security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
982 Commits 1 Branch 0 Tags
2ed97d2e8c38fe776b16a316a2d048cdb0ec52ca
Commit Graph

340 Commits

Author SHA1 Message Date
Terrance DeJesus 096723b2a1 [Rule Tuning] Symbolic Link to Shadow Copy Created (#1830) 
* fixed duplicated file name

* deprecated Symbolic Link to Shadow Copy Created as it may be prone to FP and the intrusion steps are covered with NTDS or SAM Database File Copied

* moved rule back to production, added investigation notes and sequencing to EQL query

* added related rule 3bc6deaa-fbd4-433a-ae21-3e892f95624f to investigation notes

* updating with minor changes

* adjusted related rules

* adjusted investigation notes

* Update rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* TOML linted and adjusted updated date

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2022-03-18 11:08:29 -04:00
Jonhnathan 22dd7f0ada Deprecate PrintNightmare Rules (#1852) 2022-03-17 19:39:36 -03:00
Jonhnathan a6edb7cfcf Update defense_evasion_posh_process_injection.toml (#1838) 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-03-17 19:37:42 -03:00
Jonhnathan e0f8f61ca0 Update persistence_user_account_added_to_privileged_group_ad.toml (#1845) 2022-03-16 13:06:04 -03:00
Jonhnathan b5f06f455c Update defense_evasion_microsoft_defender_tampering.toml (#1837) 2022-03-14 20:07:39 -03:00
Jonhnathan 53fbc50ea1 [New Rule] AdminSDHolder SDProp Exclusion Added (#1795) 
* AdminSDHolder SDProp Exclusion Added Initial Rule

* Update persistence_sdprop_exclusion_dsheuristics.toml

* Update rules/windows/persistence_sdprop_exclusion_dsheuristics.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2022-03-10 14:17:01 -03:00
Samirbous a6582351b5 [New Rule] Potential Remote Credential Access via Registry (#1804) 
* [New Rule] Potential Remote Credential Access via Registry

4624 logon followed by hive file creation by regsvc svchost.exe by same user.name and host.id. This matches on secretdsdump and other similar implementations. require to correlation Elastic endpoint file events with System integration logs (4624).

Example of data :

* Delete workspace.xml

* Update credential_access_remote_sam_secretsdump.toml

* Update credential_access_remote_sam_secretsdump.toml

* add non ecs field

* Update non-ecs-schema.json

* Update credential_access_remote_sam_secretsdump.toml

* Update rules/windows/credential_access_remote_sam_secretsdump.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/credential_access_remote_sam_secretsdump.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/credential_access_remote_sam_secretsdump.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-03-03 16:28:03 +01:00
Terrance DeJesus 202b9c7479 [New Rule] Execution control.exe via WorkFolders.exe (#1806) 
* added detection rule defense_evasion_workfolders_control_execution.toml related to issue #1586

* updated rule authors

* added references to the rule

* added timestamp override variable to the rule

* adjusted value of timestamp override from event_ingested to event.ingested

* Update rules/windows/defense_evasion_workfolders_control_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/defense_evasion_workfolders_control_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/defense_evasion_workfolders_control_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/defense_evasion_workfolders_control_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/defense_evasion_workfolders_control_execution.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/windows/defense_evasion_workfolders_control_execution.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* linted toml file as suggested

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-03-03 09:21:40 -05:00
Jonhnathan 5c477849fe [Rule Tuning] Update PowerShell script_block queries to avoid partial matches (#1807) 
* Update script_block queries

* Update execution_posh_psreflect.toml
 2022-03-03 07:37:25 -03:00
Samirbous f48144c6b3 [New Rule] Registry Hive File Creation via SMB (#1779) 
* [New Rule] Registry Hive File Creation via SMB

Identifies the creation or modification of a medium size registry hive file via the SMB protocol :

* Update credential_access_moving_registry_hive_via_smb.toml

* Update etc/non-ecs-schema.json

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-03-02 10:12:17 +01:00
Jonhnathan 1c50f35aed [Security Content] Update rules based on docs review (#1803) 
* Adds suggestions from security-docs

* Update rules/windows/lateral_movement_powershell_remoting_target.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2022-03-01 21:39:30 -03:00
Mika Ayenson aa7d79cc53 [New Rule] LSASS Memory Dump (#1784) 
* Add new event_data fields (ObjectName, ProcessName)

* Add detection for LSASS Memory Dump Handle Access

* Reference an example of 120089 AccessMask presence

* modify query to increase performance and update the description to remove ("This rule").

* expand path to Elastic Agent ensure syntax consistency

* Optimize rule based on AccessMaskDescription and additional False Positives.

* add AccessMaskDescription keyword and rule tune to make sure AccessMask is used

* filter dllhost.exe and or the condition between AccessMask and AccessMaskDescription

* cleanup
 2022-02-24 08:14:01 -05:00
Jonhnathan dec4243db0 [Rule Tuning] Update rules based on docs review (#1778) 
* Update rules based on docs review

* trivial change to trigger CLA

* undo changes from triggering build

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-02-16 07:42:06 -09:00
Jonhnathan 3227d65cd8 [Rule Tuning] Remove Windows Integration & Winlogbeat Support - User.id (#1773) 
* Remove Windows Integration & Winlogbeat Support

* Update lateral_movement_service_control_spawned_script_int.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-02-15 23:04:55 -03:00
Jonhnathan 03f60cc11c [Rule Tuning] Potential Command and Control via Internet Explorer (#1771) 
* Use user.name on the sequence instead of user.id

* Update command_and_control_iexplore_via_com.toml

* Remove min_stack and comment "with runs"

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-02-15 22:58:01 -03:00
Jonhnathan 42436d3364 [New Rule] Potential Credential Access via DCSync (#1763) 
* "Potential Credential Access via DCSync" Initial Rule

* replace unintentional bracket removal

* json

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-02-15 21:40:26 -03:00
Jonhnathan fd678dc5cb Modified to use Integrity fields instead of user.id (#1772) 2022-02-15 15:22:49 -09:00
Jonhnathan 9bbe26fec0 [Rule Tuning] Sysmon Registry-based Rules Review & Fixes (#1775) 
* Initial Review of Sysmon Registry Rules

* Update defense_evasion_sip_provider_mod.toml
 2022-02-15 09:56:37 -03:00
Jonhnathan c646a18efb Update discovery_net_command_system_account.toml (#1769) 2022-02-14 12:11:12 -03:00
Samirbous 326aa64ff6 [New Rule] Windows Service Installed via an Unusual Client (#1759) 
* [New Rule] Windows Service Installed via an Unusual Client

https://www.x86matthew.com/view_post?id=create_svc_rpc

* Update non-ecs-schema.json

* Update rules/windows/privilege_escalation_windows_service_via_unusual_client.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/privilege_escalation_windows_service_via_unusual_client.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Add ```s

* Update privilege_escalation_windows_service_via_unusual_client.toml

* add missing comma to schema

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-02-11 21:56:59 +01:00
Jonhnathan 9c56b00429 Modification of AmsiEnable Registry Key - Sysmon support (#1760) 2022-02-11 17:49:38 -03:00
Jonhnathan aa9fedd18d Update impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml (#1757) 2022-02-11 08:15:49 -09:00
Jonhnathan 85b72256c2 [New Rule] Potential Shadow Credentials added to AD Object (#1729) 
* Potential Shadow Credentials added to AD Object Initial Rule

* Apply suggestions from code review

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update credential_access_shadow_credentials.toml

* Add AD tag

* Update credential_access_shadow_credentials.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-02-04 15:49:04 -03:00
Jonhnathan 7dac52f1cf [New Rule] PowerShell Script Block Logging Disabled (#1749) 
* PowerShell Script Block Logging Disabled

* Update rules/windows/defense_evasion_disable_posh_scriptblocklogging.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update defense_evasion_disable_posh_scriptblocklogging.toml

