 @@ detection:
- 'wget * - http* | sh'
- 'wget * - http* | bash'
- 'python -m SimpleHTTPServer'
- 'import pty; pty.spawn'
- '-m http.server' # Python 3
- 'import pty; pty.spawn*'
- 'socat exec:*'
- 'socat -O /tmp/*'
- 'socat tcp-connect*'
- '*echo binary >>*'
# Malware
- '*wget *; chmod +x*'
- '*wget *; chmod 777 *'
- '*cd /tmp || cd /var/run || cd /mnt*'
# Apache Struts in-the-wild exploit codes
- 'stop;service iptables stop;'
- 'stop;SuSEfirewall2 stop;'
- 'chmod 777 2020'
- '">>/etc/rc.local;'
- 'wget -c *;chmod 777'
- '*stop;service iptables stop;*'
- '*stop;SuSEfirewall2 stop;*'
- 'chmod 777 2020*'
- '*>>/etc/rc.local'
# Metasploit framework exploit codes
- 'base64 -d /tmp/'
- ' | base64 -d'
- '/bin/chmod u+s'
- 'chmod +s /tmp/'
- 'chmod u+s /tmp/'
- '/tmp/haxhax'
- '/tmp/ns_sploit'
- 'nc -l -p '
- 'cp /bin/ksh '
- 'cp /bin/sh '
- ' /tmp/*.b64 '
- '/tmp/ysocereal.jar'
- '*base64 -d /tmp/*'
- '* | base64 -d *'
- '*/chmod u+s *'
- '*chmod +s /tmp/*'
- '*chmod u+s /tmp/*'
- '* /tmp/haxhax*'
- '* /tmp/ns_sploit*'
- 'nc -l -p *'
- 'cp /bin/ksh *'
- 'cp /bin/sh *'
- '* /tmp/*.b64 *'
- '*/tmp/ysocereal.jar*'
- '*/tmp/x *'
- '*; chmod +x /tmp/*'
- '*;chmod +x /tmp/*'
condition: keywords
falsepositives:
- Unknown
rules/linux/lnx_shell_susp_rev_shells.yml
+40
View File
@@ -0,0 +1,40 @@
title: Suspicious Reverse Shell Command Line
status: experimental
description: Detects suspicious shell commands or program code that may be exected or used in command line to establish a reverse shell
references:
- https://alamot.github.io/reverse_shells/
author: Florian Roth
date: 2019/04/02
logsource:
product: linux
detection:
keywords:
- 'BEGIN {s = "/inet/tcp/0/'
- 'bash -i >& /dev/tcp/'
- 'bash -i >& /dev/udp/'
- 'sh -i >$ /dev/udp/'
- 'sh -i >$ /dev/tcp/'
- '&& while read line 0<&5; do'
- '/bin/bash -c exec 5<>/dev/tcp/'
- '/bin/bash -c exec 5<>/dev/udp/'
- 'nc -e /bin/sh '
- '/bin/sh | nc'
- 'rm -f backpipe; mknod /tmp/backpipe p && nc '
- ';socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i))))'
- ';STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'
- '/bin/sh -i <&3 >&3 2>&3'
- 'uname -a; w; id; /bin/bash -i'
- '$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2); $stream.Write($sendbyte,0,$sendbyte.Length); $stream.Flush()};'
- ";os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);os.putenv('HISTFILE','/dev/null');"
- '.to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
- ';while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print'
- "socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:"
- 'rm -f /tmp/p; mknod /tmp/p p &&'
- ' | /bin/bash | telnet '
- ',echo=0,raw tcp-listen:'
- 'nc -lvvp '
- 'xterm -display 1'
condition: keywords
falsepositives:
- Unknown
level: high
rules/linux/lnx_shellshock.yml
+2 -1
View File
@@ -1,6 +1,7 @@
title: Shellshock Expression
description: Detects shellshock expressions in log files
reference: http://rubular.com/r/zxBfjWfFYs
references:
- http://rubular.com/r/zxBfjWfFYs
logsource:
product: linux
detection:
rules/linux/lnx_ssh_cve_2018_15473.yml
+16
View File
@@ -0,0 +1,16 @@
title: SSHD Error Message CVE-2018-15473
description: Detects exploitation attempt using public exploit code for CVE-2018-15473
references:
- https://github.com/Rhynorater/CVE-2018-15473-Exploit
author: Florian Roth
date: 2017/08/24
logsource:
product: linux
service: sshd
