IBM QRadar: Rules: Difference between revisions
| Line 31: | Line 31: | ||
* [https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_curl_download_exec_combo.yml (Github) Sigma - Curl Download And Execute Combination] | * [https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_curl_download_exec_combo.yml (Github) Sigma - Curl Download And Execute Combination] | ||
title: Curl Download And Execute Combination | |||
... | |||
selection: | selection: | ||
CommandLine|contains|windash: ' -c ' | CommandLine|contains|windash: ' -c ' | ||
| Line 42: | Line 44: | ||
And in IBM QRadar Rule: | And in IBM QRadar Rule: | ||
Apply ''' | Apply '''Curl Download And Execute Combination''' | ||
'''and''' when an event matches '''any''' of the following '''BB: Windows Endpoint Events''' | '''and''' when an event matches '''any''' of the following '''BB: Windows Endpoint Events''' | ||
'''and''' when the event matches '''Event ID is any of 4688''' | '''and''' when the event matches '''Event ID is any of 4688''' | ||
Revision as of 19:01, 19 January 2025
Uma Rule (regra) é um grupo de testes que podem desencadear uma ação se condições específicas forem atendidas.
Artigos
Exemplos
| Rule | Description |
|---|---|
|
Apply Potential Windows Enumeration Detected |
Comandos que hackers pegam informações em servidores MS Windows |
| . | . |
| . | . |
Exemplo: (Github) Sigma - Curl Download And Execute Combination
title: Curl Download And Execute Combination
...
selection:
CommandLine|contains|windash: ' -c '
CommandLine|contains|all:
- 'curl '
- 'http'
- '-o'
- '&'
condition: selection
And in IBM QRadar Rule:
Apply Curl Download And Execute Combination and when an event matches any of the following BB: Windows Endpoint Events and when the event matches Event ID is any of 4688 and when the event matches Command (custom) any of [/c or curl or http or -o or &]