phantinuss
c125ae7e7d
remove: Abusing Findstr for Defense Evasion - Deprecate in favour of 2 splitted rules. 587254ee-a24b-4335-b3cd-065c0f1f4baa and 04936b66-3915-43ad-a8e5-809eadfd1141 remove: Windows Update Client LOLBIN - Deprecate in favour of 52d097e2-063e-4c9c-8fbb-855c8948d135 fix: Remote Thread Creation By Uncommon Source Image - Enhance filters to avoid false positives fix: Suspicious Shim Database Installation via Sdbinst.EXE - Add "null" and "empty" filters to account for cases where the CLI is null or empty new: Insenstive Subfolder Search Via Findstr.EXE new: Remote File Download Via Findstr.EXE new: Windows Defender Exclusion Deleted new: Windows Defender Exclusion List Modified new: Windows Defender Exclusion Reigstry Key - Write Access Requested update: Renamed Office Binary Execution - Add new binaries and filters to increase coverage and tune FPs update: EVTX Created In Uncommon Location - Enhance filters to cover other drives other than "C:" update: Findstr GPP Passwords - Add "find.exe" binary to increase coverage update: Findstr Launching .lnk File - Add "find.exe" binary to increase coverage update: LSASS Process Reconnaissance Via Findstr.EXE - Add "find.exe" binary to increase coverage update: Non-DLL Extension File Renamed With DLL Extension - Update title and logic update: Permission Misconfiguration Reconnaissance Via Findstr.EXE - Add "find.exe" binary to increase coverage update: Potentially Suspicious Wuauclt Network Connection - Change the logic to use the "CommandLine" field in order to avoid false positives update: Proxy Execution Via Wuauclt.EXE - Update title and enhance filters update: Recon Command Output Piped To Findstr.EXE - Add "find.exe" binary to increase coverage update: Security Tools Keyword Lookup Via Findstr.EXE - Add "find.exe" binary to increase coverage update: Suspicious Appended Extension - Enhance list of extension update: Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE - Add "find.exe" binary to increase coverage fix: Uncommon Userinit Child Process - Add the citrix process cmstart to the filtered processes and make it more strict to avoid abuse. Also enhances the other filters by removing the C: notation. fix: Bad Opsec Defaults Sacrificial Processes With Improper Arguments - Add FP filter for chrome installer spawning rundll32 without arguments --------- Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com> thanks: @vj-codes for #4554 thanks: @mezzofix for #4520 thanks: @rkmbaxed for #4566 and #4569 thanks: @celalettin-turgut for #4570
Sigma - Generic Signature Format for SIEM Systems
Welcome to the Sigma main rule repository. The place where detection engineers, threat hunters and all defensive security practitioners collaborate on detection rules. The repository offers more than 3000 detection rules of different type and aims to make reliable detections accessible to all at no cost.
Currently the repository offers three types of rules:
- Generic Detection Rules - Are threat agnostic, their aim is to detect a behavior or an implementation of a technique or procedure that was, can or will be used by a potential threat actor.
- Threat Hunting Rules - Are broader in scope and are meant to give the analyst a starting point to hunt for potential suspicious or malicious activity
- Emerging Threat Rules - Are rules that cover specific threats, that are timely and relevant for certain periods of time. These threats include specific APT campaigns, exploitation of Zero-Day vulnerabilities, specific malware used during an attack,...etc.
Explore Sigma
To start exploring the Sigma ecosystem, please visit the official website sigmahq.io
What is Sigma
Sigma is a generic and open signature format that allows you to describe relevant log events in a straightforward manner. The rule format is very flexible, easy to write and applicable to any type of log file.
The main purpose of this project is to provide a structured form in which researchers or analysts can describe their once developed detection methods and make them shareable with others.
Sigma is for log files what Snort is for network traffic and YARA is for files.
Why Sigma
Today, everyone collects log data for analysis. People start working on their own, processing numerous white papers, blog posts and log analysis guidelines, extracting the necessary information and build their own searches and dashboard. Some of their searches and correlations are great and very useful but they lack a standardized format in which they can share their work with others.
Others provide excellent analyses, include IOCs and YARA rules to detect the malicious files and network connections, but have no way to describe a specific or generic detection method in log events. Sigma is meant to be an open standard in which such detection mechanisms can be defined, shared and collected in order to improve the detection capabilities for everyone.
🌟 Key Features
- A continuously growing list of detection and hunting rules, peer reviewed by a community of professional Detection Engineers.
- Vendor agnostic detection rules.
- Easily shareable across communities and reports
🏗️ Rule Creation
To start writing Sigma rules please check the following guides:
🔎 Contributing & Making PRs
Please refer to the CONTRIBUTING guide for detailed instructions on how you can start contributing new rules.
📦 Rule Packages
You can download the latest rule packages from the release page and start leveraging Sigma rules today.
🧬 Rule Usage and Conversion
-
You can start converting Sigma rules today using Sigma CLI or sigconverter.io the GUI interface
-
To integrate Sigma rules in your own toolchain or products use pySigma.
🚨 Reporting False Positives or New Rule Ideas
If you find a false positive or would like to propose a new detection rule idea but do not have the time to create one, please create a new issue on the GitHub repository by selecting one of the available templates.
📚 Resources & Further Reading
- Hack.lu 2017 Sigma - Generic Signatures for Log Events by Thomas Patzke
- MITRE ATT&CK® and Sigma Alerting SANS Webcast Recording
- Sigma - Generic Signatures for SIEM Systems by Florian Roth
Projects or Products that use or integrate Sigma rules
- Atomic Threat Coverage (Since December 2018)
- Confluent Sigma - Kafka Streams supported Sigma rules
- IBM QRadar
- Joe Sandbox
- MISP (Since Version 2.4.70, March 2017)
- Nextron's Aurora Agent
- Nextron's THOR Scanner - Scan with Sigma rules on endpoints
- RANK VASA
- Sekoia.io XDR - XDR supporting Sigma and Sigma Correlation rules languages
- SIΣGMA - SIEM consumable generator that utilizes Sigma for query conversion
- SOC Prime
- TA-Sigma-Searches (Splunk App)
- TimeSketch
- ypsilon - Automated Use Case Testing
- alterix - Converts Sigma rules to the query language of CRYPTTECH's SIEM
📜 Maintainers
- Nasreddine Bencherchali (@nas_bench)
- Florian Roth (@cyb3rops)
- Christian Burkard (@phantinuss)
- François Hubaut (@frack113)
- Thomas Patzke (@blubbfiction)
Credits
This project would've never reached this height without the help of the hundreds of contributors. Thanks to all past and present contributors for their help.
Licenses
The content of this repository is released under the Detection Rule License (DRL) 1.1.