detection:
keywords:
- 'error: buffer_get_ret: trying to get more bytes 1907 than in buffer 308 [preauth]'
condition: keywords
falsepositives:
- Unknown
level: medium
rules/linux/lnx_susp_failed_logons_single_source.yml
+3 -3
View File
@@ -5,9 +5,9 @@ logsource:
service: auth
detection:
selection:
log: auth
pam_user: not null
pam_rhost: not null
pam_message: "authentication failure"
pam_user: '*'
pam_rhost: '*'
timeframe: 24h
condition: selection | count(pam_user) by pam_rhost > 3
falsepositives:
rules/linux/lnx_susp_jexboss.yml
+17
View File
@@ -0,0 +1,17 @@
title: JexBoss Command Sequence
description: Detects suspicious command sequence that JexBoss
references:
- https://www.us-cert.gov/ncas/analysis-reports/AR18-312A
author: Florian Roth
date: 2017/08/24
logsource:
product: linux
detection:
selection1:
- 'bash -c /bin/bash'
selection2:
- '&/dev/tcp/'
condition: selection1 and selection2
falsepositives:
- Unknown
level: high
rules/linux/lnx_susp_named.yml
+20
View File
@@ -0,0 +1,20 @@
title: Suspicious Named Error
status: experimental
description: Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
references:
- https://github.com/ossec/ossec-hids/blob/master/etc/rules/named_rules.xml
author: Florian Roth
date: 2018/02/20
logsource:
product: linux
service: syslog
detection:
keywords:
- '* dropping source port zero packet from *'
- '* denied AXFR from *'
- '* exiting (due to fatal error)*'
condition: keywords
falsepositives:
- Unknown
level: high
rules/linux/lnx_susp_ssh.yml
+15 -9
View File
@@ -1,6 +1,8 @@
title: Suspicious SSHD error
title: Suspicious SSHD Error
description: Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
reference: https://github.com/openssh/openssh-portable/blob/master/ssherr.c
references:
- https://github.com/openssh/openssh-portable/blob/master/ssherr.c
- https://github.com/ossec/ossec-hids/blob/master/etc/rules/sshd_rules.xml
author: Florian Roth
date: 2017/06/30
logsource:
@@ -8,13 +10,17 @@ logsource:
service: sshd
detection:
keywords:
- 'unexpected internal error'
- 'unknown or unsupported key type'
- 'invalid certificate signing key'
- 'invalid elliptic curve value'
- 'incorrect signature'
- 'error in libcrypto'
- 'unexpected bytes remain after decoding'
- '*unexpected internal error*'
- '*unknown or unsupported key type*'
- '*invalid certificate signing key*'
- '*invalid elliptic curve value*'
- '*incorrect signature*'
- '*error in libcrypto*'
- '*unexpected bytes remain after decoding*'
- '*fatal: buffer_get_string: bad string*'
- '*Local: crc32 compensation attack*'
- '*bad client public DH value*'
- '*Corrupted MAC on input*'
condition: keywords
falsepositives:
- Unknown
rules/linux/lnx_susp_vsftp.yml
+3 -2
View File
@@ -1,6 +1,7 @@
title: Suspicious VSFTPD error messages
title: Suspicious VSFTPD Error Messages
description: Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
reference: https://github.com/dagwieers/vsftpd/
references:
- https://github.com/dagwieers/vsftpd/
author: Florian Roth
date: 2017/07/05
logsource:
rules/network/net_dns_c2_detection.yml
+19
View File
@@ -0,0 +1,19 @@
title: Possible DNS Tunneling
status: experimental
description: Normally, DNS logs contain a limited amount of different dns queries for a single domain. This rule detects a high amount of queries for a single domain, which can be an indicator that DNS is used to transfer data.
