Potential CVE-2023-23397 Exploitation Attempt - Windows Server filter

[djlukic]

Summary of the Pull Request

Hi,

I have found that RemoteAddress field exists on Windows Server and hence why I am proposing this filter for private addresses.

Changelog

Potential CVE-2023-23397 Exploitation Attempt - SMB (de96b824-02b0-4241-9356-7e9b47f04bac)

• Added RemoteAddress field to filters

Example Log Event

{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "System": {
      "Provider": {
        "#attributes": {
          "Name": "Microsoft-Windows-SMBClient",
          "Guid": "988C59C5-0A1C-45B6-A555-0C62276E327D"
        }
      },
      "EventID": 30803,
      "Version": 2,
      "Level": 2,
      "Task": 0,
      "Opcode": 0,
      "Keywords": "0x400000000000040",
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2023-12-27T00:33:18.000507Z"
        }
      },
      "EventRecordID": 208480,
      "Correlation": null,
      "Execution": {
        "#attributes": {
          "ProcessID": 4,
          "ThreadID": 11616
        }
      },
      "Channel": "Microsoft-Windows-SmbClient/Connectivity",
      "Computer": "[redacted].local",
      "Security": {
        "#attributes": {
          "UserID": "S-1-5-18"
        }
      }
    },
    "EventData": {
      "Reason": 4,
      "Status": 3221225991,
      "ServerNameLength": 15,
      "ServerName": "[redacted]",
      "AddressLength": 28,
      "RemoteAddress": "170001BD00000000FE800000000000000517A6851A7BD06E0D000000",
      "LocalAddress": "00000000000000000000000000000000000000000000000000000000",
      "InstanceNameLength": 24,
      "InstanceName": "\\Device\\LanmanRedirector",
      "ConnectionType": 1
    }
  }
}

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions