sigma-rules

.gitkeep

[FR] Add support for building block rules (BBR) (#2822 )

2023-06-20 09:00:30 -04:00

collection_archive_data_zip_imageload.toml

[New Rule] Unusual Process For MSSQL Service Accounts (#3040 )

2023-08-29 09:10:25 -03:00

collection_common_compressed_archived_file.toml

[New Rule] File Compressed or Archived into Common Format (#3173 )

2023-10-11 11:34:34 -07:00

collection_files_staged_in_recycle_bin_root.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

collection_linux_suspicious_clipboard_activity.toml

[Rule Tuning] Update timestamp_override Unit Tests and Fix Rules Missing Field (#3368 )

2024-01-17 14:14:38 -05:00

collection_outlook_email_archive.toml

[New Rule] New BBR Rules - Part 1 (#3026 )

2023-09-05 18:07:47 -03:00

collection_posh_compression.toml

Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157 )

2023-10-30 16:53:04 +05:30

collection_posh_webcam_video_capture.toml

Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157 )

2023-10-30 16:53:04 +05:30

command_and_control_bitsadmin_activity.toml

[New Rule] New BBR Rules - Part 1 (#3026 )

2023-09-05 18:07:47 -03:00

command_and_control_certutil_network_connection.toml

[Security Content] Introduce Investigate Plugin in Investigation Guides (#3080 )

2023-12-08 11:54:40 -07:00

command_and_control_linux_proxychains_activity.toml

[Security Content] Add Investigation Guides to Linux C2 Rules (#3247 )

2023-12-18 17:02:40 +01:00

command_and_control_linux_ssh_x11_forwarding.toml

[Security Content] Add Investigation Guides to Linux C2 Rules (#3247 )

2023-12-18 17:02:40 +01:00

command_and_control_non_standard_http_port.toml

[Security Content] Add Investigation Guides to Linux C2 Rules (#3247 )

2023-12-18 17:02:40 +01:00

credential_access_gdb_memory_dump.toml

[New Rules] GDB Secret Dumping (#3060 )

2023-08-31 17:41:22 +02:00

credential_access_kirbi_file.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

credential_access_mdmp_file_creation.toml

[New Rule] [BBR] Memory Dump File Rules (#3122 )

2023-10-17 09:35:38 -03:00

credential_access_mdmp_file_unusual_extension.toml

[New Rule] [BBR] Memory Dump File Rules (#3122 )

2023-10-17 09:35:38 -03:00

credential_access_win_private_key_access.toml

[New Rule] New BBR Rules - Part 1 (#3026 )

2023-09-05 18:07:47 -03:00

defense_evasion_cmd_copy_binary_contents.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

defense_evasion_cmstp_execution.toml

[New Rule] New BBR Rules - Part 4 (#3035 )

2023-08-29 08:49:22 -03:00

defense_evasion_collection_masquerading_unusual_archive_file_extension.toml

[New Rules] [BBR] Windows Deprecated ERs Conversion - 1 (#3131 )

2023-10-17 11:36:53 -03:00

defense_evasion_communication_apps_suspicious_child_process.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

defense_evasion_creation_of_hidden_files_directories.toml

[Security Content] Include "Data Source: Elastic Defend" tag (#3002 )

2023-09-05 14:22:01 -04:00

defense_evasion_disable_nla.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

defense_evasion_dll_hijack.toml

[Rule Tuning] Potential Masquerading as System32 DLL (#3184 )

2023-10-17 08:29:08 -03:00

defense_evasion_dotnet_clickonce_dfsvc_netcon.toml

[New Rules] [BBR] Windows Deprecated ERs Conversion - 1 (#3131 )

2023-10-17 11:36:53 -03:00

defense_evasion_download_susp_extension.toml

[New Rule] [BBR] File with Suspicious Extension Downloaded (#3139 )

2023-09-27 12:37:11 -03:00

defense_evasion_execution_via_visualstudio_prebuildevent.toml

[New Rules] [BBR] Windows Deprecated ERs Conversion - 2 (#3138 )

2023-10-17 13:49:49 -03:00

defense_evasion_file_permission_modification.toml

[Security Content] Include "Data Source: Elastic Defend" tag (#3002 )

2023-09-05 14:22:01 -04:00

defense_evasion_generic_deletion.toml

[Security Content] Include "Data Source: Elastic Defend" tag (#3002 )

2023-09-05 14:22:01 -04:00

defense_evasion_indirect_command_exec_pcalua_forfiles.toml

[New Rule] New BBR Rules - Part 4 (#3035 )

2023-08-29 08:49:22 -03:00

defense_evasion_injection_from_msoffice.toml

[New Rules] [BBR] Windows Deprecated ERs Conversion - 1 (#3131 )

2023-10-17 11:36:53 -03:00

defense_evasion_installutil_command_activity.toml

[New Rule] New BBR Rules - Part 4 (#3035 )

2023-08-29 08:49:22 -03:00

defense_evasion_invalid_codesign_imageload.toml

[New Rules] [BBR] Windows Deprecated ERs Conversion - 3 (#3143 )

2023-10-17 14:16:28 -03:00

defense_evasion_masquerading_browsers.toml

[Rule Tuning] Potential Masquerading as Browser Process (#3180 )

2023-10-17 08:53:37 -03:00

defense_evasion_masquerading_business_apps_installer.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

defense_evasion_masquerading_unusual_exe_file_extension.toml

[New Rules] [BBR] Windows Deprecated ERs Conversion - 1 (#3131 )

2023-10-17 11:36:53 -03:00

defense_evasion_masquerading_vlc_dll.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

defense_evasion_masquerading_windows_dll.toml

[Rule Tuning] Potential Masquerading as System32 DLL (#3184 )

2023-10-17 08:29:08 -03:00

defense_evasion_masquerading_windows_system32_exe.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

defense_evasion_msdt_suspicious_diagcab.toml

[New Rules] [BBR] Windows Deprecated ERs Conversion - 2 (#3138 )

2023-10-17 13:49:49 -03:00

defense_evasion_msiexec_installsource_archive_file.toml

[New Rules] [BBR] Windows Deprecated ERs Conversion - 2 (#3138 )

2023-10-17 13:49:49 -03:00

defense_evasion_powershell_clear_logs_script.toml

Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157 )

2023-10-30 16:53:04 +05:30

defense_evasion_processes_with_trailing_spaces.toml

[Security Content] Include "Data Source: Elastic Defend" tag (#3002 )

2023-09-05 14:22:01 -04:00

defense_evasion_service_disabled_registry.toml

[New Rule] New BBR Rules - Part 5 (#3052 )

2023-09-05 18:36:34 -03:00

defense_evasion_service_path_registry.toml

[New Rule] New BBR Rules - Part 5 (#3052 )

2023-09-05 18:36:34 -03:00

defense_evasion_services_exe_path.toml

[New Rule] New BBR Rules - Part 5 (#3052 )

2023-09-05 18:36:34 -03:00

defense_evasion_sus_utility_executed_via_tmux_or_screen.toml

[Tuning] Small Linux DR Tuning (#3287 )

2023-12-07 12:45:24 +01:00

defense_evasion_suspicious_msiexec_execution.toml

[New Rules] [BBR] Windows Deprecated ERs Conversion - 2 (#3138 )

2023-10-17 13:49:49 -03:00

defense_evasion_unsigned_bits_client.toml

[New Rules] [BBR] Windows Deprecated ERs Conversion - 2 (#3138 )

2023-10-17 13:49:49 -03:00

defense_evasion_unusual_process_extension.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

defense_evasion_unusual_process_path_wbem.toml

[New Rule] New BBR Rules - Part 3 (#3034 )

2023-09-12 21:28:01 -03:00

defense_evasion_write_dac_access.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

discovery_capnetraw_capability.toml

Linux Process Capabilities Enrichment Detection Rules (#3366 )

2024-01-18 22:49:43 +05:30

discovery_files_dir_systeminfo_via_cmd.toml

Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157 )

2023-10-30 16:53:04 +05:30

discovery_generic_account_groups.toml

[Tuning] Windows Discovery Rule Tuning for UEBA (#3097 )

2023-10-11 09:43:26 +02:00

discovery_generic_process_discovery.toml

[Tuning] Windows Discovery Rule Tuning for UEBA (#3097 )

2023-10-11 09:43:26 +02:00

discovery_generic_registry_query.toml

[Rule Tuning] Optimize query for Query Registry using Built-in Tools (#3330 )