references:
- https://zeltser.com/c2-dns-tunneling/
- https://patrick-bareiss.com/detect-c2-traffic-over-dns-using-sigma/
author: Patrick Bareiss
date: 2019/04/07
logsource:
product: dns
detection:
selection:
parent_domain: '*'
condition: selection | count(dns_query) by parent_domain > 1000
falsepositives:
- Valid software, which uses dns for transferring data
level: high
tags:
- attack.t1043
rules/network/net_mal_dns_cobaltstrike.yml
+19
View File
@@ -0,0 +1,19 @@
title: Cobalt Strike DNS Beaconing
status: experimental
description: Detects suspicious DNS queries known from Cobalt Strike beacons
references:
- https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
author: Florian Roth
date: 2018/05/10
logsource:
category: dns
detection:
selection:
query:
- 'aaa.stage.*'
- 'post.1*'
condition: selection
falsepositives:
- Unknown
level: high
rules/network/net_susp_dns_b64_queries.yml
+17
View File
@@ -0,0 +1,17 @@
title: Suspicious DNS Query with B64 Encoded String
status: experimental
description: Detects suspicious DNS queries using base64 encoding
references:
- https://github.com/krmaxwell/dns-exfiltration
author: Florian Roth
date: 2018/05/10
logsource:
category: dns
detection:
selection:
query:
- '*==.*'
condition: selection
falsepositives:
- Unknown
level: medium
rules/network/net_susp_dns_txt_exec_strings.yml
+23
View File
@@ -0,0 +1,23 @@
title: DNS TXT Answer with possible execution strings
status: experimental
description: Detects strings used in command execution in DNS TXT Answer
references:
- https://twitter.com/stvemillertime/status/1024707932447854592
- https://github.com/samratashok/nishang/blob/master/Backdoors/DNS_TXT_Pwnage.ps1
tags:
- attack.t1071
author: Markus Neis
date: 2018/08/08
logsource:
category: dns
detection:
selection:
record_type: 'TXT'
answer:
- '*IEX*'
- '*Invoke-Expression*'
- '*cmd.exe*'
condition: selection
falsepositives:
- Unknown
level: high
rules/network/net_susp_telegram_api.yml
+20
View File
@@ -0,0 +1,20 @@
title: Telegram Bot API Request
status: experimental
description: Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind
references:
- https://core.telegram.org/bots/faq
- https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/
- https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/
- https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/
author: Florian Roth
date: 2018/06/05
logsource:
category: dns
detection:
selection:
query:
- 'api.telegram.org' # Telegram Bot API Request https://core.telegram.org/bots/faq
condition: selection
falsepositives:
- Legitimate use of Telegram bots in the company
level: medium
rules/proxy/proxy_apt40.yml
+20
View File
@@ -0,0 +1,20 @@
title: APT40 Dropbox Tool User Agent
status: experimental
description: Detects suspicious user agent string of APT40 Dropbox tool
references:
- Internal research from Florian Roth
author: Thomas Patzke
logsource:
category: proxy
detection:
selection:
UserAgent: 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36'
r-dns: 'api.dropbox.com'
condition: selection
fields:
- c-ip
- cs-uri
falsepositives:
- Old browsers
level: high
rules/proxy/proxy_chafer_malware.yml
+20
View File
@@ -0,0 +1,20 @@
title: Chafer Malware URL Pattern
status: experimental
description: Detects HTTP requests used by Chafer malware
references:
- https://securelist.com/chafer-used-remexi-malware/89538/
author: Florian Roth
date: 2019/01/31
logsource:
category: proxy
detection:
selection:
c-uri-query: '*/asp.asp?ui=*'
condition: selection
fields:
- ClientIP
- URL
- UserAgent
falsepositives:
- Unknown
level: critical
rules/proxy/proxy_cobalt_amazon.yml
+27
View File
@@ -0,0 +1,27 @@
title: CobaltStrike Malleable Amazon browsing traffic profile
status: experimental
description: Detects Malleable Amazon Profile
references:
- https://github.com/rsmudge/Malleable-C2-Profiles/blob/master/normal/amazon.profile
- https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100
author: Markus Neis
tags:
- attack.t1102
logsource:
category: proxy
detection:
selection1:
UserAgent: "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
HttpMethod: 'GET'
URL: '/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books'
Host: 'www.amazon.com'
Cookie: '*=csm-hit=s-24KU11BB82RZSYGJ3BDK|1419899012996'
selection2:
UserAgent: "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
HttpMethod: 'POST'
URL: '/N4215/adj/amzn.us.sr.aps'
Host: 'www.amazon.com'
condition: selection1 or selection2
falsepositives:
- Unknown
level: high
