Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Multiple Rules to cover the '-' flags along with '/' flags #4739

Open
wants to merge 10 commits into
base: master
Choose a base branch
from

Conversation

qasimqlf
Copy link
Contributor

@qasimqlf qasimqlf commented Feb 26, 2024

Summary of the Pull Request

Many binaries accepts both type of arguments that startswith '/' and '-'. So, i updated some rules having flags with '/' as prefix to check for '-' prefix as well. And i tested all updated flags.

Changelog

update: Esentutl Gather Credentials - Increase coverage by adding for the "/" option in commands flags
update: Copying Sensitive Files with Credential Data - Increase coverage by adding for the "/" option in commands flags
update: Explorer Process Tree Break - Increase coverage by adding for the "/" option in commands flags
update: LSASS Process Reconnaissance Via Findstr.EXE - Increase coverage by adding for the "/" option in commands flags
update: Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location - Increase coverage by adding for the "/" option in commands flags
update: Lolbin Unregmp2.exe Use As Proxy - Increase coverage by adding for the "/" option in commands flags
update: New Remote Desktop Connection Initiated Via Mstsc.EXE - Increase coverage by adding for the "/" option in commands flags

Example Log Event

N/A

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

  • If your PR adds new rules, please consider following and applying these conventions

@github-actions github-actions bot added Rules Windows Pull request add/update windows related rules labels Feb 26, 2024
@qasimqlf qasimqlf marked this pull request as ready for review February 27, 2024 08:23
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
@nasbench nasbench self-assigned this Mar 5, 2024
@nasbench nasbench added the Work In Progress Some changes are needed label Mar 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Rules Windows Pull request add/update windows related rules Work In Progress Some changes are needed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants