Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix FP Found In Testing #4560

Merged
merged 6 commits into from
Nov 10, 2023
Merged

Fix FP Found In Testing #4560

merged 6 commits into from
Nov 10, 2023

Conversation

nasbench
Copy link
Member

@nasbench nasbench commented Nov 9, 2023

Summary of the Pull Request

This PR tune multiple rules for FPs found in testing

Changelog

fix: Bad Opsec Defaults Sacrificial Processes With Improper Arguments - Enhance filter to account for an FP found with MS edge
fix: Files With System Process Name In Unsuspected Locations - Enhance filter to cover other folder variation for windows recovery
fix: Portable Gpg.EXE Execution - Add new legitimate location for GNuGpg
fix: Suspicious WmiPrvSE Child Process - Add a filter for msiexec image used to install new MSI packages via WMI process
update: ISO Image Mounted - Update title and add new filter
update: Potential NT API Stub Patching - Enhance the selection coverage by removing the "C:" prefix to cover other installation possibilities
update: Remote Thread Creation Via PowerShell - Update selection to use endswith modifier for better coverage
update: Remote Thread Creation Via PowerShell In Potentially Suspicious Target - Update title and add a "regsvr32" as a new additional process to increase coverage
update: Suspicious Whoami.EXE Execution - Enhance the selection by using a * wildcard to account for the order and avoid FPs
update: WMI Module Loaded By Non Uncommon Process - Enhance selection by making the System folders filter use a "contains" instead of an exact match

Example Log Event

N/A

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

  • If your PR adds new rules, please consider following and applying these conventions

@github-actions github-actions bot added Rules Windows Pull request add/update windows related rules labels Nov 9, 2023
@nasbench nasbench added the Work In Progress Some changes are needed label Nov 9, 2023
@nasbench nasbench removed the Work In Progress Some changes are needed label Nov 10, 2023
@nasbench nasbench marked this pull request as ready for review November 10, 2023 15:56
@nasbench nasbench added the 2nd Review Needed PR need a second approval label Nov 10, 2023
@nasbench nasbench requested a review from phantinuss November 10, 2023 15:56
@nasbench nasbench removed the 2nd Review Needed PR need a second approval label Nov 10, 2023
@nasbench nasbench merged commit 309c2de into SigmaHQ:master Nov 10, 2023
11 checks passed
@nasbench nasbench deleted the fix-fp-testing branch March 11, 2024 21:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Rules Windows Pull request add/update windows related rules
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants