Compare text

Find the difference between two text files

Real-time diff
Unified diff
Collapse lines
Highlight change
Syntax highlighting
Tools
Diffchecker Desktop icon
Diffchecker Desktop The most secure way to run Diffchecker. Get the Diffchecker Desktop app: your diffs never leave your computer!Get Desktop

Comparing sensitive data, confidential files or internal emails?

Most legal and privacy policies prohibit uploading sensitive data online. Diffchecker Desktop ensures your confidential information never leaves your computer. Work offline and compare documents securely.

Download Diffchecker DesktopLearn more

Wazuh Sigma rules

Created Diff never expires
41 removals
416 lines
39 additions
414 lines
<group name="sigma,">
<group name="sigma,">
<!--
<!--
Author: Brian Kellogg
Author: Brian Kellogg
Sigma: https://github.com/SigmaHQ/sigma
Sigma: https://github.com/SigmaHQ/sigma
Wazuh: https://wazuh.com
Wazuh: https://wazuh.com
All Sigma rules licensed under DRL: https://github.com/SigmaHQ/sigma/blob/master/LICENSE.Detection.Rules.md
All Sigma rules licensed under DRL: https://github.com/SigmaHQ/sigma/blob/master/LICENSE.Detection.Rules.md
-->
-->
<rule id="900001" level="10">
<rule id="900001" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<mitre>
<mitre>
<id>attack.execution</id>
<id>attack.execution</id>
<id>attack.t1047</id>
<id>attack.t1047</id>
<id>attack.t1053.002</id>
<id>attack.t1053.002</id>
<id>attack.t1569.002</id>
<id>attack.t1569.002</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Execution</description>
<description>MITRE BZAR Indicators for Execution</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)JobAdd</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:JobAdd)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)atsvc</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:atsvc)$</field>
</rule>
</rule>
<rule id="900002" level="10">
<rule id="900002" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<mitre>
<mitre>
<id>attack.execution</id>
<id>attack.execution</id>
<id>attack.t1047</id>
<id>attack.t1047</id>
<id>attack.t1053.002</id>
<id>attack.t1053.002</id>
<id>attack.t1569.002</id>
<id>attack.t1569.002</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Execution</description>
<description>MITRE BZAR Indicators for Execution</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)ITaskSchedulerService</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:ITaskSchedulerService)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)SchRpcEnableTask</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:SchRpcEnableTask)$</field>
</rule>
</rule>
<rule id="900003" level="10">
<rule id="900003" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<mitre>
<mitre>
<id>attack.execution</id>
<id>attack.execution</id>
<id>attack.t1047</id>
<id>attack.t1047</id>
<id>attack.t1053.002</id>
<id>attack.t1053.002</id>
<id>attack.t1569.002</id>
<id>attack.t1569.002</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Execution</description>
<description>MITRE BZAR Indicators for Execution</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)ITaskSchedulerService</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:ITaskSchedulerService)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)SchRpcRegisterTask</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:SchRpcRegisterTask)$</field>
</rule>
</rule>
<rule id="900004" level="10">
<rule id="900004" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<mitre>
<mitre>
<id>attack.execution</id>
<id>attack.execution</id>
<id>attack.t1047</id>
<id>attack.t1047</id>
<id>attack.t1053.002</id>
<id>attack.t1053.002</id>
<id>attack.t1569.002</id>
<id>attack.t1569.002</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Execution</description>
<description>MITRE BZAR Indicators for Execution</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)ITaskSchedulerService</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:ITaskSchedulerService)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)SchRpcRun</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:SchRpcRun)$</field>
</rule>
</rule>
<rule id="900005" level="10">
<rule id="900005" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<mitre>
<mitre>
<id>attack.execution</id>
<id>attack.execution</id>
<id>attack.t1047</id>
<id>attack.t1047</id>
<id>attack.t1053.002</id>
<id>attack.t1053.002</id>
<id>attack.t1569.002</id>
<id>attack.t1569.002</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Execution</description>
<description>MITRE BZAR Indicators for Execution</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)IWbemServices</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:IWbemServices)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)ExecMethod</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:ExecMethod)$</field>
</rule>
</rule>
<rule id="900006" level="10">
<rule id="900006" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<mitre>
<mitre>
<id>attack.execution</id>
<id>attack.execution</id>
<id>attack.t1047</id>
<id>attack.t1047</id>
<id>attack.t1053.002</id>
<id>attack.t1053.002</id>
<id>attack.t1569.002</id>
