valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 17:35:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Updated Rule

Browse Source 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
This commit is contained in:
Cyb3rEng 2021-08-31 21:54:32 -06:00 committed by GitHub
parent 900f71e6b2
commit d5fa226180
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
rules/windows/sysmon/Monitor_LOLBins_process_creations_with_Wmiprvse_parent_process.yml
View File

@ -1,25 +1,23 @@
title: LOLBins process creations with Wmiprvse parent process(sysmon) title: LOLBins Process Created With WmiPrvSE
description: This rule will monitor LOLBin process creations by wmiprvse. Add more LOLBins to rule logic if needed. description: This rule will monitor LOLBin process creations by wmiprvse. Add more LOLBins to rule logic if needed.
references: references:
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
- https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/main/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/main/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml
author: "Idea by: Vadim Khrykov" author: "Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule)"
tags: tags:
- attack.t1204.002 - attack.t1204.002
- attack.t1047 - attack.t1047
- attack.t1218.010 - attack.t1218.010
- attack.execution - attack.execution
- attack.defence_evasion - attack.defence_evasion
status: experimental status: experimental
Date: 2021/23/8 Date: 2021/23/8
logsource: logsource:
product: Windows product: Windows
service: Sysmon
category: process_creation category: process_creation
detection: detection:
description: add more LOLBins to the rules logic of your choice. #useful_information: add more LOLBins to the rules logic of your choice.
selection1: selection1:
EventLog: Microsoft-Windows-Sysmon/Operational
EventID: 1 EventID: 1
selection2: selection2:
Image|endswith: Image|endswith:
@ -34,4 +32,4 @@ detection:
condition: selection1 AND selection2 AND selection3 condition: selection1 AND selection2 AND selection3
falsepositives: falsepositives:
- "FPs are possible here, but some LOLBins weren't excluded for obvious reasons." - "FPs are possible here, but some LOLBins weren't excluded for obvious reasons."
level: high level: high