2023-12-14 19:55:36 -07:00

discovery_hosts_file_access.toml

[Security Content] Include "Data Source: Elastic Defend" tag (#3002 )

2023-09-05 14:22:01 -04:00

discovery_internet_capabilities.toml

[Tuning] Windows Discovery Rule Tuning for UEBA (#3097 )

2023-10-11 09:43:26 +02:00

discovery_kernel_module_enumeration_via_proc.toml

Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157 )

2023-10-30 16:53:04 +05:30

discovery_linux_modprobe_enumeration.toml

[Rule Tuning] Linux BBR Tuning (#3347 )

2023-12-19 20:17:53 +01:00

discovery_linux_sysctl_enumeration.toml

[Rule Tuning] Linux BBR Tuning (#3347 )

2023-12-19 20:17:53 +01:00

discovery_linux_system_information_discovery.toml

[Security Content] Include "Data Source: Elastic Defend" tag (#3002 )

2023-09-05 14:22:01 -04:00

discovery_linux_system_owner_user_discovery.toml

[Security Content] Include "Data Source: Elastic Defend" tag (#3002 )

2023-09-05 14:22:01 -04:00

discovery_net_share_discovery_winlog.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

discovery_net_view.toml

Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157 )

2023-10-30 16:53:04 +05:30

discovery_of_accounts_or_groups_via_builtin_tools.toml

[Security Content] Include "Data Source: Elastic Defend" tag (#3002 )

2023-09-05 14:22:01 -04:00

discovery_of_domain_groups.toml

[Security Content] Include "Data Source: Elastic Defend" tag (#3002 )

2023-09-05 14:22:01 -04:00

discovery_posh_generic.toml

Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157 )

2023-10-30 16:53:04 +05:30

discovery_posh_password_policy.toml

Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157 )

2023-10-30 16:53:04 +05:30

discovery_post_exploitation_external_ip_lookup.toml

[Tuning] Windows Discovery Rule Tuning for UEBA (#3097 )

2023-10-11 09:43:26 +02:00

discovery_process_discovery_via_builtin_tools.toml

[Security Content] Include "Data Source: Elastic Defend" tag (#3002 )

2023-09-05 14:22:01 -04:00

discovery_remote_system_discovery_commands_windows.toml

Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157 )

2023-10-30 16:53:04 +05:30

discovery_security_software_wmic.toml

Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157 )

2023-10-30 16:53:04 +05:30

discovery_signal_unusual_user_host.toml

[Tuning] Windows Discovery Rule Tuning for UEBA (#3097 )

2023-10-11 09:43:26 +02:00

discovery_suspicious_proc_enumeration.toml

Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157 )

2023-10-30 16:53:04 +05:30

discovery_suspicious_which_command_execution.toml

[Tuning & New Rule] Linux Reverse Shell & DR Tuning (#3254 )

2023-12-18 09:36:21 +01:00

discovery_system_network_connections.toml

[Security Content] Include "Data Source: Elastic Defend" tag (#3002 )

2023-09-05 14:22:01 -04:00

discovery_system_service_discovery.toml

[Tuning] Windows Discovery Rule Tuning for UEBA (#3097 )

2023-10-11 09:43:26 +02:00

discovery_system_time_discovery.toml

[Tuning] Windows Discovery Rule Tuning for UEBA (#3097 )

2023-10-11 09:43:26 +02:00

discovery_win_network_connections.toml

[Tuning] Windows Discovery Rule Tuning for UEBA (#3097 )

2023-10-11 09:43:26 +02:00

discovery_windows_system_information_discovery.toml

[Tuning] Windows Discovery Rule Tuning for UEBA (#3097 )

2023-10-11 09:43:26 +02:00

execution_delayed_via_ping_lolbas_unsigned.toml

[New Rules] [BBR] Windows Deprecated ERs Conversion - 1 (#3131 )

2023-10-17 11:36:53 -03:00

execution_downloaded_shortcut_files.toml

[New Rule] New BBR Rules - Part 2 (#3029 )

2023-09-12 21:49:22 -03:00

execution_downloaded_url_file.toml

[New Rule] New BBR Rules - Part 3 (#3034 )