rules/proxy/proxy_cobalt_ocsp.yml
+19
View File
@@ -0,0 +1,19 @@
title: CobaltStrike Malleable (OCSP) Profile
status: experimental
description: Detects Malleable (OCSP) Profile with Typo (OSCP) in URL
references:
- https://github.com/rsmudge/Malleable-C2-Profiles/blob/master/normal/ocsp.profile
author: Markus Neis
tags:
- attack.t1102
logsource:
category: proxy
detection:
selection:
URL: '*/oscp/*'
Host: 'ocsp.verisign.com'
condition: selection
falsepositives:
- Unknown
level: high
rules/proxy/proxy_cobalt_onedrive.yml
+21
View File
@@ -0,0 +1,21 @@
title: CobaltStrike Malleable OneDrive browsing traffic profile
status: experimental
description: Detects Malleable OneDrive Profile
references:
- https://github.com/rsmudge/Malleable-C2-Profiles/blob/master/normal/onedrive_getonly.profile
author: Markus Neis
tags:
- attack.t1102
logsource:
category: proxy
detection:
selection:
HttpMethod: 'GET'
URL: '*?manifest=wac'
Host: 'onedrive.live.com'
filter:
URL: 'http*://onedrive.live.com/*'
condition: selection and not filter
falsepositives:
- Unknown
level: high
rules/proxy/proxy_download_susp_dyndns.yml
+2 -2
View File
@@ -1,7 +1,8 @@
title: Download from Suspicious Dyndns Hosts
status: experimental
description: Detects download of certain file types from hosts with dynamic DNS names (selected list)
reference: https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-and-potential-threats
references:
- https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-and-potential-threats
author: Florian Roth
date: 2017/11/08
logsource:
@@ -55,7 +56,6 @@ detection:
- '*.mooo.com'
- '*.dns-dns.com'
- '*.strangled.net'
- '*.ddns.info'
- '*.adultdns.net'
- '*.craftx.biz'
- '*.ddns01.com'
rules/proxy/proxy_download_susp_tlds_blacklist.yml
+12 -7
View File
@@ -1,12 +1,13 @@
title: Download from Suspicious TLD
status: experimental
description: Detects download of certain file types from hosts in suspicious TLDs
reference:
references:
- https://www.symantec.com/connect/blogs/shady-tld-research-gdn-and-our-2016-wrap
- https://promos.mcafee.com/en-US/PDF/MTMW_Report.pdf
- https://www.spamhaus.org/statistics/tlds/
- https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/
author: Florian Roth
date: 2017/11/07
date: 2018/06/13
logsource:
category: proxy
detection:
@@ -52,15 +53,13 @@ detection:
- '*.vip'
- '*.party'
- '*.tech'
- '*.tech'
- '*.xyz'
- '*.date'
- '*.faith'
- '*.zip'
- '*.cricket'
- '*.space'
- '*.top'
# McAfee report
# McAfee report
- '*.info'
- '*.vn'
- '*.cm'
@@ -83,7 +82,6 @@ detection:
- '*.tt'
- '*.name'
- '*.tv'
- '*.tv'
- '*.kz'
- '*.tc'
- '*.mobi'
@@ -93,10 +91,17 @@ detection:
- '*.link'
- '*.trade'
- '*.accountant'
# Spamhaus 2018 https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/
- '*.cf'
- '*.gq'
- '*.ml'
- '*.ga'
# Custom
- '*.pw'
condition: selection
fields:
- ClientIP
- URL
falsepositives:
- All kind of software downloads
- All kinds of software downloads
level: low
rules/proxy/proxy_download_susp_tlds_whitelist.yml
+1 -1
View File
@@ -1,4 +1,4 @@
title: Download from Suspicious TLD
title: Download EXE from Suspicious TLD
status: experimental
description: Detects executable downloads from suspicious remote systems
author: Florian Roth
rules/proxy/proxy_downloadcradle_webdav.yml
+24
View File
@@ -0,0 +1,24 @@
title: Windows WebDAV User Agent
status: experimental
description: Detects WebDav DownloadCradle
references:
- https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html
author: Florian Roth
date: 2018/04/06
logsource:
category: proxy
detection:
selection:
UserAgent: 'Microsoft-WebDAV-MiniRedir/*'
HttpMethod: 'GET'
condition: selection
fields:
- ClientIP
- URL
- UserAgent
- HttpMethod
falsepositives:
- Administrative scripts that download files from the Internet
- Administrative scripts that retrieve certain website contents
- Legitimate WebDAV administration
level: high
rules/proxy/proxy_empty_ua.yml
+3 -4
View File
@@ -1,16 +1,15 @@
title: Empty User Agent
status: experimental
description: Detects suspicious empty user agent strings in proxy logs
reference:
references:
- https://twitter.com/Carlos_Perez/status/883455096645931008
author: Florian Roth
logsource:
category: proxy
detection:
selection:
UserAgent:
# Empty string - as used by Powershell's (New-Object Net.WebClient).DownloadString
- ''
# Empty string - as used by Powershell's (New-Object Net.WebClient).DownloadString
UserAgent: ''
condition: selection
fields:
- ClientIP
rules/proxy/proxy_powershell_ua.yml
+2 -1
