security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
07d80c2b701ae222b828ae680bced9359be856b6
sigma-rules/rules_building_block
T
History
Jonhnathan 711e0f3ab7 [New Rule] New BBR Rules - Part 2 (#3029) 
* [New Rule] New BBR Rules - Part 2

* Update discovery_generic_account_groups.toml

* Update discovery_generic_account_groups.toml

* Update rules_building_block/defense_evasion_cmd_copy_binary_contents.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules_building_block/execution_downloaded_shortcut_files.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules_building_block/defense_evasion_cmd_copy_binary_contents.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update rules_building_block/defense_evasion_unusual_process_extension.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update defense_evasion_unusual_process_extension.toml

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

(cherry picked from commit ddb1f75352)
2023-09-13 00:54:52 +00:00
..
.gitkeep
[FR] Add support for building block rules (BBR) (#2822)
2023-06-20 09:00:30 -04:00
collection_archive_data_zip_imageload.toml
[New Rule] Unusual Process For MSSQL Service Accounts (#3040)
2023-08-29 12:16:12 +00:00
collection_files_staged_in_recycle_bin_root.toml
[New Rule] New BBR Rules - Part 4 (#3035)
2023-08-29 11:55:07 +00:00
collection_linux_suspicious_clipboard_activity.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
collection_outlook_email_archive.toml
[New Rule] New BBR Rules - Part 1 (#3026)
2023-09-05 21:14:06 +00:00
collection_posh_compression.toml
[Rule Tuning] Windows BBR Rules (#3018)
2023-08-25 08:26:51 +00:00
collection_posh_webcam_video_capture.toml
[New Rule] PowerShell Script with Webcam Video Capture Capabilities (#2935)
2023-08-09 15:17:15 -03:00
command_and_control_bitsadmin_activity.toml
[New Rule] New BBR Rules - Part 1 (#3026)
2023-09-05 21:14:06 +00:00
command_and_control_linux_proxychains_activity.toml
[New Rules] Linux Tunneling and Port Forwarding (#3028)
2023-08-30 20:17:43 +00:00
command_and_control_linux_ssh_x11_forwarding.toml
[New Rules] Linux Tunneling and Port Forwarding (#3028)
2023-08-30 20:17:43 +00:00
command_and_control_non_standard_http_port.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
credential_access_gdb_memory_dump.toml
[New Rules] GDB Secret Dumping (#3060)
2023-08-31 15:47:30 +00:00
credential_access_kirbi_file.toml
[New Rule] New BBR Rules - Part 3 (#3034)
2023-09-13 00:34:12 +00:00
credential_access_win_private_key_access.toml
[New Rule] New BBR Rules - Part 1 (#3026)
2023-09-05 21:14:06 +00:00
defense_evasion_cmd_copy_binary_contents.toml
[New Rule] New BBR Rules - Part 2 (#3029)
2023-09-13 00:54:52 +00:00
defense_evasion_cmstp_execution.toml
[New Rule] New BBR Rules - Part 4 (#3035)
2023-08-29 11:55:07 +00:00
defense_evasion_communication_apps_suspicious_child_process.toml
[New Rule] Suspicious Communication App Child Process (#2998)
2023-08-31 10:38:57 +00:00
defense_evasion_creation_of_hidden_files_directories.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
defense_evasion_disable_nla.toml
[New Rule] Network-Level Authentication (NLA) Disabled (#3039)
2023-08-28 11:11:26 +00:00
defense_evasion_dll_hijack.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
defense_evasion_file_permission_modification.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
defense_evasion_generic_deletion.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
defense_evasion_indirect_command_exec_pcalua_forfiles.toml
[New Rule] New BBR Rules - Part 4 (#3035)
2023-08-29 11:55:07 +00:00
defense_evasion_installutil_command_activity.toml
[New Rule] New BBR Rules - Part 4 (#3035)
2023-08-29 11:55:07 +00:00
defense_evasion_masquerading_browsers.toml
[New Rule] Potential Masquerading as Browser Process (#2995)
2023-08-28 16:34:26 +00:00
defense_evasion_masquerading_business_apps_installer.toml
[New Rule] Potential Masquerading as Business App Installer (#3068)
2023-09-05 21:04:26 +00:00
defense_evasion_masquerading_communication_apps.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
defense_evasion_masquerading_vlc_dll.toml
[New Rule] Potential Masquerading as VLC DLL (#3006)
2023-08-30 20:51:39 +00:00
defense_evasion_masquerading_windows_dll.toml
[New Rule] Potential Masquerading as Windows System32 DLL (#3021)
2023-08-28 11:37:53 +00:00
defense_evasion_masquerading_windows_system32_exe.toml
[New Rule] Potential Masquerading as Windows System32 Executable (#3022)
2023-08-21 18:20:06 +00:00
defense_evasion_powershell_clear_logs_script.toml
[New Rule] Building Block Rules - Part 1 (#2912)
2023-07-18 20:01:43 -03:00
defense_evasion_processes_with_trailing_spaces.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
defense_evasion_service_disabled_registry.toml
[New Rule] New BBR Rules - Part 5 (#3052)
2023-09-05 21:42:38 +00:00
defense_evasion_service_path_registry.toml
[New Rule] New BBR Rules - Part 5 (#3052)
2023-09-05 21:42:38 +00:00
defense_evasion_services_exe_path.toml