2023-09-12 21:28:01 -03:00

execution_linux_segfault.toml

[New BBR] Segfault Detected (#3240 )

2023-11-02 09:40:50 +01:00

execution_mofcomp.toml

[New Rule] New BBR Rules - Part 2 (#3029 )

2023-09-12 21:49:22 -03:00

execution_settingcontent_ms_file_creation.toml

[New Rule] New BBR Rules - Part 4 (#3035 )

2023-08-29 08:49:22 -03:00

execution_unix_socket_communication.toml

[New BBR] Unix Socket Communication (#3072 )

2023-10-23 17:18:48 +02:00

execution_unsigned_service_executable.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

execution_wmi_wbemtest.toml

[New Rule] New BBR Rules - Part 3 (#3034 )

2023-09-12 21:28:01 -03:00

initial_access_cross_site_scripting.toml

Potential Cross Site Scripting ( XSS ) (#2922 )

2023-07-20 19:12:00 +05:30

initial_access_execution_from_removable_media.toml

[New Rules] [BBR] Windows Deprecated ERs Conversion - 3 (#3143 )

2023-10-17 14:16:28 -03:00

initial_access_execution_remote_via_msiexec.toml

[New Rules] [BBR] Windows Deprecated ERs Conversion - 3 (#3143 )

2023-10-17 14:16:28 -03:00

initial_access_xsl_script_execution_via_com.toml

[New Rules] [BBR] Windows Deprecated ERs Conversion - 3 (#3143 )

2023-10-17 14:16:28 -03:00

lateral_movement_at.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

lateral_movement_posh_winrm_activity.toml

Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157 )

2023-10-30 16:53:04 +05:30

lateral_movement_rdp_conn_unusual_process.toml

[New Rule] New BBR Rules - Part 5 (#3052 )

2023-09-05 18:36:34 -03:00

lateral_movement_unusual_process_sql_accounts.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

lateral_movement_wmic_remote.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

persistence_browser_extension_install.toml

[New Rule] New BBR Rules - Part 1 (#3026 )

2023-09-05 18:07:47 -03:00

persistence_cap_sys_admin_added_to_new_binary.toml

Linux Process Capabilities Enrichment Detection Rules (#3366 )

2024-01-18 22:49:43 +05:30

persistence_creation_of_kernel_module.toml

[Rule Tuning] Linux BBR Tuning (#3347 )

2023-12-19 20:17:53 +01:00

persistence_kernel_driver_load.toml

[New BBR] Kernel Driver Load (#3236 )

2023-11-02 09:32:38 +01:00

persistence_msoffice_startup_registry.toml

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165 )

2023-10-15 18:12:20 -03:00

persistence_netsh_helper_dll.toml

[New Rule] New BBR Rules - Part 5 (#3052 )

2023-09-05 18:36:34 -03:00

persistence_startup_folder_lnk.toml

[New Rule] New BBR Rules - Part 5 (#3052 )

2023-09-05 18:36:34 -03:00

persistence_suspicious_file_opened_through_editor.toml

[Rule Tuning] Linux Rules (#3092 )

2023-10-23 16:28:58 +02:00

persistence_tainted_kernel_module_load.toml

[Rule Tuning] Tainted Kernel Module Load (#3234 )

2023-10-30 09:49:20 +01:00

persistence_tainted_kernel_module_out_of_tree_load.toml

[New Rule] Out-Of-Tree Kernel Module Load (#3233 )

2023-12-07 22:53:21 +01:00

persistence_transport_agent_exchange.toml

Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157 )

2023-10-30 16:53:04 +05:30

persistence_udev_rule_creation.toml

[Rule Tuning] Update timestamp_override Unit Tests and Fix Rules Missing Field (#3368 )

2024-01-17 14:14:38 -05:00

persistence_werfault_reflectdebugger.toml

[New Rule] New BBR Rules - Part 5 (#3052 )

2023-09-05 18:36:34 -03:00

privilege_escalation_trap_execution.toml

[Security Content] Include "Data Source: Elastic Defend" tag (#3002 )

2023-09-05 14:22:01 -04:00

privilege_escalation_unquoted_service_path.toml

[Security Content] Include "Data Source: Elastic Defend" tag (#3002 )

2023-09-05 14:22:01 -04:00