* Apply suggestions from code review

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-02-04 15:44:27 -03:00
Jonhnathan 40095d95bf Update credential_access_mod_wdigest_security_provider.toml (#1751) 2022-02-04 15:38:12 -03:00
Jonhnathan 9ce5d0b92a [New Rule] AdminSDHolder Backdoor (#1745) 
* AdminSDHolder Backdoor

* Update rules/windows/persistence_ad_adminsdholder.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-02-01 10:14:39 -03:00
Jonhnathan d949fefe0c [New Rule] KRBTGT Delegation Backdoor (#1743) 
* KRBTGT Delegation Backdoor

* Update persistence_msds_alloweddelegateto_krbtgt.toml

* Update non-ecs-schema.json

* Update rules/windows/persistence_msds_alloweddelegateto_krbtgt.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* refresh rule_id with new uuid

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-02-01 10:08:54 -03:00
Jonhnathan 6e3f4b2824 [New Rule] Kerberos Preauthentication Disabled for User (#1717) 
* Initial "Kerberos Preauthentication Disabled for User" Rule

* Update credential_access_disable_kerberos_preauth.toml

* Update credential_access_disable_kerberos_preauth.toml

* Apply suggestions from code review

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Add config directives

* Update rules/windows/credential_access_disable_kerberos_preauth.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-01-31 12:31:20 -03:00
Jonhnathan 25ec71579d [New Rule] SeEnableDelegationPrivilege assigned to User (#1737) 
* SeEnableDelegationPrivilege assigned to User

* Apply suggestions from code review

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Fix logging policy name

* Update rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* lint

* Update credential_access_seenabledelegationprivilege_assigned_to_user.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-01-31 12:22:54 -03:00
Justin Ibarra 72c64de3f5 [Rule tuning] Update rules based on docs review (#1663) 
* [Rule tuning] Update rule verbiage based on docs review

* fix typos

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* revert TI rule changes since it was deprecated

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
 2022-01-28 10:41:22 -09:00
Jonhnathan edd0df5e1a [New Rule] PowerShell Kerberos Ticket Request (#1715) 
* PowerShell Kerberos Ticket Request Initial Rule

* bump date
 2022-01-27 16:36:02 -03:00
Jonhnathan b6cbdbd416 [New Rule] MS Office Macro Security Registry Modifications (#1696) 
* "MS Office Macro Security Registry Modifications" Initial Rule

* Update rules/windows/defense_evasion_ms_office_suspicious_regmod.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-01-27 16:24:41 -03:00
Samirbous 26fb8e83a5 [New Rule] Potential Privileged Escalation via SamAccountName Spoofing (#1660) 
* [New Rule] Potential Privileged Escalation via SamAccountName Spoofing

Identifies a suspicious computer account name rename event, this may indicate an attempt to exploit CVE-2021-42278 to elevated privileges from standard domain user to domain admin privileges. CVE-2021-42278 is a security vulnerability that allows potential attackers to impersonate a domain controller using computer account sAMAccountName spoofing.

https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/
https://github.com/cube0x0/noPac

EQL

```
iam where event.action == "renamed-user-account" and
  /* machine account name renamed to user like account name */
  winlog.event_data.OldTargetUserName : "*$" and not winlog.event_data.NewTargetUserName : "*$"
```

* Create privilege_escalation_samaccountname_spoofing_attack.toml

* Update non-ecs-schema.json

* extra ref

* toml linted

* ref for MS kb5008102

* more ref

* Update rules/windows/privilege_escalation_samaccountname_spoofing_attack.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/privilege_escalation_samaccountname_spoofing_attack.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update non-ecs-schema.json

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-01-27 15:46:27 +01:00
Jonhnathan 1699f50beb Update credential_access_suspicious_lsass_access_memdump.toml (#1714) 2022-01-27 09:28:16 -03:00
Jonhnathan 4ac824192f Update source.ip condition (#1712) 2022-01-27 09:24:55 -03:00
Jonhnathan 95e3b87faf [New Rule] Startup/Logon Script added to Group Policy Object (#1607) 
* "Startup/Logon Script added to Group Policy Object" Initial Rule

