IBM QRadar: Rules: Difference between revisions
Line 31: | Line 31: | ||
* [https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_curl_download_exec_combo.yml (Github) Sigma - Curl Download And Execute Combination] | * [https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_curl_download_exec_combo.yml (Github) Sigma - Curl Download And Execute Combination] | ||
title: Curl Download And Execute Combination | |||
... | |||
selection: | selection: | ||
CommandLine|contains|windash: ' -c ' | CommandLine|contains|windash: ' -c ' | ||
Line 42: | Line 44: | ||
And in IBM QRadar Rule: | And in IBM QRadar Rule: | ||
Apply ''' | Apply '''Curl Download And Execute Combination''' | ||
'''and''' when an event matches '''any''' of the following '''BB: Windows Endpoint Events''' | '''and''' when an event matches '''any''' of the following '''BB: Windows Endpoint Events''' | ||
'''and''' when the event matches '''Event ID is any of 4688''' | '''and''' when the event matches '''Event ID is any of 4688''' |
Revision as of 19:01, 19 January 2025
Uma Rule (regra) é um grupo de testes que podem desencadear uma ação se condições específicas forem atendidas.
Artigos
Exemplos
Rule | Description |
---|---|
Apply Potential Windows Enumeration Detected |
Comandos que hackers pegam informações em servidores MS Windows |
. | . |
. | . |
Exemplo: (Github) Sigma - Curl Download And Execute Combination
title: Curl Download And Execute Combination ... selection: CommandLine|contains|windash: ' -c ' CommandLine|contains|all: - 'curl ' - 'http' - '-o' - '&' condition: selection
And in IBM QRadar Rule:
Apply Curl Download And Execute Combination and when an event matches any of the following BB: Windows Endpoint Events and when the event matches Event ID is any of 4688 and when the event matches Command (custom) any of [/c or curl or http or -o or &]