<id>attack.t1569.002</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Execution</description>
<description>MITRE BZAR Indicators for Execution</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)IWbemServices</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:IWbemServices)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)ExecMethodAsync</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:ExecMethodAsync)$</field>
</rule>
</rule>
<rule id="900007" level="10">
<rule id="900007" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<mitre>
<mitre>
<id>attack.execution</id>
<id>attack.execution</id>
<id>attack.t1047</id>
<id>attack.t1047</id>
<id>attack.t1053.002</id>
<id>attack.t1053.002</id>
<id>attack.t1569.002</id>
<id>attack.t1569.002</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Execution</description>
<description>MITRE BZAR Indicators for Execution</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)svcctl</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:svcctl)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)CreateServiceA</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:CreateServiceA)$</field>
</rule>
</rule>
<rule id="900008" level="10">
<rule id="900008" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<mitre>
<mitre>
<id>attack.execution</id>
<id>attack.execution</id>
<id>attack.t1047</id>
<id>attack.t1047</id>
<id>attack.t1053.002</id>
<id>attack.t1053.002</id>
<id>attack.t1569.002</id>
<id>attack.t1569.002</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Execution</description>
<description>MITRE BZAR Indicators for Execution</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)svcctl</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:svcctl)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)CreateServiceW</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:CreateServiceW)$</field>
</rule>
</rule>
<rule id="900009" level="10">
<rule id="900009" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<mitre>
<mitre>
<id>attack.execution</id>
<id>attack.execution</id>
<id>attack.t1047</id>
<id>attack.t1047</id>
<id>attack.t1053.002</id>
<id>attack.t1053.002</id>
<id>attack.t1569.002</id>
<id>attack.t1569.002</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Execution</description>
<description>MITRE BZAR Indicators for Execution</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)svcctl</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:svcctl)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)StartServiceA</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:StartServiceA)$</field>
</rule>
</rule>
<rule id="900010" level="10">
<rule id="900010" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<!--ID: b640c0b8-87f8-4daa-aef8-95a24261dd1d-->
<mitre>
<mitre>
<id>attack.execution</id>
<id>attack.execution</id>
<id>attack.t1047</id>
<id>attack.t1047</id>
<id>attack.t1053.002</id>
<id>attack.t1053.002</id>
<id>attack.t1569.002</id>
<id>attack.t1569.002</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Execution</description>
<description>MITRE BZAR Indicators for Execution</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)svcctl</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:svcctl)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)StartServiceW</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:StartServiceW)$</field>
</rule>
</rule>
<rule id="900011" level="10">
<rule id="900011" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.-->
<!--Description: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: 53389db6-ba46-48e3-a94c-e0f2cefe1583-->
<!--ID: 53389db6-ba46-48e3-a94c-e0f2cefe1583-->
<mitre>
<mitre>
<id>attack.persistence</id>
<id>attack.persistence</id>
<id>attack.t1547.004</id>
<id>attack.t1547.004</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Persistence</description>
<description>MITRE BZAR Indicators for Persistence</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)spoolss</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:spoolss)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)RpcAddMonitor</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:RpcAddMonitor)$</field>
</rule>
</rule>
<rule id="900012" level="10">
<rule id="900012" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.-->
<!--Description: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: 53389db6-ba46-48e3-a94c-e0f2cefe1583-->
<!--ID: 53389db6-ba46-48e3-a94c-e0f2cefe1583-->
<mitre>
<mitre>
<id>attack.persistence</id>
<id>attack.persistence</id>
<id>attack.t1547.004</id>
<id>attack.t1547.004</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Persistence</description>
<description>MITRE BZAR Indicators for Persistence</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)spoolss</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:spoolss)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)RpcAddPrintProcessor</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:RpcAddPrintProcessor)$</field>
</rule>
</rule>
<rule id="900013" level="10">
<rule id="900013" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.-->
<!--Description: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: 53389db6-ba46-48e3-a94c-e0f2cefe1583-->
<!--ID: 53389db6-ba46-48e3-a94c-e0f2cefe1583-->