View File
@@ -1,7 +1,8 @@
title: Windows PowerShell User Agent
status: experimental
description: Detects Windows PowerShell Web Access
reference: https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Invoke-WebRequest
references:
- https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Invoke-WebRequest
author: Florian Roth
logsource:
category: proxy
rules/proxy/proxy_susp_flash_download_loc.yml
+3 -2
View File
@@ -1,7 +1,8 @@
title: Flash Player Update from Suspicious Location
status: experimental
description: Detects a flashplayer update from an unofficial location
reference: https://gist.github.com/roycewilliams/a723aaf8a6ac3ba4f817847610935cfb
references:
- https://gist.github.com/roycewilliams/a723aaf8a6ac3ba4f817847610935cfb
author: Florian Roth
logsource:
category: proxy
@@ -11,7 +12,7 @@ detection:
- '*/install_flash_player.exe'
- '*/flash_install.php*'
filter:
cs-uri-query: '*.adobe.com/*'
cs-uri-stem: '*.adobe.com/*'
condition: selection and not filter
falsepositives:
- Unknown flash download locations
rules/proxy/proxy_telegram_api.yml
+29
View File
@@ -0,0 +1,29 @@
title: Telegram API Access
status: experimental
description: Detects suspicious requests to Telegram API without the usual Telegram User-Agent
references:
- https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/
- https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/
- https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/
author: Florian Roth
date: 2018/06/05
logsource:
category: proxy
detection:
selection:
r-dns:
- 'api.telegram.org' # Often used by Bots
filter:
UserAgent:
# Used https://core.telegram.org/bots/samples for this list
- '*Telegram*'
- '*Bot*'
condition: selection and not filter
fields:
- ClientIP
- URL
- UserAgent
falsepositives:
- Legitimate use of Telegram bots in the company
level: medium
rules/proxy/proxy_ua_apt.yml
+52 -38
View File
@@ -1,38 +1,52 @@
title: APT User Agent
status: experimental
description: Detects suspicious user agent strings used in APT malware in proxy logs
reference: Internal Research
author: Florian Roth
logsource:
category: proxy
detection:
selection:
UserAgent:
# APT Related
- 'SJZJ (compatible; MSIE 6.0; Win32)' # APT Backspace
- 'Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0' # APT GrizzlySteppe - ChopStick - US CERT https://goo.gl/1DTHwi
- 'User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC' # Comment Crew Miniasp
- 'Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit)' # Comment Crew Miniasp
- 'webclient' # Naikon APT
- 'Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200' # Naikon APT
- 'Mozilla/4.0 (compatible; MSI 6.0;' # SnowGlobe Babar - yes, it is cut
- 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0' # Sofacy - Xtunnel
- 'Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/' # Sofacy - Xtunnel
- 'Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2' # Sofacy - Xtunnel
- 'Mozilla/4.0' # Derusbi backdoor ELF https://github.com/fideliscyber/indicators/tree/master/FTA-1021
- 'Netscape' # Unit78020 Malware
- 'Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7' # Unit78020 Malware
- 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Firefox/3.6.13 GTB7.1' # Winnti related
- 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)' # Winnti related
- 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)' # APT17
- 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)' # Bronze Butler - Daserf
- 'Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)' # Bronze Butler - Daserf
condition: selection
fields:
- ClientIP
- URL
- UserAgent
falsepositives:
- Old browsers
level: high
title: APT User Agent
status: experimental
description: Detects suspicious user agent strings used in APT malware in proxy logs
references:
- Internal Research
author: Florian Roth, Markus Neis
logsource:
category: proxy
detection:
selection:
UserAgent:
# APT Related
- 'SJZJ (compatible; MSIE 6.0; Win32)' # APT Backspace
- 'Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0' # APT GrizzlySteppe - ChopStick - US CERT https://goo.gl/1DTHwi
- 'User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC' # Comment Crew Miniasp
- 'Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit)' # Comment Crew Miniasp
- 'webclient' # Naikon APT
- 'Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200' # Naikon APT
- 'Mozilla/4.0 (compatible; MSI 6.0;' # SnowGlobe Babar - yes, it is cut
- 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0' # Sofacy - Xtunnel
