Rules Update

wagga40 · Dec 2, 2023 · 990cd0d · 990cd0d
1 parent f63b4d0
commit 990cd0d
Show file tree

Hide file tree

Showing 14 changed files with 1,271 additions and 995 deletions.
diff --git a/pdm.lock b/pdm.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -12,7 +12,7 @@ dependencies = [
     "pymisp>=2.4.179",
     "PyYAML>=6.0.1",
     "ruamel-yaml>=0.18.5",
-    "termcolor>=2.3.0",
+    "termcolor>=2.4.0",
     "pysigma>=0.10.9",
     "pysigma-pipeline-sysmon>=1.0.3",
     "pysigma-pipeline-windows>=1.1.1",

diff --git a/rules_linux.json b/rules_linux.json
@@ -2373,6 +2373,24 @@
         ],
         "filename": "proc_creation_lnx_susp_java_children.yml"
     },
+    {
+        "title": "Potential Linux Process Code Injection Via DD Utility",
+        "id": "4cad6c64-d6df-42d6-8dae-eb78defdc415",
+        "description": "Detects the injection of code by overwriting the memory map of a Linux process using the \"dd\" Linux command.",
+        "author": "Joseph Kamau",
+        "tags": [
+            "attack.defense_evasion",
+            "attack.t1055.009"
+        ],
+        "falsepositives": [
+            "Unknown"
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE (Image LIKE '%/dd' ESCAPE '\\' AND CommandLine LIKE '%of=%' ESCAPE '\\' AND CommandLine LIKE '%/proc/%' ESCAPE '\\' AND CommandLine LIKE '%/mem%' ESCAPE '\\')"
+        ],
+        "filename": "proc_creation_lnx_dd_process_injection.yml"
+    },
     {
         "title": "Decode Base64 Encoded Text",
         "id": "e2072cab-8c9a-459b-b63c-40ae79e27031",

diff --git a/rules_windows_generic.json b/rules_windows_generic.json
diff --git a/rules_windows_generic_full.json b/rules_windows_generic_full.json
diff --git a/rules_windows_generic_high.json b/rules_windows_generic_high.json
diff --git a/rules_windows_generic_medium.json b/rules_windows_generic_medium.json
diff --git a/rules_windows_generic_pysigma.json b/rules_windows_generic_pysigma.json
diff --git a/rules_windows_sysmon.json b/rules_windows_sysmon.json
diff --git a/rules_windows_sysmon_full.json b/rules_windows_sysmon_full.json
diff --git a/rules_windows_sysmon_high.json b/rules_windows_sysmon_high.json
diff --git a/rules_windows_sysmon_medium.json b/rules_windows_sysmon_medium.json
diff --git a/rules_windows_sysmon_pysigma.json b/rules_windows_sysmon_pysigma.json
diff --git a/sigma b/sigma