Files
blue-team-tools/rules-emerging-threats
Swachchhanda Shrawan Poudel 3359340f21 Merge PR #4763 from @swachchhanda000 - New rules related to Raspberry Robin TTPs
new: Potential Raspberry Robin Aclui Dll SideLoading
new: Potential Raspberry Robin Registry Set Internet Settings ZoneMap 

---------

Co-authored-by: Swachchhanda Shrawan Poudel <logpoint-admin@NP-SSP-MBP-01.local>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
2024-08-01 11:18:12 +02:00
..
2023-06-20 07:31:54 +02:00
2023-06-20 07:31:54 +02:00

Emerging Threats Rules

This folder contains rules that belongs to the "emerging-threats" category of SIGMA. This category aims to cover specific threats that are timely and relevant for certain periods of time. These threats include specific APT campaigns, exploitation of Zero-Day vulnerabilities, specific malware used during an attack,...etc.

The folder structure is split by year and every folder can contain two sub-folders

  • Exploits: Contains specific rules that cover exploitation of vulnerabilities.
  • Malware: Contains specific rules that cover malware, ransomware and any type of suspicious software used by Threat Actors or malicious actors
  • TA: Contains specific rules that cover APT, Threat Actor and malware activities.