<mitre>
<mitre>
<id>attack.persistence</id>
<id>attack.persistence</id>
<id>attack.t1547.004</id>
<id>attack.t1547.004</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Persistence</description>
<description>MITRE BZAR Indicators for Persistence</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)IRemoteWinspool</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:IRemoteWinspool)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)RpcAsyncAddMonitor</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:RpcAsyncAddMonitor)$</field>
</rule>
</rule>
<rule id="900014" level="10">
<rule id="900014" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.-->
<!--Description: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: 53389db6-ba46-48e3-a94c-e0f2cefe1583-->
<!--ID: 53389db6-ba46-48e3-a94c-e0f2cefe1583-->
<mitre>
<mitre>
<id>attack.persistence</id>
<id>attack.persistence</id>
<id>attack.t1547.004</id>
<id>attack.t1547.004</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Persistence</description>
<description>MITRE BZAR Indicators for Persistence</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)IRemoteWinspool</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:IRemoteWinspool)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)RpcAsyncAddPrintProcessor</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:RpcAsyncAddPrintProcessor)$</field>
</rule>
</rule>
<rule id="900015" level="10">
<rule id="900015" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.-->
<!--Description: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: 53389db6-ba46-48e3-a94c-e0f2cefe1583-->
<!--ID: 53389db6-ba46-48e3-a94c-e0f2cefe1583-->
<mitre>
<mitre>
<id>attack.persistence</id>
<id>attack.persistence</id>
<id>attack.t1547.004</id>
<id>attack.t1547.004</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Persistence</description>
<description>MITRE BZAR Indicators for Persistence</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)ISecLogon</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:ISecLogon)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)SeclCreateProcessWithLogonW</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:SeclCreateProcessWithLogonW)$</field>
</rule>
</rule>
<rule id="900016" level="10">
<rule id="900016" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Sigma Rule Author: @neu5ron, SOC Prime-->
<!--Description: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.-->
<!--Description: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.-->
<!--Date: 2020/03/19-->
<!--Date: 2020/03/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: 53389db6-ba46-48e3-a94c-e0f2cefe1583-->
<!--ID: 53389db6-ba46-48e3-a94c-e0f2cefe1583-->
<mitre>
<mitre>
<id>attack.persistence</id>
<id>attack.persistence</id>
<id>attack.t1547.004</id>
<id>attack.t1547.004</id>
</mitre>
</mitre>
<description>MITRE BZAR Indicators for Persistence</description>
<description>MITRE BZAR Indicators for Persistence</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.endpoint" negate="no" type="pcre2">(?i)ISecLogon</field>
<field name="data.endpoint" negate="no" type="pcre2">(?i)^(?:ISecLogon)$</field>
<field name="data.operation" negate="no" type="pcre2">(?i)SeclCreateProcessWithLogonExW</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:SeclCreateProcessWithLogonExW)$</field>
</rule>
</rule>
<rule id="900017" level="10">
<rule id="900017" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml</info>
<!--Sigma Rule Author: @neu5ron, @Antonlovesdnb, Mike Remen-->
<!--Sigma Rule Author: @neu5ron, @Antonlovesdnb, Mike Remen-->
<!--Description: Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam.
<!--Description: Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam.
The usage of this RPC function should be rare if ever used at all.
The usage of this RPC function should be rare if ever used at all.
Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.
Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.
View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'
View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'
-->
-->
<!--Date: 2021/08/17-->
<!--Date: 2021/08/17-->
<!--Status: test-->
<!--Status: test-->
<!--ID: 4096842a-8f9f-4d36-92b4-d0b2a62f9b2a-->
<!--ID: 4096842a-8f9f-4d36-92b4-d0b2a62f9b2a-->
<mitre>
<mitre>
<id>attack.t1557.001</id>
<id>attack.t1557.001</id>
<id>attack.t1187</id>
<id>attack.t1187</id>
</mitre>
</mitre>
<description>Potential PetitPotam Attack Via EFS RPC Calls</description>
<description>Potential PetitPotam Attack Via EFS RPC Calls</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:efs)</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:efs)</field>
</rule>
</rule>
<rule id="900018" level="10">
<rule id="900018" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_printnightmare_print_driver_install.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_printnightmare_print_driver_install.yml</info>
<!--Sigma Rule Author: @neu5ron (Nate Guagenti)-->
<!--Sigma Rule Author: @neu5ron (Nate Guagenti)-->
<!--Description: Detects the remote installation of a print driver which is possible indication of the exploitation of PrintNightmare (CVE-2021-1675).
