Skip to content

Commit 51bb847

Browse files
swachchhanda000swachchhanda000
authored
Merge branch 'master' into sep25_fps
2 parents 76d719b + d36fc36 commit 51bb847

48 files changed

Lines changed: 1025 additions & 184 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/goodlog-tests.yml‎

Lines changed: 1 addition & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -3,40 +3,7 @@
33

44
name: Goodlog Tests
55

6-
on:
7-
push:
8-
branches:
9-
- "*"
10-
paths:
11-
- ".github/workflows/goodlog-tests.yml"
12-
- ".github/workflows/known-FPs.csv"
13-
- "deprecated/**.yml"
14-
- "rules-compliance/**.yml"
15-
- "rules-dfir/**.yml"
16-
- "rules-emerging-threats/**.yml"
17-
- "rules-placeholder/**.yml"
18-
- "rules-threat-hunting/**.yml"
19-
- "rules/**.yml"
20-
- "tests/thor.yml"
21-
- "unsupported/**.yml"
22-
pull_request:
23-
branches:
24-
- master
25-
paths:
26-
- ".github/workflows/goodlog-tests.yml"
27-
- ".github/workflows/known-FPs.csv"
28-
- "deprecated/**.yml"
29-
- "rules-compliance/**.yml"
30-
- "rules-dfir/**.yml"
31-
- "rules-emerging-threats/**.yml"
32-
- "rules-placeholder/**.yml"
33-
- "rules-threat-hunting/**.yml"
34-
- "rules/**.yml"
35-
- "tests/thor.yml"
36-
- "unsupported/**.yml"
37-
38-
# Allows you to run this workflow manually from the Actions tab
39-
workflow_dispatch:
6+
on: [push, pull_request, workflow_dispatch]
407

418
env:
429
EVTX_BASELINE_VERSION: v0.8.2

‎.github/workflows/sigma-test.yml‎

Lines changed: 1 addition & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -3,42 +3,7 @@
33

44
name: Sigma Rule Tests
55

6-
on:
7-
push:
8-
branches:
9-
- "*"
10-
paths:
11-
- ".github/workflows/sigma-test.yml"
12-
- "deprecated/**.yml"
13-
- "rules-compliance/**.yml"
14-
- "rules-dfir/**.yml"
15-
- "rules-emerging-threats/**.yml"
16-
- "rules-placeholder/**.yml"
17-
- "rules-threat-hunting/**.yml"
18-
- "rules/**.yml"
19-
- "tests/sigma_cli_conf.yml"
20-
- "tests/test_logsource.py"
21-
- "tests/test_rules.py"
22-
- "unsupported/**.yml"
23-
pull_request:
24-
branches:
25-
- master
26-
paths:
27-
- ".github/workflows/sigma-test.yml"
28-
- "deprecated/**.yml"
29-
- "rules-compliance/**.yml"
30-
- "rules-dfir/**.yml"
31-
- "rules-emerging-threats/**.yml"
32-
- "rules-placeholder/**.yml"
33-
- "rules-threat-hunting/**.yml"
34-
- "rules/**.yml"
35-
- "tests/sigma_cli_conf.yml"
36-
- "tests/test_logsource.py"
37-
- "tests/test_rules.py"
38-
- "unsupported/**.yml"
39-
40-
# Allows you to run this workflow manually from the Actions tab
41-
workflow_dispatch:
6+
on: [push, pull_request, workflow_dispatch]
427

438
jobs:
449
yamllint:
@@ -77,9 +42,6 @@ jobs:
7742
uses: actions/setup-python@v5
7843
with:
7944
python-version: 3.11
80-
- name: Install dependencies
81-
run: |
82-
pip install PyYAML colorama
8345
- name: Test Sigma Rules
8446
run: |
8547
pip install PyYAML colorama

‎.github/workflows/sigma-validation.yml‎

Lines changed: 1 addition & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,6 @@
11
name: Validate Sigma rules
22

3-
on:
4-
push:
5-
branches:
6-
- "*"
7-
paths:
8-
- "deprecated/**.yml"
9-
- "rules-compliance/**.yml"
10-
- "rules-dfir/**.yml"
11-
- "rules-emerging-threats/**.yml"
12-
- "rules-placeholder/**.yml"
13-
- "rules-threat-hunting/**.yml"
14-
- "rules/**.yml"
15-
- "tests/validate-sigma-schema/validate.sh"
16-
- "unsupported/**.yml"
17-
pull_request:
18-
branches:
19-
- master
20-
paths:
21-
- "deprecated/**.yml"
22-
- "rules-compliance/**.yml"
23-
- "rules-dfir/**.yml"
24-
- "rules-emerging-threats/**.yml"
25-
- "rules-placeholder/**.yml"
26-
- "rules-threat-hunting/**.yml"
27-
- "rules/**.yml"
28-
- "tests/validate-sigma-schema/validate.sh"
29-
- "unsupported/**.yml"
30-
31-
# Allows you to run this workflow manually from the Actions tab
32-
workflow_dispatch:
3+
on: [push, pull_request, workflow_dispatch]
334