- 'Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/' # Sofacy - Xtunnel
- 'Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2' # Sofacy - Xtunnel
- 'Mozilla/4.0' # Derusbi backdoor ELF https://github.com/fideliscyber/indicators/tree/master/FTA-1021
- 'Netscape' # Unit78020 Malware
- 'Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7' # Unit78020 Malware
- 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Firefox/3.6.13 GTB7.1' # Winnti related
- 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)' # Winnti related
- 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)' # APT17
- 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)' # Bronze Butler - Daserf
- 'Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)' # Bronze Butler - Daserf
- 'Mozilla/4.0 (compatible; MSIE 8.0; Win32)' # TSCookie https://app.any.run/tasks/0996b314-5133-491b-8d23-d431ffdec597
- 'Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1' # Delphi downloader https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
- 'Mozilla/6.1 (compatible; MSIE 9.0; Windows NT 5.3; Trident/5.0)' # VPNFilter https://blog.talosintelligence.com/2018/05/VPNFilter.html
- 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1)' # Sofacy User-Agent https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/
- 'Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko' # Sofacy User-Agent https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/
- 'Mozilla v5.1 *' # Sofacy Zebrocy samples
- 'MSIE 8.0' # Sofacy Azzy Backdoor from https://www.hybrid-analysis.com/sample/a80e29c0757bee05338fd5c22a542d852ad86c477068e3eb4aacc1c3e59e2eef?environmentId=100
- 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)' # https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html
- 'Mozilla/4.0 (compatible; RMS)' # Attacks on industrial enterprises using RMS and TeamViewer https://goo.gl/GthvTw
- 'Mozilla/4.0 (compatible; MSIE 6.0; DynGate)' # Attacks on industrial enterprises using RMS and TeamViewer https://goo.gl/GthvTw
- 'O/9.27 (W; U; Z)' # Cmstar https://www.virustotal.com/#/file/e4328011bb2b04abc856ccd04404c9f95d67167f6c291d343e8ffa8aa2aa2099/details
- 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; Trident/5.0*' # KerrDown UA https://goo.gl/s2WU6o
- 'Mozilla/5.0 (Windows NT 9; *' # Suspicious 'Windows NT 9' user agent - used by APT33 malware in 2018
condition: selection
fields:
- ClientIP
- URL
- UserAgent
falsepositives:
- Old browsers
level: high
rules/proxy/proxy_ua_bitsadmin_susp_tld.yml
+26
View File
@@ -0,0 +1,26 @@
title: Bitsadmin to Uncommon TLD
status: experimental
description: Detects Bitsadmin connections to domains with uncommon TLDs
- https://twitter.com/jhencinski/status/1102695118455349248
- https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/
author: Florian Roth
date: 2019/03/07
logsource:
category: proxy
detection:
selection:
UserAgent:
- 'Microsoft BITS/*'
falsepositives:
r-dns:
- '*.com'
- '*.net'
- '*.org'
condition: selection and not falsepositives
fields:
- ClientIP
- URL
- UserAgent
falsepositives:
- Rare programs that use Bitsadmin and update from regional TLDs e.g. .uk or .ca
level: high
rules/proxy/proxy_ua_frameworks.yml
+3 -1
View File
@@ -1,7 +1,7 @@
title: Exploit Framework User Agent
status: experimental
description: Detects suspicious user agent strings used by exploit / pentest framworks like Metasploit in proxy logs
reference:
references:
- https://blog.didierstevens.com/2015/03/16/quickpost-metasploit-user-agent-strings/
author: Florian Roth
logsource:
@@ -22,6 +22,7 @@ detection:
- 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; SIMBAR={7DB0F6DE-8DE7-4841-9084-28FA914B0F2E}; SLCC1; .N'
- 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)' # only use in proxy logs - not for detection in web server logs
- 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/4.0.221.6 Safari/525.13'
- 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MAAU)' # Payloads
# Metasploit Update by Florian Roth 08.07.2017
- 'Mozilla/5.0'
@@ -33,6 +34,7 @@ detection:
- 'X-FORWARDED-FOR'
- 'DotDotPwn v2.1'
- 'SIPDROID'
- 'Mozilla/5.0 (Windows NT 10.0; Win32; x32; rv:60.0)' # CobaltStrike https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/
# Exploits
- '*wordpress hash grabber*'
rules/proxy/proxy_ua_hacktool.yml
+2 -1
View File
@@ -1,7 +1,7 @@
title: Hack Tool User Agent
status: experimental
description: Detects suspicious user agent strings user by hack tools in proxy logs
reference:
references:
- https://github.com/fastly/waf_testbed/blob/master/templates/default/scanners-user-agents.data.erb
- http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules
author: Florian Roth
@@ -60,6 +60,7 @@ detection:
# Hack tool
- 'ruler' # https://www.crowdstrike.com/blog/using-outlook-forms-lateral-movement-persistence/
- 'Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)' # SQLi Dumper
condition: selection
fields:
- ClientIP
rules/proxy/proxy_ua_malware.yml
+7 -1
View File
@@ -1,7 +1,7 @@
title: Malware User Agent
status: experimental
description: Detects suspicious user agent strings used by malware in proxy logs
reference:
references:
- http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules
- http://www.botopedia.org/search?searchword=scan&searchphrase=all
- https://networkraptor.blogspot.com/2015/01/user-agent-strings.html
@@ -22,6 +22,8 @@ detection:
- '*<|>*' # Houdini / Iniduoh / njRAT
- 'nsis_inetc (mozilla)' # ZeroAccess
- 'Wget/1.9+cvs-stable (Red Hat modified)' # Dyre / Upatre
# Ghost419 https://goo.gl/rW1yvZ
- 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)'
# Malware
- '*zeroup*' # W32/Renos.Downloader
@@ -44,6 +46,10 @@ detection:
- 'Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)' # Fareit
- 'Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)' # Webshell's back connect
- 'MSIE' # Toby web shell
- '*(Charon; Inferno)' # Loki Bot
- 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0)' # Fareit / Pony
- 'Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)' # https://goo.gl/g43qjs
- 'Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1)' # MacControl malware https://goo.gl/sqY3Ja https://www.symantec.com/connect/blogs/osxmacontrol-back-it-again
# Others
- '* pxyscand*'
rules/proxy/proxy_ua_suspicious.yml
+7 -2
View File
@@ -1,7 +1,7 @@
title: Suspicious User Agent
status: experimental
description: Detects suspicious malformed user agent strings in proxy logs
reference:
references:
- https://github.com/fastly/waf_testbed/blob/master/templates/default/scanners-user-agents.data.erb
author: Florian Roth
logsource:
@@ -20,7 +20,12 @@ detection:
- ' Mozilla/*' # leading space
- 'Mozila/*' # single 'l'
- '_'
condition: selection
- 'CertUtil URL Agent' # https://twitter.com/stvemillertime/status/985150675527974912
- 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0)' # CobaltStrike Beacon https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/
falsepositives:
UserAgent:
- 'Mozilla/3.0 * Acrobat *' # Acrobat with linked content
condition: selection and not falsepositives
fields:
- ClientIP
- URL
rules/web/web_apache_segfault.yml
+2 -1
View File
@@ -1,7 +1,8 @@
title: Apache Segmentation Fault
description: Detects a segmentation fault error message caused by a creashing apacke worker process
author: Florian Roth
reference: http://www.securityfocus.com/infocus/1633
references:
- http://www.securityfocus.com/infocus/1633
logsource:
product: apache
detection:
rules/web/web_apache_threading_error.yml
+16
View File
@@ -0,0 +1,16 @@
title: Apache Threading Error
status: experimental
description: Detects an issue in apache logs that reports threading related errors
author: Florian Roth
date: 2019/01/22
references:
- https://github.com/hannob/apache-uaf/blob/master/README.md
logsource:
product: apache
detection:
keywords:
- '__pthread_tpp_change_priority: Assertion `new_prio == -1 || (new_prio >= fifo_min_prio && new_prio <= fifo_max_prio)'
condition: keywords
falsepositives:
- https://bz.apache.org/bugzilla/show_bug.cgi?id=46185
level: medium
rules/web/web_cve_2018_2894_weblogic_exploit.yml
+30
View File
@@ -0,0 +1,30 @@
title: Oracle WebLogic Exploit
description: Detects access to a webshell droped into a keytore folder on the WebLogic server
author: Florian Roth
date: 2018/07/22
status: experimental
references:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2894
- https://twitter.com/pyn3rd/status/1020620932967223296
- https://github.com/LandGrey/CVE-2018-2894
logsource:
category: webserver
detection:
selection:
c-uri-path:
- '*/config/keystore/*.js*'
condition: selection
fields:
- c-ip
- c-dns
falsepositives:
- Unknown
tags:
- attack.t1100
- attack.t1190
- attack.initial_access
- attack.persistence
- attack.privilege_escalation
- cve.2018-2894
level: critical
rules/web/web_source_code_enumeration.yml
+20
View File
@@ -0,0 +1,20 @@
title: Source Code Enumeration Detection by Keyword
