Attributed metadata history

Release r2025-02-03

New Rules new: Azure Login Bypassing Conditional Access Policies new: CVE-2024-49113 Exploitation Attempt - LDAP Nightmare new: Suspicious Binaries and Scripts in Public Folder new: Suspicious Invocation of Shell via Rsync new: Windows Event Log Access Tampering Via Registry Updated Rules update: Exploit Framework User Agent - Add default Havoc C2 UA update: Renamed Powershell Under Powershell Channel - Update regex to use \s+ to account for different parsers update: Shell Execution via Rsync - Linux - Rework logic to make it more generic and include additional shells. update: Suspicious Non PowerShell WSMAN COM Provider - Update regex to use \s+ to account for different parsers update: Suspicious Windows Service Tampering - Add additional services Removed / Deprecated Rules remove: Windows Defender Exclusion Deleted Fixed Rules fix: BITS Transfer Job With Uncommon Or Suspicious Remote TLD - Add dn.onenote.net/ and cdn.office.net/ fix: CodeIntegrity - Unmet Signing Level Requirements By File Under Validation - Add filter for Kaspersky and mDNS Responder fix: Failed Code Integrity Checks - Add filters for CrowdStrike. fix: Forest Blizzard APT - Process Creation Activity - prepend SHA256 to hash value fix: HackTool - Dumpert Process Dumper Execution - prepend MD5 to hash value fix: ManageEngine Endpoint Central Dctask64.EXE Potential Abuse - prepend IMPHASH to hash value fix: Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation - Add filter for \Windows\SoftwareDistribution\Download\ fix: Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load - Add exclusion filter C:\ProgramData\Package Cache\{ to account for cases like the execution of vcredist fix: Privileged User Has Been Created - Add missing comma to avoid false positives fix: Relevant Anti-Virus Signature Keywords In Application Log - Enhances the HTool string to avoid unintended matches. fix: Renamed Powershell Under Powershell Channel - Add edge case filters for double backslashes PowerShell invocation. fix: Renamed ZOHO Dctask64 Execution - prepend IMPASH to hash value fix: Uncommon AppX Package Locations - Add https://installer.teams.static.microsoft/ fix: WCE wceaux.dll Access - Remove EventIDs 4658 and 4660 as they both do not contain the ObjectName field Acknowledgement Thanks to @DanielKoifman, @defensivedepth, @djlukic, @frack113, @GtUGtHGtNDtEUaE, @joshnck, @krdmnbrk, @nasbench, @Neo23x0, @samuelmonsempessenthorus, @Ti-R, @tsale, @X-Junior for their contribution to this release Which Sigma rule package should I use? A detailed explanation can be found in the Releases.md file. If you are new to Sigma, we recommend starting with the "Core" ruleset. The latest release package on GitHub can always be found here.

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.