* Change severity

* nest non-ecs schema and move logs-system to winlogbeat

* format query and remove quotes

* Update rules/windows/privilege_escalation_group_policy_iniscript.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Add rule_ids and false_positives instance

Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
 2022-01-20 09:11:23 -03:00
Jonhnathan 49854aaae2 [Rule Tuning] Add Investigation Guides, Config/Logging Policy to PowerShell merged rules (#1610) 
* Add Investigation Guide and config to Suspicious Portable Executable Encoded in Powershell Script

* Add Investigation Guide and config to "PowerShell Suspicious Discovery Related Windows API Functions" rule

* Add Investigation Guide and Config to "PowerShell MiniDump Script" rule

* Add logging policy reference

* Add Investigation Guide/Config to "PowerShell Suspicious Script with Audio Capture Capabilities"

* Add Related Rules GUIDs

* Add Investigation Guide/config for "Potential Process Injection via PowerShell"

* Adjust Response and remediation

* Add Investigation Guide/config for "PowerShell Keylogging Script"

* bump updated_date

* Apply suggestions from Samir

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Apply suggestions

* Revise line from investigation guides

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2022-01-20 08:56:53 -03:00
Jonhnathan 7fa0c0f719 [New Rule] Potential Priivilege Escalation via InstallerFileTakeOver (#1629) 
* Create privilege_escalation_installertakeover.toml

* Update privilege_escalation_installertakeover.toml

* Update privilege_escalation_installertakeover.toml

* Update privilege_escalation_installertakeover.toml

* Update rules/windows/privilege_escalation_installertakeover.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/privilege_escalation_installertakeover.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update description and change OFN from : to ==

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-01-20 08:53:58 -03:00
Jonhnathan d7116485f3 [New Rule] Group Policy Abuse for Privilege Addition (#1603) 
* "Group Policy Abuse for Privilege Addition" Initial Rule

* Update privilege_escalation_group_policy_privileged_groups.toml

* Add related rules

* fix missing comma

* Update non-ecs-schema.json

* Remove duplicated entries

* update note with code format

* Update rules/windows/privilege_escalation_group_policy_privileged_groups.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-01-20 08:40:52 -03:00
Jonhnathan 865771886e [New Rule] Scheduled Task Execution at Scale via GPO (#1605) 
* "Scheduled Task Execution at Scale via GPO" Initial Rule
* Update non-ecs-schema.json
 2022-01-19 16:06:48 -09:00
Jonhnathan 7bbeaf3053 [New Rule] PowerShell PSReflect Script (#1558) 2022-01-19 15:31:08 -09:00
Samirbous 6a0164cbd3 [Rule Tuning] Connection to Commonly Abused Web Services (#1708) 
Added Discord domains often abused to stage malicious files.
 2022-01-17 14:52:26 -03:00
Austin Songer fd824d1fd5 [New Rule] Microsoft Defender Tampering (#1575) 
* Create defense_evasion_microsoft_defender_tampering.toml

* Update defense_evasion_microsoft_defender_tampering.toml

* Update defense_evasion_microsoft_defender_tampering.toml

* Update defense_evasion_microsoft_defender_tampering.toml

* Update rules/windows/defense_evasion_microsoft_defender_tampering.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/defense_evasion_microsoft_defender_tampering.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/defense_evasion_microsoft_defender_tampering.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/defense_evasion_microsoft_defender_tampering.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update defense_evasion_microsoft_defender_tampering.toml

* Update defense_evasion_microsoft_defender_tampering.toml

* Update rules/windows/defense_evasion_microsoft_defender_tampering.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update defense_evasion_microsoft_defender_tampering.toml