<!--Description: Detects the remote installation of a print driver which is possible indication of the exploitation of PrintNightmare (CVE-2021-1675).
The occurrence of print drivers being installed remotely via RPC functions should be rare, as print drivers are normally installed locally and or through group policy.
The occurrence of print drivers being installed remotely via RPC functions should be rare, as print drivers are normally installed locally and or through group policy.
-->
-->
<!--Date: 2021/08/23-->
<!--Date: 2021/08/23-->
<!--Status: stable-->
<!--Status: stable-->
<!--ID: 7b33baef-2a75-4ca3-9da4-34f9a15382d8-->
<!--ID: 7b33baef-2a75-4ca3-9da4-34f9a15382d8-->
<mitre>
<mitre>
<id>attack.execution</id>
<id>attack.execution</id>
<id>cve.2021.1678</id>
<id>cve.2021.1678</id>
<id>cve.2021.1675</id>
<id>cve.2021.1675</id>
<id>cve.2021.34527</id>
<id>cve.2021.34527</id>
</mitre>
</mitre>
<description>Possible PrintNightmare Print Driver Install</description>
<description>Possible PrintNightmare Print Driver Install</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dce_rpc,</group>
<group>zeek,dce_rpc,</group>
<field name="data.operation" negate="no" type="pcre2">(?i)RpcAsyncInstallPrinterDriverFromPackage|RpcAsyncAddPrintProcessor|RpcAddPrintProcessor|RpcAddPrinterDriverEx|RpcAddPrinterDriver|RpcAsyncAddPrinterDriver</field>
<field name="data.operation" negate="no" type="pcre2">(?i)^(?:RpcAsyncInstallPrinterDriverFromPackage|RpcAsyncAddPrintProcessor|RpcAddPrintProcessor|RpcAddPrinterDriverEx|RpcAddPrinterDriver|RpcAsyncAddPrinterDriver)$</field>
</rule>
</rule>
<rule id="900019" level="10">
<rule id="900019" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_smb_spoolss_named_pipe.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_smb_spoolss_named_pipe.yml</info>
<!--Sigma Rule Author: OTR (Open Threat Research), @neu5ron-->
<!--Sigma Rule Author: OTR (Open Threat Research), @neu5ron-->
<!--Description: Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.-->
<!--Description: Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.-->
<!--Date: 2018/11/28-->
<!--Date: 2018/11/28-->
<!--Status: test-->
<!--Status: test-->
<!--ID: bae2865c-5565-470d-b505-9496c87d0c30-->
<!--ID: bae2865c-5565-470d-b505-9496c87d0c30-->
<mitre>
<mitre>
<id>attack.lateral_movement</id>
<id>attack.lateral_movement</id>
<id>attack.t1021.002</id>
<id>attack.t1021.002</id>
</mitre>
</mitre>
<description>SMB Spoolss Name Piped Usage</description>
<description>SMB Spoolss Name Piped Usage</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,smb_files,</group>
<group>zeek,smb_files,</group>
<field name="data.path" negate="no" type="pcre2">(?i)(?:IPC\$)$</field>
<field name="data.path" negate="no" type="pcre2">(?i)(?:IPC\$)$</field>
<field name="data.name" negate="no" type="pcre2">(?i)spoolss</field>
<field name="data.name" negate="no" type="pcre2">(?i)^(?:spoolss)$</field>
</rule>
</rule>
<rule id="900020" level="13">
<rule id="900020" level="13">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_default_cobalt_strike_certificate.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_default_cobalt_strike_certificate.yml</info>
<!--Sigma Rule Author: Bhabesh Raj-->
<!--Sigma Rule Author: Bhabesh Raj-->
<!--Description: Detects the presence of default Cobalt Strike certificate in the HTTPS traffic-->