345
jobs:
356
sigma-rules-validator:

rules/windows/process_creation/proc_creation_win_powershell_susp_ps_downloadfile.yml renamed to deprecated/windows/proc_creation_win_powershell_susp_ps_downloadfile.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
title: PowerShell DownloadFile
22
id: 8f70ac5f-1f6f-4f8e-b454-db19561216c5
3-
status: test
3+
status: deprecated # Deprecated in favor of 3b6ab547-8ec2-4991-b9d2-2b06702a48d7
44
description: Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line
55
references:
66
- https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html
77
author: Florian Roth (Nextron Systems)
88
date: 2020-08-28
9-
modified: 2021-11-27
9+
modified: 2025-10-20
1010
tags:
1111
- attack.execution
1212
- attack.t1059.001

rules/windows/process_creation/proc_creation_win_whoami_execution.yml renamed to deprecated/windows/proc_creation_win_whoami_execution.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
title: Whoami Utility Execution
22
id: e28a5a99-da44-436d-b7a0-2afc20a5f413
3-
status: test
3+
status: deprecated # Deprecated in favor of 502b42de-4306-40b4-9596-6f590c81f073
44
description: Detects the execution of whoami, which is often used by attackers after exploitation / privilege escalation
55
references:
66
- https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/
77
- https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/
88
author: Florian Roth (Nextron Systems)
99
date: 2018-08-13
10-
modified: 2023-11-30
10+
modified: 2025-10-20
1111
tags:
1212
- attack.discovery
1313
- attack.t1033

‎rules-emerging-threats/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.yml‎

Lines changed: 6 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,10 @@ status: test
44
description: Detects WannaCry ransomware activity
55
references:
66
- https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100
7+
- https://x.com/nas_bench/status/1868639048484425963
78
author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro
89
date: 2019-01-16
9-
modified: 2023-02-03
10+
modified: 2025-10-18
1011
tags:
1112
- attack.lateral-movement
1213
- attack.t1210
@@ -22,7 +23,7 @@ logsource:
2223
category: process_creation
2324
product: windows
2425
detection:
25-
selection1:
26+
selection_img:
2627
- Image|endswith:
2728
- '\tasksche.exe'
2829
- '\mssecsvc.exe'
@@ -35,27 +36,9 @@ detection:
3536
- '\linuxnew.exe'
3637
- '\wannacry.exe'
3738
- Image|contains: 'WanaDecryptor'
38-
selection2:
39-
- CommandLine|contains|all:
40-
- 'icacls'
41-
- '/grant'
42-
- 'Everyone:F'
43-
- '/T'
44-
- '/C'
45-
- '/Q'
46-
- CommandLine|contains|all:
47-
- 'bcdedit'
48-
- '/set'
49-
- '{default}'
50-
- 'recoveryenabled'
51-
- 'no'
52-
- CommandLine|contains|all:
53-
- 'wbadmin'
54-
- 'delete'
55-
- 'catalog'
56-
- '-quiet'
57-
- CommandLine|contains: '@Please_Read_Me@.txt'
58-
condition: 1 of selection*
39+
selection_cmd:
40+
CommandLine|contains: '@Please_Read_Me@.txt'
41+
condition: 1 of selection_*
5942
fields:
6043
- CommandLine
6144
- ParentCommandLine

‎rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_smbclient_connectivity_exploit_cve_2023_23397_outlook_remote_file.yml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ references:
77
- https://github.com/nasbench/Misc-Research/blob/fc46f6da34ff7e0076da28fd3e66d6e1100f1c2f/ETW/Microsoft-Windows-SMBClient.md
88
author: Nasreddine Bencherchali (Nextron Systems)
99
date: 2023-04-05
10-
modified: 2025-04-07
10+
modified: 2025-10-13
1111
tags:
1212
- attack.exfiltration
1313
- cve.2023-23397
@@ -73,6 +73,18 @@ detection:
7373
- '0200????0A' # 10.
7474
- '0200????7F' # 127
7575
- '0200????A9FE' # 169.254.
76+
- RemoteAddress|contains:
77+
# IPv6
78+
- '00000000000000000000000000000001' # ::1 - IPv6 loopback
79+
- 'FE80000000000000' # fe80:: - IPv6 link-local addresses
80+
- 'FC00000000000000' # fc00:: - IPv6 private addresses
81+
# IPv4
82+
# The "?" are meant to represent the port
83+
- '0200????C0A8' # 192.168.
84+
- '0200????AC' # 172.
85+
- '0200????0A' # 10.
86+
- '0200????7F' # 127
87+
- '0200????A9FE' # 169.254.
7688
condition: selection and not 1 of filter_main_*
7789
falsepositives:
7890
- Some false positives may occur from external trusted servers. Apply additional filters accordingly

