paulmataruso/main
1
0
Fork 0
mirror of https://github.com/socfortress/Wazuh-Rules.git synced 2025-11-02 21:03:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update MITRE_TECHNIQUES_FROM_SYSMON_EVENT1.xml

Browse Source
This commit is contained in:
taylor_socfortress
2022-12-01 11:17:54 -06:00
committed by GitHub
parent 5fe8d5c6f1
commit 38747cbbe3
1 changed files with 15 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
Windows_Sysmon/MITRE_TECHNIQUES_FROM_SYSMON_EVENT1.xml
View File

@@ -1028,18 +1028,13 @@
<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group> <group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
</rule> </rule>
<!-- MS RCE "Follina" Detection Rules --> <!-- MS RCE "Follina" Detection Rules -->
<!-- regsvr32 Spawned by MS-OFFICE Processes--> <rule id="100506" level="12">
<rule id="100506" level="13"> <if_sid>100105</if_sid>
<if_sid>100160</if_sid> <field name="win.eventdata.parentImage">winword\.exe$|excel\.exe$|powerpnt\.exe$|outlook\.exe$|msaccess\.exe$|lync\.exe$|mspub\.exe$|onenote\.exe$</field>
<field name="win.eventdata.parentImage">winword.exe$|excel.exe$|powerpnt.exe$</field> <description>Possible Follina (CVE-2022-30190) exploitation attempt detected. New process created by a Microsoft Office application.</description>
<description>Sysmon - Event 1: Process $(win.eventdata.description) - MS RCE Follina Detection.</description>
<mitre> <mitre>
<id>T1204</id> <id>T1203</id>
<id>T1047</id>
<id>T1218</id>
</mitre> </mitre>
<options>no_full_log</options>
<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
</rule> </rule>
<!-- rundll32 Spawned by MS-OFFICE Processes--> <!-- rundll32 Spawned by MS-OFFICE Processes-->
<rule id="100507" level="13"> <rule id="100507" level="13">
@@ -1170,6 +1165,16 @@
<options>no_full_log</options> <options>no_full_log</options>
<group>sysmon_event1,windows_sysmon_event1,</group> <group>sysmon_event1,windows_sysmon_event1,</group>
</rule> </rule>
<!-- Folina Exploit Detected -->
<rule id="100521" level="15">
<if_sid>100506</if_sid>
<field name="win.eventdata.originalFileName" type="pcre2">^msdt\.exe$</field>
<field name="win.eventdata.commandLine" type="pcre2">ms-msdt:(/|-)id.*(PCWDiagnostic|IT_RebrowseForFile|IT_LaunchMethod|SelectProgram)</field>
<description>Follina (CVE-2022-30190) exploitation attempt detected. MSDT executed with known Follina exploitation pattern.</description>
<mitre>
<id>T1203</id>
</mitre>
</rule>
<!-- Rules 100600 - 100699: Correlation Rules --> <!-- Rules 100600 - 100699: Correlation Rules -->
<!-- Frequency rule to capture 3 sysmon event 1 Anomalies --> <!-- Frequency rule to capture 3 sysmon event 1 Anomalies -->