New Rule for Suspicious Network Tunneling with QEMU

[threatHNTR]

Summary of the Pull Request

Added a new detection rule for identifying potentially suspicious network tunneling activities initiated through QEMU virtual machine instances on Windows systems.

Changelog

new: Suspicious Network Tunneling with QEMU

Example Log Event

From SecureList Blog:

Focused the detection around the socket connection.

-netdev socket,id=sock,connect=<IP>:443

From QEMU Documentation:

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @threatHNTR 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