Merge branch 'master' into akira-ransomware

Author: frack113

.github/PULL_REQUEST_TEMPLATE.md

@@ -44,4 +44,4 @@ Link the fixed issues here, in case your commit fixes issues with rules or code
 
 ### SigmaHQ Rule Creation Conventions
 
-- If your PR adds new rules, please consider following and applying these [conventions](https://github.com/SigmaHQ/sigma-specification/blob/main/sigmahq/sigmahq_conventions.md)
+- If your PR adds new rules, please consider following and applying these [conventions](https://github.com/SigmaHQ/sigma-specification/blob/main/sigmahq/)

.github/latest_archiver_output.md

@@ -29,6 +29,6 @@ jobs:
             
             It looks like this is your first pull request on the Sigma rules repository!
 
-            Please make sure to read the [SigmaHQ conventions](https://github.com/SigmaHQ/sigma-specification/blob/main/sigmahq/sigmahq_conventions.md) document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.
+            Please make sure to read the [SigmaHQ conventions](https://github.com/SigmaHQ/sigma-specification/blob/main/sigmahq/) document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.
 
             Thanks again, and welcome to the Sigma community! :smiley:

.github/workflows/greetings.yml

@@ -75,7 +75,7 @@ jobs:
         python-version: 3.11
     - name: Install dependencies
       run: |
-        # pip install sigma-cli~=0.7.1
+        pip install pysigma
         pip install sigma-cli
         pip install pySigma-validators-sigmahq==0.7.0
     - name: Test Sigma Rule Syntax

.github/workflows/sigma-test.yml

@@ -48,6 +48,6 @@ git push origin your-feature-branch
 
 ## 📚 Adding or Updating Detection Rules
 
-To update or contribute a new rule please make sure to follow the guidelines in the [SigmaHQ conventions document](https://github.com/SigmaHQ/sigma-specification/blob/main/sigmahq/sigmahq_conventions.md). Consider installing the [VsCode Sigma Extension](https://marketplace.visualstudio.com/items?itemName=humpalum.sigma) for auto completion and quality of life features.
+To update or contribute a new rule please make sure to follow the guidelines in the [SigmaHQ conventions documents](https://github.com/SigmaHQ/sigma-specification/blob/main/sigmahq). Consider installing the [VsCode Sigma Extension](https://marketplace.visualstudio.com/items?itemName=humpalum.sigma) for auto completion and quality of life features.
 
 Thank you for contributing to Sigma! 🧙‍♂️

CONTRIBUTING.md

@@ -93,6 +93,7 @@ If you find a false positive or would like to propose a new detection rule idea
 * [alterix](https://github.com/mtnmunuklu/alterix) - Converts Sigma rules to the query language of CRYPTTECH's SIEM
 * [AttackIQ](https://www.attackiq.com/2024/01/10/sigmaiq-attackiqs-latest-innovation-for-actionable-detections/) - Sigma Rules integrated in AttackIQ's platform, and [SigmAIQ](https://github.com/AttackIQ/SigmAIQ) for Sigma rule conversion and LLM apps
 * [Atomic Threat Coverage](https://github.com/atc-project/atomic-threat-coverage) (Since December 2018)
+* [AttackRuleMap - Mapping of Atomic Red Team tests and Sigma Rules](https://attackrulemap.com/)
 * [Confluent Sigma](https://github.com/confluentinc/confluent-sigma) - Kafka Streams supported Sigma rules
 * [IBM QRadar](https://community.ibm.com/community/user/security/blogs/gladys-koskas1/2023/08/02/qradar-natively-supports-sigma-for-rules-creation)
 * [Impede Detection Platform](https://impede.ai/)
@@ -102,6 +103,7 @@ If you find a false positive or would like to propose a new detection rule idea
 * [Nextron's Aurora Agent](https://www.nextron-systems.com/aurora/)
 * [Nextron's THOR Scanner](https://www.nextron-systems.com/thor/) - Scan with Sigma rules on endpoints
 * [RANK VASA](https://globenewswire.com/news-release/2019/03/04/1745907/0/en/RANK-Software-to-Help-MSSPs-Scale-Cybersecurity-Offerings.html)
+* [Security Onion](https://docs.securityonion.net/en/latest/sigma.html)
 * [Sekoia.io XDR](https://www.sekoia.io) - XDR supporting Sigma and Sigma Correlation rules languages
 * [sigma2stix](https://github.com/muchdogesec/sigma2stix) - Converts the entire SigmaHQ Ruleset into STIX 2.1 Objects.
   * A versioned archive of sigma2stix STIX 2.1 data is also available to [download here](https://github.com/muchdogesec/cti_knowledge_base_store/tree/main/sigma-rules).

