SigmaHQ/rules/windows/sysmon/sysmon_win_binary_github_com.yml

title: Microsoft Binary Github Communication
id: 635dbb88-67b3-4b41-9ea5-a3af2dd88153
status: experimental
description: Detects an executable in the Windows folder accessing github.com
references:
    - https://twitter.com/M_haggis/status/900741347035889665
    - https://twitter.com/M_haggis/status/1032799638213066752
author: Michael Haag (idea), Florian Roth (rule)
tags:
    - attack.lateral_movement
    - attack.t1105
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 3
        Initiated: 'true'
        DestinationHostname: 
            - '*.github.com'
            - '*.githubusercontent.com'
        Image: 'C:\Windows\\*'
    condition: selection
falsepositives:
    - 'Unknown'
    - '@subTee in your network'
level: high
Rule: Microsoft Binary Github Communication 2017-08-24 16:27:22 +00:00			`title: Microsoft Binary Github Communication`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`id: 635dbb88-67b3-4b41-9ea5-a3af2dd88153`
Rule: Microsoft Binary Github Communication 2017-08-24 16:27:22 +00:00			`status: experimental`
			`description: Detects an executable in the Windows folder accessing github.com`
Change All "str" references to be "list"to mach schema update 2018-01-27 23:24:16 +00:00			`references:`
			`- https://twitter.com/M_haggis/status/900741347035889665`
Rule: Improved Github communication rule 2018-08-30 08:08:01 +00:00			`- https://twitter.com/M_haggis/status/1032799638213066752`
Rule: Microsoft Binary Github Communication 2017-08-24 16:27:22 +00:00			`author: Michael Haag (idea), Florian Roth (rule)`
Added missing tags and some minor improvements 2019-03-05 22:25:49 +00:00			`tags:`
			`- attack.lateral_movement`
			`- attack.t1105`
Rule: Microsoft Binary Github Communication 2017-08-24 16:27:22 +00:00			`logsource:`
			`product: windows`
			`service: sysmon`
			`detection:`
			`selection:`
			`EventID: 3`
sysmon eventid 3: filter on outgoing connections (initiated: true) to avoid false positives 2019-09-25 15:11:22 +00:00			`Initiated: 'true'`
Rule: Improved Github communication rule 2018-08-30 08:08:01 +00:00			`DestinationHostname:`
			`- '*.github.com'`
			`- '*.githubusercontent.com'`
Escaped '\' to '\\' where required 2019-02-02 23:24:57 +00:00			`Image: 'C:\Windows\\*'`
Rule: Microsoft Binary Github Communication 2017-08-24 16:27:22 +00:00			`condition: selection`
			`falsepositives:`
			`- 'Unknown'`
			`- '@subTee in your network'`
			`level: high`