<!--Description: Detects the presence of default Cobalt Strike certificate in the HTTPS traffic-->
<!--Date: 2021/06/23-->
<!--Date: 2021/06/23-->
<!--Status: test-->
<!--Status: test-->
<!--ID: 7100f7e3-92ce-4584-b7b7-01b40d3d4118-->
<!--ID: 7100f7e3-92ce-4584-b7b7-01b40d3d4118-->
<mitre>
<mitre>
<id>attack.command_and_control</id>
<id>attack.command_and_control</id>
<id>attack.s0154</id>
<id>attack.s0154</id>
</mitre>
</mitre>
<description>Default Cobalt Strike Certificate</description>
<description>Default Cobalt Strike Certificate</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,x509,</group>
<group>zeek,x509,</group>
<field name="data.certificate.serial" negate="no" type="pcre2">(?i)8BB00EE</field>
<field name="data.certificate.serial" negate="no" type="pcre2">(?i)^(?:8BB00EE)$</field>
</rule>
</rule>
<rule id="900021" level="7">
<rule id="900021" level="7">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dns_mining_pools.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dns_mining_pools.yml</info>
<!--Sigma Rule Author: Saw Winn Naung, Azure-Sentinel, @neu5ron-->
<!--Sigma Rule Author: Saw Winn Naung, Azure-Sentinel, @neu5ron-->
<!--Description: Identifies clients that may be performing DNS lookups associated with common currency mining pools.-->
<!--Description: Identifies clients that may be performing DNS lookups associated with common currency mining pools.-->
<!--Date: 2021/08/19-->
<!--Date: 2021/08/19-->
<!--Status: test-->
<!--Status: test-->
<!--ID: bf74135c-18e8-4a72-a926-0e4f47888c19-->
<!--ID: bf74135c-18e8-4a72-a926-0e4f47888c19-->
<mitre>
<mitre>
<id>attack.execution</id>
<id>attack.execution</id>
<id>attack.t1569.002</id>
<id>attack.t1569.002</id>
<id>attack.impact</id>
<id>attack.impact</id>
<id>attack.t1496</id>
<id>attack.t1496</id>
</mitre>
</mitre>
<description>DNS Events Related To Mining Pools</description>
<description>DNS Events Related To Mining Pools</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>dns,zeek,</group>
<group>dns,zeek,</group>
<field name="data.query" negate="no" type="pcre2">(?i)(?:monerohash\.com|do\-dear\.com|xmrminerpro\.com|secumine\.net|xmrpool\.com|minexmr\.org|hashanywhere\.com|xmrget\.com|mininglottery\.eu|minergate\.com|moriaxmr\.com|multipooler\.com|moneropools\.com|xmrpool\.eu|coolmining\.club|supportxmr\.com|minexmr\.com|hashvault\.pro|xmrpool\.net|crypto\-pool\.fr|xmr\.pt|miner\.rocks|walpool\.com|herominers\.com|gntl\.co\.uk|semipool\.com|coinfoundry\.org|cryptoknight\.cc|fairhash\.org|baikalmine\.com|tubepool\.xyz|fairpool\.xyz|asiapool\.io|coinpoolit\.webhop\.me|nanopool\.org|moneropool\.com|miner\.center|prohash\.net|poolto\.be|cryptoescrow\.eu|monerominers\.net|cryptonotepool\.org|extrmepool\.org|webcoin\.me|kippo\.eu|hashinvest\.ws|monero\.farm|linux\-repository\-updates\.com|1gh\.com|dwarfpool\.com|hash\-to\-coins\.com|pool\-proxy\.com|hashfor\.cash|fairpool\.cloud|litecoinpool\.org|mineshaft\.ml|abcxyz\.stream|moneropool\.ru|cryptonotepool\.org\.uk|extremepool\.org|extremehash\.com|hashinvest\.net|unipool\.pro|crypto\-pools\.org|monero\.net|backup\-pool\.com|mooo\.com|freeyy\.me|cryptonight\.net|shscrypto\.net)$</field>