README.md

@@ -1,6 +1,6 @@
 title: OMIGOD SCX RunAsProvider ExecuteShellCommand - Auditd
 id: 045b5f9c-49f7-4419-a236-9854fb3c827a
-status: test
+status: unsupported # This rule requires correlations. See https://github.com/SigmaHQ/sigma/discussions/4440#discussioncomment-7070862 and https://user-images.githubusercontent.com/9653181/133756156-4fb9c2b1-aa65-4380-957b-72170de36fc4.png
 description: |
     Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
     SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager.
@@ -9,11 +9,11 @@ references:
     - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
     - https://github.com/Azure/Azure-Sentinel/pull/3059
 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
-date: 2021/09/17
-modified: 2022/11/26
+date: 2021-09-17
+modified: 2024-09-02
 tags:
-    - attack.privilege_escalation
-    - attack.initial_access
+    - attack.privilege-escalation
+    - attack.initial-access
     - attack.execution
     - attack.t1068
     - attack.t1190

…cx_runasprovider_executeshellcommand.yml …cx_runasprovider_executeshellcommand.ymlrules/linux/auditd/lnx_auditd_omigod_scx_runasprovider_executeshellcommand.yml renamed to deprecated/linux/lnx_auditd_omigod_scx_runasprovider_executeshellcommand.yml rules/linux/auditd/lnx_auditd_omigod_scx_runasprovider_executeshellcommand.yml renamed to deprecated/linux/lnx_auditd_omigod_scx_runasprovider_executeshellcommand.yml

@@ -42,28 +42,6 @@ detection:
             - 'MD5=0f16a43f7989034641fd2de3eb268bf1'
             - 'MD5=ee6b1a79cb6641aa44c762ee90786fe0'
             - 'MD5=909f3fc221acbe999483c87d9ead024a'
-    selection_hash:
-        - sha256:
-            - '0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc'
-            - '9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c'
-            - '8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104'
-            - 'd7c81b0f3c14844f6424e8bdd31a128e773cb96cccef6d05cbff473f0ccb9f9c'
-            - '05b146a48a69dd62a02759487e769bd30d39f16374bc76c86453b4ae59e7ffa4'
-            - 'c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497'
-        - sha1:
-            - '31cc8718894d6e6ce8c132f68b8caaba39b5ba7a'
-            - 'a804ebec7e341b4d98d9e94f6e4860a55ea1638d'
-            - '6debce728bcff73d9d1d334df0c6b1c3735e295c'
-            - 'cc65bf60600b64feece5575f21ab89e03a728332'
-            - '3ef30c95e40a854cc4ded94fc503d0c3dc3e620e'
-            - 'b2f955b3e6107f831ebe67997f8586d4fe9f3e98'
-        - md5:
-            - '10f3679384a03cb487bda9621ceb5f90'
-            - '04a88f5974caa621cee18f34300fc08a'
-            - '6fcf56f6ca3210ec397e55f727353c4a'
-            - '0f16a43f7989034641fd2de3eb268bf1'
-            - 'ee6b1a79cb6641aa44c762ee90786fe0'
-            - '909f3fc221acbe999483c87d9ead024a'
     condition: 1 of selection*
 falsepositives:
     - Legitimate BIOS driver updates (should be rare)

deprecated/windows/driver_load_win_mal_poortry_driver.yml

@@ -19,16 +19,12 @@ detection:
             - 'MD5=a179c4093d05a3e1ee73f6ff07f994aa'
             - 'SHA1=5d6b9e80e12bfc595d4d26f6afb099b3cb471dd4'
             - 'SHA256=4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1'
-    selection_other:
-        - md5: 'a179c4093d05a3e1ee73f6ff07f994aa'
-        - sha1: '5d6b9e80e12bfc595d4d26f6afb099b3cb471dd4'
-        - sha256: '4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1'
     driver_img:
         ImageLoaded|endswith: '\aswArPot.sys'
     driver_status:
         - Signed: 'false'
         - SignatureStatus: Expired
-    condition: 1 of selection* or all of driver_*
+    condition: selection_sysmon or all of driver_*
 falsepositives:
     - Unknown
 level: high

deprecated/windows/driver_load_win_vuln_avast_anti_rootkit_driver.yml

@@ -26,16 +26,6 @@ detection:
             - 'SHA1=10B30BDEE43B3A2EC4AA63375577ADE650269D25'
             - 'MD5=C996D7971C49252C582171D9380360F2'
             - 'MD5=D2FD132AB7BBC6BBB87A84F026FA0244'
-    selection_hash:
-        - sha256:
-            - '0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5'
-            - 'ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1'
-        - sha1:
-            - 'c948ae14761095e4d76b55d9de86412258be7afd'
-            - '10b30bdee43b3a2ec4aa63375577ade650269d25'
-        - md5:
-            - 'c996d7971c49252c582171d9380360f2'
-            - 'd2fd132ab7bbc6bbb87a84f026fa0244'
     condition: 1 of selection*
 falsepositives:
     - Legitimate BIOS driver updates (should be rare)