* Update defense_evasion_microsoft_defender_tampering.toml

* Update defense_evasion_microsoft_defender_tampering.toml

* Update defense_evasion_microsoft_defender_tampering.toml

* Update rules/windows/defense_evasion_microsoft_defender_tampering.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/defense_evasion_microsoft_defender_tampering.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update defense_evasion_microsoft_defender_tampering.toml

* Update rules/windows/defense_evasion_microsoft_defender_tampering.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/defense_evasion_microsoft_defender_tampering.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/defense_evasion_microsoft_defender_tampering.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2022-01-13 19:50:01 -03:00
Jonhnathan cbf0798646 [Rule Tuning] Change Rules to use Source.ip instead of source.address (#1704) 
* Replace source.address to source.ip for compatibility

* Change query

* Missing and condition
 2022-01-13 16:40:10 -03:00
Austin Songer 25327134a6 [New Rule] Shadowcopy via Symlink (#1675) 
* Create credential_access_shadowcopy_via_symlink.toml

* Update credential_access_shadowcopy_via_symlink.toml

* Update and rename credential_access_shadowcopy_via_symlink.toml to credential_access_shadowcopy_via_mklink.toml

* Update credential_access_shadowcopy_via_mklink.toml

* Update rules/windows/credential_access_shadowcopy_via_mklink.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/credential_access_shadowcopy_via_mklink.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/credential_access_shadowcopy_via_mklink.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update credential_access_shadowcopy_via_mklink.toml

* Rename credential_access_shadowcopy_via_mklink.toml to credential_access_symbolic_link_to_shadow_copy_createdcredential_access_symbolic_link_to_shadow_copy_created.toml

* Update credential_access_symbolic_link_to_shadow_copy_createdcredential_access_symbolic_link_to_shadow_copy_created.toml

* Apply suggestions from code review

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2022-01-12 07:52:37 -03:00
Jonhnathan 899642dd78 [New Rule] PowerShell Suspicious Script with Screenshot Capabilities (#1581) 
* Create collection_posh_screen_grabber.toml

* Update collection_posh_screen_grabber.toml

* Update collection_posh_screen_grabber.toml

* Update collection_posh_screen_grabber.toml

* Update rules/windows/collection_posh_screen_grabber.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update query condition

* lint

* Update execution_python_tty_shell.toml

* Revert "Update execution_python_tty_shell.toml"

This reverts commit d2d72ea5726415caca8786d59446b6dd60dcee54.

* Update collection_posh_screen_grabber.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2021-12-14 19:30:45 -03:00
Jonhnathan f2a28e49fb [New Rules] PowerShell Suspicious Payload Encoded and Compressed (#1580) 
* Create defense_evasion_posh_compressed.toml

* Update defense_evasion_posh_compressed.toml

* Add GzipStream, cover common variations withou using wildcard

* Update defense_evasion_posh_compressed.toml

* Apply suggestions from code review

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Add false_positives

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2021-12-14 19:25:11 -03:00
Jonhnathan d4e06beee6 [New Rule] PowerShell Reflection Assembly Load (#1559) 
* Create defense_evasion_posh_assembly_load.toml

* Update defense_evasion_posh_assembly_load.toml

* Update rules/windows/defense_evasion_posh_assembly_load.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Change event.code to event.category

* Update rules/windows/defense_evasion_posh_assembly_load.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2021-12-08 17:59:17 -03:00
Jonhnathan ee548328d5 [Rule Tuning] Powershell Defender Exclusion (#1644) 
* Split process.args condition

* Update rules/windows/defense_evasion_defender_exclusion_via_powershell.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2021-12-08 11:51:32 -03:00
Samirbous b85818f49c [New Rule] Enumeration of Privileged Local Groups Membership (#1557) 
* [New Rule] Enumeration of Privileged Local Groups Membership

* Update non-ecs-schema.json

* Update discovery_privileged_localgroup_membership.toml

* removed endpoint index (not needed)

* Update rules/windows/discovery_privileged_localgroup_membership.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2021-12-08 11:23:42 +01:00