Skip to content

Fixed fps and added coverage for ARM based windows dotnet paths #5208

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 7 commits into
base: master
Choose a base branch
from

Conversation

swachchhanda000
Copy link
Contributor

@swachchhanda000 swachchhanda000 commented Feb 24, 2025

Summary of the Pull Request

Fixed fps and added coverage for ARM based windows dotnet paths

Changelog

fix: Potential System DLL Sideloading From Non System Locations : shell32.dll, windows.storage.dll were causing fp from C:\Windows\SyChpe32 directory thus added to filters
fix: Potential DLL Sideloading Of MsCorSvc.DLL: fp for \Windows\Microsoft.NET\FrameworkArm64\ path resolved by adding it in the filter

ARM Based windows dotnet paths updated in these rules below:

update: Creation of an Executable by an Executable: ARM Based windows dotnet paths updated
update: Amsi.DLL Load By Uncommon Process: ARM Based windows dotnet paths updated
update: WMI Module Loaded By Uncommon Process: ARM Based windows dotnet paths updated
update: PowerShell Core DLL Loaded By Non PowerShell Process: ARM Based windows dotnet paths updated
update: Suspicious WSMAN Provider Image Loads: ARM Based windows dotnet paths updated
update: AddinUtil.EXE Execution From Uncommon Directory: ARM Based windows dotnet paths updated
update: AspNetCompiler Execution: ARM Based windows dotnet paths updated
update: Potentially Suspicious ASP.NET Compilation Via AspNetCompiler: ARM Based windows dotnet paths updated

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

  • If your PR adds new rules, please consider following and applying these conventions

@github-actions github-actions bot added Rules Windows Pull request add/update windows related rules labels Feb 24, 2025
@nasbench nasbench added the Author Input Required changes the require information from original author of the rules label Feb 24, 2025
@nasbench nasbench added Work In Progress Some changes are needed and removed Author Input Required changes the require information from original author of the rules labels Feb 28, 2025
@nasbench nasbench added this to the Sigma-March-Release milestone Mar 21, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Rules Windows Pull request add/update windows related rules Work In Progress Some changes are needed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants