Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

updated adfind related rules #5203

Open
wants to merge 11 commits into
base: master
Choose a base branch
from
Open

updated adfind related rules #5203

wants to merge 11 commits into from

Conversation

swachchhanda000
Copy link
Contributor

@swachchhanda000 swachchhanda000 commented Feb 23, 2025 •
edited
Loading

Summary of the Pull Request

Added new adfind execution rule

Changelog

new: PUA - AdFind.EXE Execution
update: Renamed AdFind Execution - New entries of IMPHASH added to increase coverage

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

  • If your PR adds new rules, please consider following and applying these conventions

@github-actions github-actions bot added Rules Windows Pull request add/update windows related rules labels Feb 23, 2025
@nasbench nasbench added the Author Input Required changes the require information from original author of the rules label Feb 24, 2025
nasbench
nasbench previously approved these changes Feb 25, 2025
View reviewed changes
@nasbench nasbench added 2nd Review Needed PR need a second approval and removed Author Input Required changes the require information from original author of the rules labels Feb 25, 2025
@nasbench nasbench requested a review from frack113 February 25, 2025 21:39
@frack113
Copy link
Member

Hi,
The purpose of the rule is to detect ActiveDirectory Enumeration., and with the update even start adfind will generate a high alert.
I think it is better to put your detection in a new MEDIUM rule.
The selection names are better , you can keep them in the PR.

@frack113 frack113 added Ready to Merge and removed 2nd Review Needed PR need a second approval labels Feb 26, 2025
@nasbench nasbench self-requested a review February 26, 2025 12:02
@nasbench nasbench dismissed their stale review February 26, 2025 12:03

Changes have been made

@nasbench nasbench added 2nd Review Needed PR need a second approval and removed Ready to Merge labels Feb 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@frack113 frack113 frack113 approved these changes

@nasbench nasbench Awaiting requested review from nasbench

Assignees
No one assigned
Labels
2nd Review Needed PR need a second approval Rules Windows Pull request add/update windows related rules
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@swachchhanda000 @frack113 @nasbench