sigma

sigma copied to clipboard

Based on suspicious regedit changes sigma rules

3

### Description of the Idea of the Rule Suspicious reg changes ### Public References / Exampel Event Log https://github.com/HydraDragonAntivirus/OpenSourceViruses/blob/main/suspiciousregchangesandtaskkils

HydraDragonAntivirus

- Rework rule referenced in #4412 - Rework fec96f39-988b-4586-b746-b93d59fd1922 - ~~Check logic behind undocumented sdbinst flags. See #4470 for reference~~ [Resolved] - This [rule](https://github.com/SigmaHQ/sigma/blob/905abc4d649f876078203a053a2801f89edc16e4/rules/linux/auditd/lnx_auditd_omigod_scx_runasprovider_executeshellcommand.yml) is using fields from multiple log...

nasbench

Detect PowerShell w/o PowerShell Execution via RunDLL32 and various other methods

3

### Description of the Idea of the Rule I want to propose a rule enabling the detection of PowerShell without using the well-known `powershell.exe` but rather via `rundll32.exe` and various...

JulianDroste

### Summary of the Pull Request Add Access To Windows Outlook Mail Files By Uncommon Application rule I used `file_access` to detect any way malware exe, ps, vbs, cmd... ###...

frack113

Update AWS Rule to use fieldref modifier instead of contains

1

### Summary of the Pull Request In deploying [this rule](https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_update_login_profile.yml), the Grafana SecOps team discovered that the `contains` modifier does not reference the field that this rule is trying to...

jamesc-grafana

### Summary of the Pull Request Microsoft Windows Phone Dialer is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to...

CertainlyP

### Description of the Idea of the Rule Kapeka: A novel backdoor spotted in Eastern Europe ### Public References / Exampel Event Log https://labs.withsecure.com/publications/kapeka ```title: Backdoor Kapeka id: 039abeb3-149a-4d03-8fda-a338d51b9762 status:...

cY83rR0H1t

### Summary of the Pull Request Kapeka backdoor sigma rules ### Changelog new: Suspicious Backdoor Dropped by Kapeka Loader new: Kapeka Backdoor Binary Loaded by Rundll32.exe new: Kapeka Backdoor Execution...

swachchhanda000

### Summary of the Pull Request Add rule for https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Wbadmin.yml ### Changelog add: Wbadmin NTDS.dit or SYSTEM hive access chore: Add LOLBAS reference to proc_creation_win_esentutl_sensitive_file_copy ### Example Log Event ```xml...

frack113

New Rule: proc_creation_macos_sysctl_discovery.yml

2

### Summary of the Pull Request Added a new rule to detect execution of `sysctl` on macOS. - `sysctl` can be used to gather interesting macOS host data, including hardware...

pratinavchandra