‎rules-emerging-threats/2025/Exploits/CVE-2025-10035/proc_creation_win_exploit_cve_2025_10035.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
title: Potential Exploitation of GoAnywhere MFT Vulnerability
2+
id: 6c76b3d0-afe4-4870-9443-ffe6773c5fef
3+
status: experimental
4+
description: |
5+
Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035.
6+
This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.
7+
references:
8+
- https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/
9+
author: MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
10+
date: 2025-10-07
11+
tags:
12+
- attack.initial-access
13+
- attack.t1190
14+
- attack.execution
15+
- attack.t1059.001
16+
- attack.persistence
17+
- attack.t1133
18+
- detection.emerging-threats
19+
- cve.2025-10035
20+
logsource:
21+
category: process_creation
22+
product: windows
23+
detection:
24+
# Detects the GoAnywhere Tomcat parent process based on path and command line arguments
25+
selection_parent:
26+
ParentImage|contains: '\GoAnywhere\tomcat\'
27+
selection_powershell_img:
28+
Image|endswith:
29+
- '\powershell.exe'
30+
- '\powershell_ise.exe'
31+
- '\pwsh.exe'
32+
selection_powershell_cmd:
33+
- CommandLine|contains|all:
34+
- 'IEX'
35+
- 'enc'
36+
- 'Hidden'
37+
- 'bypass'
38+
- CommandLine|re:
39+
- 'net\s+user'
40+
- 'net\s+group'
41+
- 'query\s+session'
42+
- CommandLine|contains:
43+
- 'whoami'
44+
- 'systeminfo'
45+
- 'dsquery'
46+
- 'localgroup administrators'
47+
- 'nltest'
48+
- 'samaccountname='
49+
- 'adscredentials'
50+
- 'o365accountconfiguration'
51+
- '.DownloadString('
52+
- '.DownloadFile('
53+
- 'FromBase64String('
54+
- 'System.IO.Compression'
55+
- 'System.IO.MemoryStream'
56+
- 'curl'
57+
selection_child_cmd:
58+
Image|endswith: '\cmd.exe'
59+
CommandLine|contains:
60+
- 'powershell'
61+
- 'whoami'
62+
- 'net.exe'
63+
- 'net1.exe'
64+
- 'rundll32'
65+
- 'quser'
66+
- 'nltest'
67+
- 'curl'
68+
selection_child_others:
69+
CommandLine|contains:
70+
- 'bitsadmin'
71+
- 'certutil'
72+
- 'mshta'
73+
- 'cscript'
74+
- 'wscript'
75+
condition: selection_parent and (all of selection_powershell_* or 1 of selection_child_*)
76+
falsepositives:
77+
- Legitimate administrative scripts or built-in GoAnywhere functions could potentially trigger this rule. Tuning may be required based on normal activity in your environment.
78+
level: high

‎rules-emerging-threats/2025/Exploits/CVE-2025-32463/file_event_lnx_exploit_cve_2025_32463.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
title: Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation
2+
id: 10ac0730-c24e-4f4c-81f8-b13a1ac95a1d
3+
status: experimental
4+
description: |
5+
Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463.
6+
This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations.
7+
When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment,
8+
potentially leading to arbitrary code execution and privilege escalation.
9+
references:
10+
- https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh
11+
author: Swachchhanda Shrawn Poudel (Nextron Systems)
12+
date: 2025-10-02
13+
tags:
14+
- attack.privilege-escalation
15+
- attack.t1068
16+
- cve.2025-32463
17+
- detection.emerging-threats
18+
logsource:
19+
category: file_event
20+
product: linux
21+
detection:
22+
selection:
23+
TargetFilename|endswith: '/etc/nsswitch.conf'
24+
filter_main_legitimate_path:
25+
TargetFilename: '/etc/nsswitch.conf'
26+
condition: selection and not 1 of filter_main_*
27+
falsepositives:
28+
- Backup locations
29+
level: high

‎rules-emerging-threats/2025/Exploits/CVE-2025-57788/proc_creation_win_exploit_cve_2025_57788.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
title: Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788)
2+
id: 917789e1-2c1f-4bf5-8c91-6f71a017f469
3+
status: experimental
4+
description: |
5+
Detects a qlogin.exe command attempting to authenticate as the internal `_+_PublicSharingUser_` using a GUID as the password.
6+
This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.
7+
references:
8+
- https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
9+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
10+
date: 2025-10-20
11+
tags:
12+
- attack.initial-access
13+
- attack.t1078.001
14+
- detection.emerging-threats
15+
- cve.2025-57788
16+
logsource:
17+
category: process_creation
18+
product: windows
19+
detection:
20+
selection:
21+
CommandLine|contains|all:
22+
- 'qlogin'
23+
- '_+_PublicSharingUser_'
24+
# Detects the use of a GUID as the password, which is indicative of an exploit attempt
25+
CommandLine|re: '[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}'
26+
condition: selection
27+
falsepositives:
28+
- Legitimate administrative scripts that use the `_+_PublicSharingUser_` account for valid purposes.
29+
level: medium

0 commit comments

Comments
 (0)