mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 17:58:52 +00:00
4600bf73dc
The [Sigma specification's status component](https://github.com/Neo23x0/sigma/wiki/Specification#status-optional) states the following: > Declares the status of the rule: > - stable: the rule is considered as stable and may be used in production systems or dashboards. > - test: an almost stable rule that possibly could require some fine tuning. > - experimental: an experimental rule that could lead to false results or be noisy, but could also identify interesting events. However the Sigma Rx YAML specification states the following: > ```yaml > status: > type: //any > of: > - type: //str > value: stable > - type: //str > value: testing > - type: //str > value: experimental > ``` The specification confuses the `test` and `testing` state. This commit changes the `test` state into the `testing` state which is already used in the code-base: - [`sigma/sigma-schema.rx.yml`](a805d18bba/sigma-schema.rx.yml (L49)) - [`sigma/tools/sigma/filter.py`](f3c60a6309/tools/sigma/filter.py (L26)) - [`sigma/tools/sigmac`](4e42bebb34/tools/sigmac (L98)) Although not modifyable through a PR, the specification should furthermore be updated to use the `testing` state.
31 lines
726 B
YAML
31 lines
726 B
YAML
title: Suspicious Netsh DLL Persistence
|
|
id: 56321594-9087-49d9-bf10-524fe8479452
|
|
description: Detects persitence via netsh helper
|
|
status: testing
|
|
references:
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1128/T1128.md
|
|
tags:
|
|
- attack.persistence
|
|
- attack.t1128
|
|
date: 2019/10/25
|
|
modified: 2019/10/25
|
|
author: Victor Sergeev, oscd.community
|
|
logsource:
|
|
category: process_creation
|
|
product: windows
|
|
detection:
|
|
selection:
|
|
Image|endswith: '\netsh.exe'
|
|
CommandLine|contains|all:
|
|
- 'add'
|
|
- 'helper'
|
|
condition: selection
|
|
fields:
|
|
- ComputerName
|
|
- User
|
|
- CommandLine
|
|
- ParentCommandLine
|
|
falsepositives:
|
|
- Unknown
|
|
level: high
|