Merge pull request #1755 from SigmaHQ/rule-devel

Different rule updates

rules/proxy/proxy_ua_malware.yml

@@ -71,6 +71,7 @@ detection:
         - 'agent *'
         - 'AutoIt'  # Suspicious - base-lining recommended
         - 'IczelionDownLoad'
+        - 'Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 10.0; .NET4.0C; .NET4.0E; Tablet PC 2.0)'  # https://unit42.paloaltonetworks.com/thor-plugx-variant/
     condition: selection
 fields:
     - ClientIP

rules/windows/builtin/win_av_relevant_match.yml

@@ -3,14 +3,14 @@ id: 78bc5783-81d9-4d73-ac97-59f6db4f72a8
 description: This detection method points out highly relevant Antivirus events
 author: Florian Roth
 date: 2017/02/19
-modified: 2021/01/07
+modified: 2021/07/28
 logsource:
     product: windows
     service: application
 detection:
     keywords:
         Message|contains:
-            - "HTool"
+            - "HTool-"
             - "Hacktool"
             - "ASP/Backdoor"
             - "JSP/Backdoor"

rules/windows/registry_event/win_registry_mimikatz_printernightmare.yml

@@ -12,7 +12,7 @@ tags:
   - cve.2021-1675
   - cve.2021-34527
 date: 2021/07/04
-modified: 2021/07/08
+modified: 2021/07/28
 logsource:
   product: windows
   category: registry_event
@@ -25,7 +25,16 @@ detection:
     TargetObject|contains|all:
       - 'legitprinter'
       - '\Control\Print\Environments\Windows'
-  condition: selection or selection_alt
+  selection_print:
+    TargetObject|contains:
+      - '\Control\Print\Environments'
+      - '\CurrentVersion\Print\Printers'
+  selection_kiwi:
+    TargetObject|contains:
+      - 'Gentil Kiwi'
+      - 'mimikatz printer'
+      - 'Kiwi Legit Printer'
+  condition: selection or selection_alt or (selection_print and selection_kiwi)
 falsepositives:
   - Legitimate installation of printer driver QMS 810, Texas Instruments microLaser printer (unlikely)
 level: critical