description: Detects source code enumeration that use GET requests by keyword searches in URL strings
author: James Ahearn
references:
- 'https://pentester.land/tutorials/2018/10/25/source-code-disclosure-via-exposed-git-folder.html'
- 'https://medium.com/@logicbomb_1/bugbounty-how-i-was-able-to-download-the-source-code-of-indias-largest-telecom-service-52cf5c5640a1'
logsource:
category: webserver
detection:
keywords:
- '*.git/*'
condition: keywords
fields:
- client_ip
- vhost
- url
- response
falsepositives:
- unknown
level: medium
rules/web/web_webshell_keyword.yml
+1 -1
View File
@@ -1,5 +1,5 @@
title: Webshell Detection by Keyword
description: Detects webshells that use GET requests by keyword sarches in URL strings
description: Detects webshells that use GET requests by keyword searches in URL strings
author: Florian Roth
logsource:
category: webserver
rules/windows/builtin/win_GPO_scheduledtasks.yml
+23
View File
@@ -0,0 +1,23 @@
title: Persistence and Execution at scale via GPO scheduled task
description: Detect lateral movement using GPO scheduled task, ususally used to deploy ransomware at scale
author: Samir Bousseaden
references:
- https://twitter.com/menasec1/status/1106899890377052160
tags:
- attack.persistence
- attack.lateral_movement
- attack.t1053
logsource:
product: windows
service: security
description: 'The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure'
detection:
selection:
EventID: 5145
ShareName: \\*\SYSVOL
RelativeTargetName: '*ScheduledTasks.xml'
Accesses: '*WriteData*'
condition: selection
falsepositives:
- if the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduledtasks
level: high
rules/windows/builtin/win_account_backdoor_dcsync_rights.yml
+25
View File
@@ -0,0 +1,25 @@
title: Powerview Add-DomainObjectAcl DCSync AD Extend Right
description: backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer
status: experimental
date: 2019/04/03
author: Samir Bousseaden
references:
- https://twitter.com/menasec1/status/1111556090137903104
- https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf
tags:
- attack.credential_access
- attack.persistence
logsource:
product: windows
service: security
detection:
selection:
EventID: 5136
LDAPDisplayName: 'ntSecurityDescriptor'
Value:
- '*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*'
- '*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*'
condition: selection
falsepositives:
- New Domain Controller computer account, check user SIDs witin the value attribute of event 5136 and verify if it's a regular user or DC computer account.
level: critical
rules/windows/builtin/win_account_discovery.yml
+34
View File
@@ -0,0 +1,34 @@
title: AD Privileged Users or Groups Reconnaissance
description: Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs
references:
- https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html
tags:
- attack.discovery
- attack.t1087
status: experimental
author: Samir Bousseaden
logsource:
product: windows
service: security
definition: 'Requirements: enable Object Access SAM on your Domain Controllers'
detection:
selection:
EventID: 4661
ObjectType:
- 'SAM_USER'
- 'SAM_GROUP'
ObjectName:
- '*-512'
- '*-502'
- '*-500'
- '*-505'
- '*-519'
- '*-520'
- '*-544'
- '*-551'
- '*-555'
- '*admin*'
condition: selection
falsepositives:
- if source account name is not an admin then its super suspicious
level: high
rules/windows/builtin/win_admin_rdp_login.yml
+9 -6
View File
@@ -1,21 +1,24 @@
title: Admin user remote login
title: Admin User Remote Logon
description: Detect remote login by Administrator user depending on internal pattern
reference:
- https://car.mitre.org/wiki/CAR-2016-04-005
references:
- https://car.mitre.org/wiki/CAR-2016-04-005
tags:
- attack.lateral_movement
- attack.t1078
- car.2016-04-005
status: experimental
author: juju4
logsource:
product: windows
service: security
description: 'Requirements: Identifiable administrators usernames (pattern or special unique character. ex: "Admin-*"), internal policy mandating use only as secondary account'
definition: 'Requirements: Identifiable administrators usernames (pattern or special unique character. ex: "Admin-*"), internal policy mandating use only as secondary account'
detection:
selection:
EventID: 4624
LogonType: 10
AuthenticationPackageName: Negotiate
Severity: Information
AccountName: 'Admin-*'
condition: selection
falsepositives:
falsepositives:
- Legitimate administrative activity
level: low

Some files were not shown because too many files have changed in this diff Show More