[New Rule] New BBR Rules - Part 5 (#3052)
2023-09-05 21:42:38 +00:00
defense_evasion_unusual_process_extension.toml
[New Rule] New BBR Rules - Part 2 (#3029)
2023-09-13 00:54:52 +00:00
defense_evasion_unusual_process_path_wbem.toml
[New Rule] New BBR Rules - Part 3 (#3034)
2023-09-13 00:34:12 +00:00
defense_evasion_write_dac_access.toml
[New Rule][BBR] WRITEDAC Access on Active Directory Object (#3015)
2023-08-31 16:04:58 +00:00
discovery_generic_account_groups.toml
[New Rule] New BBR Rules - Part 5 (#3052)
2023-09-05 21:42:38 +00:00
discovery_generic_process_discovery.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
discovery_generic_registry_query.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
discovery_hosts_file_access.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
discovery_internet_capabilities.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
discovery_kernel_module_enumeration_via_proc.toml
[Rule Tuning] Several rule tunings (#3024)
2023-08-25 12:09:16 +00:00
discovery_linux_modprobe_enumeration.toml
[Rule Tuning] Several rule tunings (#3024)
2023-08-25 12:09:16 +00:00
discovery_linux_sysctl_enumeration.toml
[Rule Tuning] Several rule tunings (#3024)
2023-08-25 12:09:16 +00:00
discovery_linux_system_information_discovery.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
discovery_linux_system_owner_user_discovery.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
discovery_net_share_discovery_winlog.toml
[New Rule] Building Block Rules - Part 4 (#2926)
2023-07-31 11:03:57 -03:00
discovery_of_accounts_or_groups_via_builtin_tools.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
discovery_of_domain_groups.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
discovery_posh_generic.toml
[Rule Tuning] Windows BBR Rules (#3018)
2023-08-25 08:26:51 +00:00
discovery_posh_password_policy.toml
[New Rule] Building Block Rules - Part 2 (#2923)
2023-08-17 16:06:41 +00:00
discovery_process_discovery_via_builtin_tools.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
discovery_suspicious_proc_enumeration.toml
[Rule Tuning] Several rule tunings (#3024)
2023-08-25 12:09:16 +00:00
discovery_suspicious_which_command_execution.toml
[New BBR] Suspicious which Enumeration (#3059)
2023-08-31 12:01:57 +00:00
discovery_system_network_connections.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
discovery_win_network_connections.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
discovery_windows_system_information_discovery.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
execution_downloaded_shortcut_files.toml
[New Rule] New BBR Rules - Part 2 (#3029)
2023-09-13 00:54:52 +00:00
execution_downloaded_url_file.toml
[New Rule] New BBR Rules - Part 3 (#3034)
2023-09-13 00:34:12 +00:00
execution_mofcomp.toml
[New Rule] New BBR Rules - Part 2 (#3029)
2023-09-13 00:54:52 +00:00
execution_settingcontent_ms_file_creation.toml
[New Rule] New BBR Rules - Part 4 (#3035)
2023-08-29 11:55:07 +00:00
execution_unsigned_service_executable.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
execution_wmi_wbemtest.toml
[New Rule] New BBR Rules - Part 3 (#3034)
2023-09-13 00:34:12 +00:00
initial_access_cross_site_scripting.toml
Potential Cross Site Scripting ( XSS ) (#2922)
2023-07-20 19:12:00 +05:30
initial_access_unusual_process_sql_accounts.toml
[New Rule] Unusual Process For MSSQL Service Accounts (#3040)
2023-08-29 12:16:12 +00:00
lateral_movement_at.toml
[New Rule] New BBR Rules - Part 1 (#3026)
2023-09-05 21:14:06 +00:00
lateral_movement_posh_winrm_activity.toml
[New Rule] Building Block Rules - Part 2 (#2923)
2023-08-17 16:06:41 +00:00
lateral_movement_rdp_conn_unusual_process.toml
[New Rule] New BBR Rules - Part 5 (#3052)
2023-09-05 21:42:38 +00:00
lateral_movement_wmic_remote.toml
[New Rule] New BBR Rules - Part 3 (#3034)
2023-09-13 00:34:12 +00:00
persistence_browser_extension_install.toml
[New Rule] New BBR Rules - Part 1 (#3026)
2023-09-05 21:14:06 +00:00
persistence_creation_of_kernel_module.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
persistence_msoffice_startup_registry.toml
[New Rule] New BBR Rules - Part 2 (#3029)
2023-09-13 00:54:52 +00:00
persistence_netsh_helper_dll.toml
[New Rule] New BBR Rules - Part 5 (#3052)
2023-09-05 21:42:38 +00:00
persistence_startup_folder_lnk.toml
[New Rule] New BBR Rules - Part 5 (#3052)
2023-09-05 21:42:38 +00:00
persistence_suspicious_file_opened_through_editor.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
persistence_transport_agent_exchange.toml
[New Rule] Building Block Rules - Part 4 (#2926)
2023-07-31 11:03:57 -03:00
persistence_werfault_reflectdebugger.toml
[New Rule] New BBR Rules - Part 5 (#3052)
2023-09-05 21:42:38 +00:00
privilege_escalation_expired_driver_loaded.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
privilege_escalation_trap_execution.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00
privilege_escalation_unquoted_service_path.toml
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
2023-09-05 18:28:40 +00:00