Merge pull request #19 from Khadinxc/update-sigma-rules-34

Update Splunk Rules from Sigma Repository:
-  Large amount of file changes due to latest changes to MITRE ATT&CK framework splitting the Defense Evasion tactic into Defense Impairment and Stealth.

Author: Khadinxc

Splunk/rules-emerging-threats/2014/TA/Axiom/proc_creation_win_apt_zxshell.spl

@@ -4,7 +4,7 @@
 # Level: critical
 # Description: Detects a ZxShell start by the called and well-known function name
 # MITRE Tactic: Execution
-# Tags: attack.execution, attack.t1059.003, attack.defense-evasion, attack.t1218.011, attack.s0412, attack.g0001, detection.emerging-threats
+# Tags: attack.execution, attack.stealth, attack.t1059.003, attack.t1218.011, attack.s0412, attack.g0001, detection.emerging-threats
 # Reference: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2014/TA/Axiom/proc_creation_win_apt_zxshell.yml
 # False Positives:
 #   - Unlikely

Splunk/rules-emerging-threats/2014/TA/Turla/proc_creation_win_apt_turla_comrat_may20.spl

@@ -4,7 +4,7 @@
 # Level: critical
 # Description: Detects commands used by Turla group as reported by ESET in May 2020
 # MITRE Tactic: Privilege Escalation
-# Tags: attack.privilege-escalation, attack.persistence, attack.defense-evasion, attack.g0010, attack.execution, attack.t1059.001, attack.t1053.005, attack.t1027, detection.emerging-threats
+# Tags: attack.privilege-escalation, attack.persistence, attack.stealth, attack.g0010, attack.execution, attack.t1059.001, attack.t1053.005, attack.t1027, detection.emerging-threats
 # Reference: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2014/TA/Turla/proc_creation_win_apt_turla_comrat_may20.yml
 
 

Splunk/rules-emerging-threats/2015/Exploits/CVE-2015-1641/proc_creation_win_exploit_cve_2015_1641.spl

@@ -3,8 +3,8 @@
 # Date: 2018-02-22
 # Level: critical
 # Description: Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641
-# MITRE Tactic: Defense Evasion
-# Tags: attack.defense-evasion, attack.t1036.005, cve.2015-1641, detection.emerging-threats
+# MITRE Tactic: Uncategorized
+# Tags: attack.stealth, attack.t1036.005, cve.2015-1641, detection.emerging-threats
 # Reference: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2015/Exploits/CVE-2015-1641/proc_creation_win_exploit_cve_2015_1641.yml
 
 Image="*\\MicroScMgmt.exe" ParentImage="*\\WINWORD.EXE"

Splunk/rules-emerging-threats/2017/Malware/Fireball/proc_creation_win_malware_fireball.spl

@@ -4,7 +4,7 @@
 # Level: high
 # Description: Detects Archer malware invocation via rundll32
 # MITRE Tactic: Execution
-# Tags: attack.execution, attack.defense-evasion, attack.t1218.011, detection.emerging-threats
+# Tags: attack.execution, attack.stealth, attack.t1218.011, detection.emerging-threats
 # Reference: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/Fireball/proc_creation_win_malware_fireball.yml
 
 CommandLine="*rundll32.exe*" CommandLine="*InstallArcherSvc*"

Splunk/rules-emerging-threats/2017/Malware/Hancitor/proc_access_win_malware_verclsid_shellcode.spl

@@ -3,8 +3,8 @@
 # Date: 2017-03-04
 # Level: high
 # Description: Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro
-# MITRE Tactic: Defense Evasion
-# Tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.emerging-threats
+# MITRE Tactic: Privilege Escalation
+# Tags: attack.privilege-escalation, attack.stealth, attack.t1055, detection.emerging-threats
 # Reference: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/Hancitor/proc_access_win_malware_verclsid_shellcode.yml
 
 GrantedAccess="0x1FFFFF" TargetImage="*\\verclsid.exe" (CallTrace="*|UNKNOWN(*" CallTrace="*VBE7.DLL*") OR (CallTrace="*|UNKNOWN*" SourceImage="*\\Microsoft Office\\*")

Splunk/rules-emerging-threats/2017/Malware/NotPetya/proc_creation_win_malware_notpetya.spl

@@ -3,8 +3,8 @@
 # Date: 2019-01-16
 # Level: critical
 # Description: Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil
-# MITRE Tactic: Defense Evasion
-# Tags: attack.defense-evasion, attack.t1218.011, attack.t1070.001, attack.credential-access, attack.t1003.001, car.2016-04-002, detection.emerging-threats
+# MITRE Tactic: Credential Access
+# Tags: attack.stealth, attack.defense-impairment, attack.t1218.011, attack.t1685.005, attack.credential-access, attack.t1003.001, car.2016-04-002, detection.emerging-threats
 # Reference: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/NotPetya/proc_creation_win_malware_notpetya.yml
 
 "\\perfc.dat" OR (CommandLine IN ("*.dat,#1", "*.dat #1", "*.zip.dll\",#1") Image="*\\rundll32.exe") OR CommandLine IN ("*wevtutil cl Application & fsutil usn deletejournal /D C:*", "*dllhost.dat %WINDIR%\\ransoms*")

