<group name="windows,sysmon,">
<!-- Sysmon - Event 11: FileCreate by $(win.eventdata.image) -->
<rule id="110101" level="3">
<if_sid>61613</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1546.011,technique_name=Application Shimming$</field>
<description>Sysmon - Event 11: FileCreate by $(win.eventdata.image)</description>
<mitre>
<id>T1546</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_11,</group>
</rule>
<!-- Sysmon - Event 11: FileCreate by $(win.eventdata.image) -->
<rule id="110102" level="3">
<if_sid>61613</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1064,technique_name=Scripting$</field>
<description>Sysmon - Event 11: FileCreate by $(win.eventdata.image)</description>
<mitre>
<id>T1064</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_11,</group>
</rule>
<!-- Sysmon - Event 11: FileCreate by $(win.eventdata.image) -->
<rule id="110103" level="3">
<if_sid>61613</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1218,technique_name=Office Signed Binary Proxy Execution$</field>
<description>Sysmon - Event 11: FileCreate by $(win.eventdata.image)</description>
<mitre>
<id>T1218</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_11,</group>
</rule>
<!-- Sysmon - Event 11: FileCreate by $(win.eventdata.image) -->
<rule id="110104" level="3">
<if_sid>61613</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1218.005,technique_name=Mshta$</field>
<description>Sysmon - Event 11: FileCreate by $(win.eventdata.image)</description>
<mitre>
<id>T1218</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_11,</group>
</rule>
<!-- Sysmon - Event 11: FileCreate by $(win.eventdata.image) -->
<rule id="110105" level="3">
<if_sid>61613</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1187,technique_name=Forced Authentication$</field>
<description>Sysmon - Event 11: FileCreate by $(win.eventdata.image)</description>
<mitre>
<id>T1187</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_11,</group>
</rule>
<!-- Sysmon - Event 11: FileCreate by $(win.eventdata.image) -->
<rule id="110106" level="3">
<if_sid>61613</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution$</field>
<description>Sysmon - Event 11: FileCreate by $(win.eventdata.image)</description>
<mitre>
<id>T1127</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_11,</group>
</rule>
<!-- Sysmon - Event 11: FileCreate by $(win.eventdata.image) -->
<rule id="110107" level="3">
<if_sid>61613</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1059.001,technique_name=PowerShell$</field>
<description>Sysmon - Event 11: FileCreate by $(win.eventdata.image)</description>
<mitre>
<id>T1059</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_11,</group>
</rule>
<!-- Sysmon - Event 11: FileCreate by $(win.eventdata.image) -->
<rule id="110108" level="3">
<if_sid>61613</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1044,technique_name=File System Permissions Weakness$</field>
<description>Sysmon - Event 11: FileCreate by $(win.eventdata.image)</description>
<mitre>
<id>T1044</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_11,</group>
</rule>
<!-- Sysmon - Event 11: FileCreate by $(win.eventdata.image) -->
<rule id="110109" level="3">
<if_sid>61613</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1047,technique_name=File System Permissions Weakness$</field>
<description>Sysmon - Event 11: FileCreate by $(win.eventdata.image)</description>
<mitre>
<id>T1047</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_11,</group>
</rule>
<!-- Sysmon - Event 11: FileCreate by $(win.eventdata.image) -->
<rule id="110110" level="3">
<if_sid>61613</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1047,technique_name=Windows Management Instrumentation$</field>
<description>Sysmon - Event 11: FileCreate by $(win.eventdata.image)</description>
<mitre>
<id>T1047</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_11,</group>
</rule>
<!-- Sysmon - Event 11: FileCreate by $(win.eventdata.image) -->
<rule id="110111" level="3">
<if_sid>61613</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1546.008,technique_name=Services File Permissions Weakness$</field>
<description>Sysmon - Event 11: FileCreate by $(win.eventdata.image)</description>
<mitre>
<id>T1546</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_11,</group>
</rule>
<!-- Lockbit 3.0 Ransomware -->
<rule id="110118" level="10">
<if_group>sysmon_event_11</if_group>
<field name="win.eventdata.targetFilename" type="pcre2">(?i)\\\\users</field>
<field name="win.eventdata.targetFilename" type="pcre2">(?i)\.+readme\.txt</field>
<description>The file $(win.eventdata.targetFilename) has been created. Possible ransomware activity.</description>
<options>no_full_log</options>
<group>sysmon_event_11,</group>
</rule>



<!--added rule-->
<rule id="110119" level="10">
  <if_group>sysmon_event_11</if_group>
  <field name="win.eventdata.targetFilename" type="pcre2">(?i)wpbbin\.exe</field>
  <description>MITRE ATTaCK T1542.001 Pre-OS Boot: System Firmware - wpbbin.exe file created in System32. Possible firmware persistence attempt.</description>
  <group>sysmon_event_11,</group>
  <mitre>
    <id>T1542.001</id>
  </mitre>
</rule>


<!--added rule-->

<rule id="110120" level="10">
  <if_group>sysmon_event_11</if_group>
  <field name="win.eventdata.targetFilename" type="pcre2">(?i)Comms.*Unistore.*data.*copy</field>
  <description>Possible mailbox data manipulation detected (T1070.008 - Email Collection: Mailbox Manipulation)</description>
  <group>sysmon_event_11,</group>
  <mitre>
    <id>T1070.008</id>
  </mitre>
</rule>


<rule id="110121" level="10">
  <if_group>sysmon_event_11</if_group>
  <field name="win.eventdata.image" type="pcre2">(?i)powershell\.exe$</field>
  <field name="win.eventdata.targetFilename" type="pcre2">(?i)Microsoft\.PowerShell_profile\.ps1|profile\.ps1</field>
  <description>T1546.013 - PowerShell Profile modified: Potential persistence mechanism detected (Event Triggered Execution)</description>
  <group>sysmon_event_11,</group>
  <mitre>
    <id>T1546.013</id>
  </mitre>
</rule>

<rule id="110122" level="10">
  <if_group>sysmon_event_11</if_group>
  <field name="win.eventdata.targetFilename" type="pcre2">(?i)\\\\Microsoft\\\\Outlook\\\\VbaProject\.OTM$</field>
  <description>T1137 - Outlook VbaProject.OTM Persistence File Created (Target: $(win.eventdata.targetFilename))</description>
  <mitre>
    <id>T1137</id>  
  </mitre>
  <group>sysmon_event_11,</group>
</rule>


<rule id="110123" level="10">
  <if_group>sysmon_event_11</if_group>
  <field name="win.eventdata.targetFilename" type="pcre2">(?i)C:\\\\Windows\\\\System32\\\\spool\\\\prtprocs\\\\x64\\\\[^\\\\]+\.dll</field>
  <description>T1547.012 - DLL Dropped in Print Processors Directory (TargetFilename: $(win.eventdata.targetFilename))</description>
  <mitre>
    <id>T1547.012</id>
  </mitre>
  <group>sysmon_event_11,</group>
</rule>

</group>
