Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add MITRE ATT&CK tags to various rules that were missing them #4392

Merged
merged 12 commits into from
Aug 28, 2023
Merged

Add MITRE ATT&CK tags to various rules that were missing them #4392

merged 12 commits into from
Aug 28, 2023

Conversation

tjgeorgen
Copy link
Contributor

Summary of the Pull Request

Add MITRE ATT&CK tags to various rules that were missing them

Changelog

All files included: add tags section if needed, add relevant MITRE ATT&CK technique or subtechnique tags in attack.tXXXX or attack.tXXXX.YYY format.

Example Log Event

n/a

Fixed Issues

n/a

SigmaHQ Rule Creation Conventions

  • If your PR adds new rules, please consider following and applying these conventions

nasbench
nasbench approved these changes Aug 28, 2023
View reviewed changes
rules/linux/network_connection/net_connection_lnx_back_connect_shell_dev.yml Show resolved Hide resolved
rules/linux/network_connection/net_connection_lnx_crypto_mining_indicators.yml Show resolved Hide resolved
rules/linux/process_creation/proc_creation_lnx_crypto_mining.yml Show resolved Hide resolved
rules/linux/process_creation/proc_creation_lnx_nohup.yml Show resolved Hide resolved
rules/linux/process_creation/proc_creation_lnx_susp_execution_tmp_folder.yml Show resolved Hide resolved
rules/windows/process_creation/proc_creation_win_hktl_execution_via_imphashes.yml Show resolved Hide resolved
rules/windows/process_creation/proc_creation_win_hktl_execution_via_pe_metadata.yml Show resolved Hide resolved
rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml Show resolved Hide resolved
rules/windows/process_creation/proc_creation_win_iis_susp_module_registration.yml Show resolved Hide resolved
rules/windows/process_creation/proc_creation_win_java_sysaidserver_susp_child_process.yml Show resolved Hide resolved
nasbench
nasbench approved these changes Aug 28, 2023
View reviewed changes
rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_filename.yml Show resolved Hide resolved
rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_outlook.yml Show resolved Hide resolved
rules/windows/file/file_event/file_event_win_cscript_wscript_dropper.yml Show resolved Hide resolved
rules/windows/file/file_event/file_event_win_iso_file_recent.yml Outdated Show resolved Hide resolved
rules/windows/file/file_event/file_event_win_shell_write_susp_files_extensions.yml Show resolved Hide resolved
rules/windows/process_creation/proc_creation_win_powershell_export_certificate.yml Show resolved Hide resolved
rules/windows/process_creation/proc_creation_win_pua_advancedrun.yml Outdated Show resolved Hide resolved
rules/windows/process_creation/proc_creation_win_pua_process_hacker.yml Show resolved Hide resolved
rules/windows/process_creation/proc_creation_win_pua_system_informer.yml Show resolved Hide resolved
@nasbench nasbench added Rules Windows Pull request add/update windows related rules Linux Pull request add/update linux related rules labels Aug 28, 2023
@nasbench nasbench self-assigned this Aug 28, 2023
nasbench
nasbench reviewed Aug 28, 2023
View reviewed changes
rules/windows/builtin/firewall_as/win_firewall_as_reset_config.yml Outdated Show resolved Hide resolved
rules/windows/builtin/firewall_as/win_firewall_as_setting_change.yml Outdated Show resolved Hide resolved
...ltin/security/account_management/win_security_member_added_security_enabled_global_group.yml Outdated Show resolved Hide resolved
...in/security/account_management/win_security_member_removed_security_enabled_global_group.yml Outdated Show resolved Hide resolved
...s/builtin/security/account_management/win_security_security_enabled_global_group_deleted.yml Outdated Show resolved Hide resolved
rules/windows/process_creation/proc_creation_win_susp_parents.yml Outdated Show resolved Hide resolved
rules/windows/process_creation/proc_creation_win_susp_progname.yml Outdated Show resolved Hide resolved
rules/windows/process_creation/proc_creation_win_susp_redirect_local_admin_share.yml Outdated Show resolved Hide resolved
rules/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml Outdated Show resolved Hide resolved
rules/windows/process_creation/proc_creation_win_wuauclt_no_cli_flags_execution.yml Outdated Show resolved Hide resolved
@nasbench nasbench added the 2nd Review Needed PR need a second approval label Aug 28, 2023
@nasbench nasbench merged commit 60b8e9b into SigmaHQ:master Aug 28, 2023
10 checks passed
@nasbench nasbench removed the 2nd Review Needed PR need a second approval label Nov 1, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nasbench nasbench nasbench approved these changes

@phantinuss phantinuss phantinuss approved these changes

Assignees

@nasbench nasbench

Labels
Linux Pull request add/update linux related rules Rules Windows Pull request add/update windows related rules
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@tjgeorgen @nasbench @phantinuss