Splunk/rules-emerging-threats/2017/Malware/PlugX/proc_creation_win_malware_plugx_susp_exe_locations.spl

@@ -4,7 +4,7 @@
 # Level: high
 # Description: Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location
 # MITRE Tactic: Privilege Escalation
-# Tags: attack.privilege-escalation, attack.persistence, attack.s0013, attack.defense-evasion, attack.t1574.001, detection.emerging-threats
+# Tags: attack.privilege-escalation, attack.persistence, attack.execution, attack.stealth, attack.s0013, attack.t1574.001, detection.emerging-threats
 # Reference: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/PlugX/proc_creation_win_malware_plugx_susp_exe_locations.yml
 
 (Image="*\\CamMute.exe" NOT (Image IN ("*\\Lenovo\\Communication Utility\\*", "*\\Lenovo\\Communications Utility\\*"))) OR (Image="*\\chrome_frame_helper.exe" NOT Image="*\\Google\\Chrome\\application\\*") OR (Image="*\\dvcemumanager.exe" NOT Image="*\\Microsoft Device Emulator\\*") OR (Image="*\\Gadget.exe" NOT Image="*\\Windows Media Player\\*") OR (Image="*\\hcc.exe" NOT Image="*\\HTML Help Workshop\\*") OR (Image="*\\hkcmd.exe" NOT (Image IN ("*\\System32\\*", "*\\SysNative\\*", "*\\SysWow64\\*"))) OR (Image="*\\Mc.exe" NOT (Image IN ("*\\Microsoft Visual Studio*", "*\\Microsoft SDK*", "*\\Windows Kit*"))) OR (Image="*\\MsMpEng.exe" NOT (Image IN ("*\\Microsoft Security Client\\*", "*\\Windows Defender\\*", "*\\AntiMalware\\*"))) OR (Image="*\\msseces.exe" NOT (Image IN ("*\\Microsoft Security Center\\*", "*\\Microsoft Security Client\\*", "*\\Microsoft Security Essentials\\*"))) OR (Image="*\\OInfoP11.exe" NOT Image="*\\Common Files\\Microsoft Shared\\*") OR (Image="*\\OleView.exe" NOT (Image IN ("*\\Microsoft Visual Studio*", "*\\Microsoft SDK*", "*\\Windows Kit*", "*\\Windows Resource Kit\\*"))) OR (Image="*\\rc.exe" NOT (Image IN ("*\\Microsoft Visual Studio*", "*\\Microsoft SDK*", "*\\Windows Kit*", "*\\Windows Resource Kit\\*", "*\\Microsoft.NET\\*")))

Splunk/rules-emerging-threats/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.spl

@@ -4,7 +4,7 @@
 # Level: critical
 # Description: Detects WannaCry ransomware activity
 # MITRE Tactic: Lateral Movement
-# Tags: attack.lateral-movement, attack.t1210, attack.discovery, attack.t1083, attack.defense-evasion, attack.t1222.001, attack.impact, attack.t1486, attack.t1490, detection.emerging-threats
+# Tags: attack.lateral-movement, attack.defense-impairment, attack.t1210, attack.discovery, attack.t1083, attack.t1222.001, attack.impact, attack.t1486, attack.t1490, detection.emerging-threats
 # Reference: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.yml
 
 CommandLine="*@Please_Read_Me@.txt*" OR Image IN ("*\\tasksche.exe", "*\\mssecsvc.exe", "*\\taskdl.exe", "*\\taskhsvc.exe", "*\\taskse.exe", "*\\111.exe", "*\\lhdfrgui.exe", "*\\linuxnew.exe", "*\\wannacry.exe") OR Image="*WanaDecryptor*"

Splunk/rules-emerging-threats/2017/TA/Dragonfly/proc_creation_win_apt_ta17_293a_ps.spl

@@ -3,8 +3,8 @@
 # Date: 2017-10-22
 # Level: high
 # Description: Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report
-# MITRE Tactic: Defense Evasion
-# Tags: attack.defense-evasion, attack.g0035, attack.t1036.003, car.2013-05-009, detection.emerging-threats
+# MITRE Tactic: Uncategorized
+# Tags: attack.stealth, attack.g0035, attack.t1036.003, car.2013-05-009, detection.emerging-threats
 # Reference: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/TA/Dragonfly/proc_creation_win_apt_ta17_293a_ps.yml
 # False Positives:
 #   - Renamed SysInternals tool

Splunk/rules-emerging-threats/2017/TA/Lazarus/proc_creation_win_apt_lazarus_binary_masquerading.spl

@@ -3,8 +3,8 @@
 # Date: 2020-06-03
 # Level: high
 # Description: Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location
-# MITRE Tactic: Defense Evasion
-# Tags: attack.defense-evasion, attack.t1036.005, detection.emerging-threats
+# MITRE Tactic: Uncategorized
+# Tags: attack.stealth, attack.t1036.005, detection.emerging-threats
 # Reference: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/TA/Lazarus/proc_creation_win_apt_lazarus_binary_masquerading.yml
 # False Positives:
 #   - Unlikely