<field name="data.query" negate="no" type="pcre2">(?i)(?:monerohash\.com|do\-dear\.com|xmrminerpro\.com|secumine\.net|xmrpool\.com|minexmr\.org|hashanywhere\.com|xmrget\.com|mininglottery\.eu|minergate\.com|moriaxmr\.com|multipooler\.com|moneropools\.com|xmrpool\.eu|coolmining\.club|supportxmr\.com|minexmr\.com|hashvault\.pro|xmrpool\.net|crypto\-pool\.fr|xmr\.pt|miner\.rocks|walpool\.com|herominers\.com|gntl\.co\.uk|semipool\.com|coinfoundry\.org|cryptoknight\.cc|fairhash\.org|baikalmine\.com|tubepool\.xyz|fairpool\.xyz|asiapool\.io|coinpoolit\.webhop\.me|nanopool\.org|moneropool\.com|miner\.center|prohash\.net|poolto\.be|cryptoescrow\.eu|monerominers\.net|cryptonotepool\.org|extrmepool\.org|webcoin\.me|kippo\.eu|hashinvest\.ws|monero\.farm|linux\-repository\-updates\.com|1gh\.com|dwarfpool\.com|hash\-to\-coins\.com|pool\-proxy\.com|hashfor\.cash|fairpool\.cloud|litecoinpool\.org|mineshaft\.ml|abcxyz\.stream|moneropool\.ru|cryptonotepool\.org\.uk|extremepool\.org|extremehash\.com|hashinvest\.net|unipool\.pro|crypto\-pools\.org|monero\.net|backup\-pool\.com|mooo\.com|freeyy\.me|cryptonight\.net|shscrypto\.net)$</field>
<field name="data.answers" negate="yes" type="pcre2">(?i)127\.0\.0\.1</field>
<field name="data.answers" negate="yes" type="pcre2">(?i)^(?:127\.0\.0\.1)$</field>
<field name="data.answers" negate="yes" type="pcre2">(?i)0\.0\.0\.0</field>
<field name="data.answers" negate="yes" type="pcre2">(?i)^(?:0\.0\.0\.0)$</field>
<field name="full_log" negate="yes" type="pcre2">(?i)true</field>
<field name="full_log" negate="yes" type="pcre2">(?i)(?:true)</field>
</rule>
</rule>
<rule id="900022" level="7">
<rule id="900022" level="7">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dns_nkn.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dns_nkn.yml</info>
<!--Sigma Rule Author: Michael Portera (@mportatoes)-->
<!--Sigma Rule Author: Michael Portera (@mportatoes)-->
<!--Description: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>-->
<!--Description: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>-->
<!--Date: 2022/04/21-->
<!--Date: 2022/04/21-->
<!--Status: test-->
<!--Status: test-->
<!--ID: fa7703d6-0ee8-4949-889c-48c84bc15b6f-->
<!--ID: fa7703d6-0ee8-4949-889c-48c84bc15b6f-->
<mitre>
<mitre>
<id>attack.command_and_control</id>
<id>attack.command_and_control</id>
</mitre>
</mitre>
<description>New Kind of Network (NKN) Detection</description>
<description>New Kind of Network (NKN) Detection</description>
<options>no_full_log</options>
<options>no_full_log</options>
<group>zeek,dns,</group>
<group>zeek,dns,</group>
<field name="data.query" negate="no" type="pcre2">(?i)seed</field>
<field name="data.query" negate="no" type="pcre2">(?i)seed</field>
<field name="data.query" negate="no" type="pcre2">(?i)\.nkn\.org</field>
<field name="data.query" negate="no" type="pcre2">(?i)\.nkn\.org</field>
</rule>
</rule>
<rule id="900023" level="10">
<rule id="900023" level="10">
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dns_susp_zbit_flag.yml</info>
<info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dns_susp_zbit_flag.yml</info>
<!--Sigma Rule Author: @neu5ron, SOC Prime Team, Corelight-->
<!--Sigma Rule Author: @neu5ron, SOC Prime Team, Corelight-->
<!--Description: The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused).
<!--Description: The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused).
Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare.
Although recently it has been used in DNSSec, the value be
Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward.
Determine if multiple of these files were accessed
Saved diffs