Updated converted sigma rules for version version/7.1

vastlimits · vastlimits · commit 60d919d1c200 · 2025-04-17T00:23:30.000Z
diff --git a/config/uberAgent-ESA-am-sigma-high-windows.conf b/config/uberAgent-ESA-am-sigma-high-windows.conf
@@ -4838,6 +4838,23 @@ RiskScore = 75
 Query = (Process.Path like r"%\\curl.exe" or Process.Name == "curl.exe") and regex_match(Process.CommandLine, "://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}") and Process.CommandLine like r"%http%" and (Process.CommandLine like r"% -O%" or Process.CommandLine like r"%--remote-name%" or Process.CommandLine like r"%--output%") and (Process.CommandLine like r"%.bat" or Process.CommandLine like r"%.bat\"" or Process.CommandLine like r"%.dat" or Process.CommandLine like r"%.dat\"" or Process.CommandLine like r"%.dll" or Process.CommandLine like r"%.dll\"" or Process.CommandLine like r"%.exe" or Process.CommandLine like r"%.exe\"" or Process.CommandLine like r"%.gif" or Process.CommandLine like r"%.gif\"" or Process.CommandLine like r"%.hta" or Process.CommandLine like r"%.hta\"" or Process.CommandLine like r"%.jpeg" or Process.CommandLine like r"%.jpeg\"" or Process.CommandLine like r"%.log" or Process.CommandLine like r"%.log\"" or Process.CommandLine like r"%.msi" or Process.CommandLine like r"%.msi\"" or Process.CommandLine like r"%.png" or Process.CommandLine like r"%.png\"" or Process.CommandLine like r"%.ps1" or Process.CommandLine like r"%.ps1\"" or Process.CommandLine like r"%.psm1" or Process.CommandLine like r"%.psm1\"" or Process.CommandLine like r"%.vbe" or Process.CommandLine like r"%.vbe\"" or Process.CommandLine like r"%.vbs" or Process.CommandLine like r"%.vbs\"" or Process.CommandLine like r"%.bat'" or Process.CommandLine like r"%.dat'" or Process.CommandLine like r"%.dll'" or Process.CommandLine like r"%.exe'" or Process.CommandLine like r"%.gif'" or Process.CommandLine like r"%.hta'" or Process.CommandLine like r"%.jpeg'" or Process.CommandLine like r"%.log'" or Process.CommandLine like r"%.msi'" or Process.CommandLine like r"%.png'" or Process.CommandLine like r"%.ps1'" or Process.CommandLine like r"%.psm1'" or Process.CommandLine like r"%.vbe'" or Process.CommandLine like r"%.vbs'")
 
 
+[ActivityMonitoringRule platform=Windows]
+# Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D).
+# Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary.
+# The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks.
+# This rule flags suspicious use of such padding observed in real-world attacks.
+# Author: Swachchhanda Shrawan Poudel (Nextron Systems)
+RuleId = dd8756e7-a3a0-4768-b47e-8f545d1a751c
+RuleName = Suspicious LNK Command-Line Padding with Whitespace Characters
+EventType = Process.Start
+Tag = proc-start-suspicious-lnk-command-line-padding-with-whitespace-characters
+RiskScore = 75
+Annotation = {"mitre_attack": ["T1204.002"]}
+Query = (Parent.Path like r"%\\explorer.exe" or Parent.CommandLine like r"%.lnk%") and (Process.CommandLine like r"%                 %" or Process.CommandLine like r"%\\u0009%" or Process.CommandLine like r"%\\u000A%" or Process.CommandLine like r"%\\u0011%" or Process.CommandLine like r"%\\u0012%" or Process.CommandLine like r"%\\u0013%" or Process.CommandLine like r"%\\u000B%" or Process.CommandLine like r"%\\u000C%" or Process.CommandLine like r"%\\u000D%" or regex_match(Process.CommandLine, "\\n\\n\\n\\n\\n\\n"))
+GenericProperty1 = Parent.Path
+GenericProperty2 = Parent.CommandLine
+
+
 [ActivityMonitoringRule platform=Windows]
 # Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs.
 # Author: Florian Roth (Nextron Systems)
@@ -4916,14 +4933,14 @@ Query = Process.CommandLine like r"%Add-Exfiltration%" or Process.CommandLine li
 [ActivityMonitoringRule platform=Windows]
 # Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic".
 # This technique were seen used by threat actors and ransomware strains in order to evade defenses.
-# Author: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105
+# Author: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)
 RuleId = cc36992a-4671-4f21-a91d-6c2b72a2edf5
 RuleName = Suspicious Eventlog Clearing or Configuration Change Activity
 EventType = Process.Start
 Tag = proc-start-suspicious-eventlog-clearing-or-configuration-change-activity
 RiskScore = 75
 Annotation = {"mitre_attack": ["T1070.001", "T1562.002"]}
-Query = (Process.Path like r"%\\wevtutil.exe" and (Process.CommandLine like r"%clear-log %" or Process.CommandLine like r"% cl %" or Process.CommandLine like r"%set-log %" or Process.CommandLine like r"% sl %" or Process.CommandLine like r"%lfn:%") or (Process.Path like r"%\\powershell.exe" or Process.Path like r"%\\pwsh.exe") and (Process.CommandLine like r"%Clear-EventLog %" or Process.CommandLine like r"%Remove-EventLog %" or Process.CommandLine like r"%Limit-EventLog %" or Process.CommandLine like r"%Clear-WinEvent %") or (Process.Path like r"%\\powershell.exe" or Process.Path like r"%\\pwsh.exe" or Process.Path like r"%\\wmic.exe") and Process.CommandLine like r"%ClearEventLog%") and not ((Parent.Path in ["C:\\Windows\\SysWOW64\\msiexec.exe", "C:\\Windows\\System32\\msiexec.exe"]) and Process.CommandLine like r"% sl %")
+Query = (Process.Path like r"%\\wevtutil.exe" or Process.Name == "wevtutil.exe") and (Process.CommandLine like r"%clear-log %" or Process.CommandLine like r"% cl %" or Process.CommandLine like r"%set-log %" or Process.CommandLine like r"% sl %" or Process.CommandLine like r"%lfn:%") or (Process.Path like r"%\\powershell.exe" or Process.Path like r"%\\powershell\_ise.exe" or Process.Path like r"%\\pwsh.exe") and (Process.CommandLine like r"%Clear-EventLog %" or Process.CommandLine like r"%Remove-EventLog %" or Process.CommandLine like r"%Limit-EventLog %" or Process.CommandLine like r"%Clear-WinEvent %" or Process.CommandLine like r"%Eventing.Reader.EventLogSession%" and Process.CommandLine like r"%ClearLog%" or Process.CommandLine like r"%Diagnostics.EventLog%" and Process.CommandLine like r"%Clear%") or (Process.Path like r"%\\powershell.exe" or Process.Path like r"%\\powershell\_ise.exe" or Process.Path like r"%\\pwsh.exe" or Process.Path like r"%\\wmic.exe") and Process.CommandLine like r"%ClearEventLog%" and not ((Parent.Path in ["C:\\Windows\\SysWOW64\\msiexec.exe", "C:\\Windows\\System32\\msiexec.exe"]) and Process.CommandLine like r"% sl %")
 GenericProperty1 = Parent.Path
 
 
