Merge branch 'master' into smb_winserver_remoteaddress_

Author: swachchhanda000

.github/latest_archiver_output.md

@@ -47,6 +47,8 @@ jobs:
     - uses: actions/checkout@v4
     - name: yaml-lint
       uses: ibiqlik/action-yamllint@v3
+      with:
+        strict: true # fail on warnings as well
 
   test-sigma-logsource:
     runs-on: ubuntu-latest
@@ -64,9 +66,28 @@ jobs:
         pip install PyYAML colorama
         python tests/test_logsource.py
 
-  test-sigma:
+  test-sigma-legacy:
+    runs-on: ubuntu-latest
+    needs: yamllint
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: true
+    - name: Set up Python 3.11
+      uses: actions/setup-python@v5
+      with:
+        python-version: 3.11
+    - name: Install dependencies
+      run: |
+        pip install PyYAML colorama
+    - name: Test Sigma Rules
+      run: |
+        pip install PyYAML colorama
+        python tests/test_rules.py
+
+  sigma-check:
     runs-on: ubuntu-latest
-    needs: test-sigma-logsource
+    needs: yamllint
     steps:
     - uses: actions/checkout@v4
       with:
@@ -83,7 +104,3 @@ jobs:
     - name: Test Sigma Rule Syntax
       run: |
         sigma check --fail-on-error --fail-on-issues --validation-config tests/sigma_cli_conf.yml rules*
-    - name: Test Sigma Rules
-      run: |
-        pip install PyYAML colorama
-        python tests/test_rules.py

.github/workflows/sigma-test.yml

@@ -1,20 +1,20 @@
 title: Azure Application Credential Modified
 id: cdeef967-f9a1-4375-90ee-6978c5f23974
-status: test
+status: deprecated
 description: Identifies when a application credential is modified.
 references:
     - https://www.cloud-architekt.net/auditing-of-msi-and-service-principals/
 author: Austin Songer @austinsonger
 date: 2021-09-02
-modified: 2022-10-09
+modified: 2025-10-17
 tags:
     - attack.impact
 logsource:
     product: azure
     service: activitylogs
 detection:
     selection:
-        properties.message: 'Update application - Certificates and secrets management'
+        properties.message: 'Update application – Certificates and secrets management'
     condition: selection
 falsepositives:
     - Application credential added may be performed by a system administrator.

…gs/azure_app_credential_modification.yml …ud/azure_app_credential_modification.ymlrules/cloud/azure/activity_logs/azure_app_credential_modification.yml renamed to deprecated/cloud/azure_app_credential_modification.yml rules/cloud/azure/activity_logs/azure_app_credential_modification.yml renamed to deprecated/cloud/azure_app_credential_modification.yml

@@ -1,12 +1,12 @@
 title: Active Directory Parsing DLL Loaded Via Office Application
 id: a2a3b925-7bb0-433b-b508-db9003263cc4
-status: test
+status: deprecated # In the AD Environment, dsparse.dll is loaded everytime an Office application is launched, so this rule is not useful.
 description: Detects DSParse DLL being loaded by an Office Product
 references:
     - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
 author: Antonlovesdnb
 date: 2020-02-19
-modified: 2023-03-28
+modified: 2025-10-17
 tags:
     - attack.execution
     - attack.t1204.002

…d/image_load_office_dsparse_dll_load.yml …s/image_load_office_dsparse_dll_load.ymlrules/windows/image_load/image_load_office_dsparse_dll_load.yml renamed to deprecated/windows/image_load_office_dsparse_dll_load.yml rules/windows/image_load/image_load_office_dsparse_dll_load.yml renamed to deprecated/windows/image_load_office_dsparse_dll_load.yml

@@ -4,9 +4,10 @@ status: test
 description: Detects WannaCry ransomware activity
 references:
     - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100
+    - https://x.com/nas_bench/status/1868639048484425963
 author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro
 date: 2019-01-16
-modified: 2023-02-03
+modified: 2025-10-18
 tags:
     - attack.lateral-movement
     - attack.t1210
@@ -22,7 +23,7 @@ logsource:
     category: process_creation
     product: windows
 detection:
-    selection1:
+    selection_img:
         - Image|endswith:
               - '\tasksche.exe'
               - '\mssecsvc.exe'
@@ -35,27 +36,9 @@ detection:
               - '\linuxnew.exe'
               - '\wannacry.exe'
         - Image|contains: 'WanaDecryptor'
-    selection2:
-        - CommandLine|contains|all:
-              - 'icacls'
-              - '/grant'
-              - 'Everyone:F'
-              - '/T'
-              - '/C'
-              - '/Q'
-        - CommandLine|contains|all:
-              - 'bcdedit'
-              - '/set'
-              - '{default}'
-              - 'recoveryenabled'
-              - 'no'
-        - CommandLine|contains|all:
-              - 'wbadmin'
-              - 'delete'
-              - 'catalog'
-              - '-quiet'
-        - CommandLine|contains: '@Please_Read_Me@.txt'
-    condition: 1 of selection*
+    selection_cmd:
+        CommandLine|contains: '@Please_Read_Me@.txt'
+    condition: 1 of selection_*
 fields:
     - CommandLine
     - ParentCommandLine

rules-emerging-threats/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.yml

@@ -0,0 +1,25 @@
+title: AWS IAM User with Console Access Login Without MFA
+id: 77caf516-34e5-4df9-b4db-20744fea0a60
+status: experimental
+description: |
+    Identifies AWS IAM user authentication to the AWS Management Console without Multi-Factor Authentication (MFA).
+    IAM users who can access the Console but haven't enabled MFA pose a security risk. These accounts could be compromised through credential stuffing, brute force attacks, or social engineering techniques.
+references:
+    - https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/
+    - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html
+author: Thuya@Hacktilizer
+date: 2025-10-18
+tags:
+    - attack.initial-access
+    - attack.t1078.004
+logsource:
+    product: aws
+    service: cloudtrail
+detection:
+    selection:
+        eventName: 'ConsoleLogin'
+        additionalEventData.MFAUsed: 'NO'
+    condition: selection
+falsepositives:
+    - Unlikely
+level: medium

rules/cloud/aws/cloudtrail/aws_iam_user_with_console_access_login_without_mfa.yml

@@ -10,8 +10,10 @@ description: |
 references:
     - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
     - https://blog.aquasec.com/container-security-tnt-container-attack
+    - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking
 author: IAI
 date: 2023-03-06
+modified: 2025-10-12
 tags:
     - attack.t1562.004
     - attack.defense-evasion
@@ -31,6 +33,12 @@ detection:
         type: 'EXECVE'
         a0: 'ufw'
         a1|contains: 'delete'
+    selection4:
+        type: 'EXECVE'
+        a0: 'nft'
+        a1|contains:
+            - 'delete'
+            - 'flush'
     condition: 1 of selection*
 falsepositives:
     - Legitimate admin activity

rules/linux/auditd/lnx_auditd_modify_system_firewall.yml

@@ -15,6 +15,31 @@ tags:
 logsource:
     product: linux
     service: auditd
+    definition: |
+        Required auditd configuration:
+        -w /usr/bin/wget -p x -k susp_activity
+        -w /usr/bin/curl -p x -k susp_activity
+        -w /usr/bin/base64 -p x -k susp_activity
+        -w /bin/nc -p x -k susp_activity
+        -w /bin/netcat -p x -k susp_activity
+        -w /usr/bin/ncat -p x -k susp_activity
+        -w /usr/bin/ss -p x -k susp_activity
+        -w /usr/bin/netstat -p x -k susp_activity
+        -w /usr/bin/ssh -p x -k susp_activity
+        -w /usr/bin/scp -p x -k susp_activity
+        -w /usr/bin/sftp -p x -k susp_activity
+        -w /usr/bin/ftp -p x -k susp_activity
+        -w /usr/bin/socat -p x -k susp_activity
+        -w /usr/bin/wireshark -p x -k susp_activity
+        -w /usr/bin/tshark -p x -k susp_activity
+        -w /usr/bin/rawshark -p x -k susp_activity
+        -w /usr/bin/rdesktop -p x -k susp_activity
+        -w /usr/local/bin/rdesktop -p x -k susp_activity
+        -w /usr/bin/wlfreerdp -p x -k susp_activity
+        -w /usr/bin/xfreerdp -p x -k susp_activity
+        -w /usr/local/bin/xfreerdp -p x -k susp_activity
+        -w /usr/bin/nmap -p x -k susp_activity
+        (via https://github.com/Neo23x0/auditd/blob/ddf2603dbc985f97538d102f13b4e4446b402bae/audit.rules#L336)
 detection:
     selection:
         key: 'susp_activity'

rules/linux/auditd/lnx_auditd_susp_c2_commands.yml

@@ -9,7 +9,7 @@ references:
     - Internal Research
 author: Samir Bousseaden, @neu5ron
 date: 2020-04-02
-modified: 2021-11-27
+modified: 2025-10-17
 tags:
     - attack.collection
 logsource:
@@ -28,7 +28,7 @@ detection:
             - '.bak'
             - '.dmp'
             - '.kirbi'
-            - '\groups.xml'
+            # - '\groups.xml'  # Commented out: groups.xml is accessed legitimately by Group Policy processing; high FP rate in enterprise environments
             - '.rdp'
     condition: selection
 falsepositives:

rules/network/zeek/zeek_smb_converted_win_susp_raccess_sensitive_fext.yml

@@ -9,7 +9,7 @@ references:
     - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023-01-11
-modified: 2025-10-07
+modified: 2025-10-17
 tags:
     - attack.defense-evasion
 logsource:
@@ -35,6 +35,7 @@ detection:
             - 'https://statics.teams.cdn.office.net/'
             - 'microsoft.com' # Example: https://go.microsoft.com/fwlink/?linkid=2160968
             - 'https://installer.teams.static.microsoft/'
+            - 'https://res.cdn.office.net' # Example https://res.cdn.office.net/nativehost/5mttl/installer/v2/1.2025.617.100/Microsoft.OutlookForWindows_x64.msix
     filter_optional_onedrive:
         Path|contains: 'AppData\Local\Microsoft\OneDrive\'
     condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*