Query: Sigma YAML for github / audit
Matching passage: Sigma rule: Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organ. Logsource: github / audit. Rule: title: Outdated Dependency Or Vulnerability Alert Disabled id: 34e1c7d4-0cd5-419d-9f1b-1dad3f61018d status: test description: 'Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories. ' author: Muhammad Faisal (@faisalusuf) date: 2023-01-27 references: - https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization tags: - attack.initial-access - attack.t1195.001 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - dependabot_alerts_new_repos.disable - dependabot_alerts.disable - dependabot_security_updates_new_repos.disable - dependabot_security_updates.disable - repository_vulnerability_alerts.disable condition: selection falsepositives: - Approved changes by the Organization owner. Please validate the 'actor' if authorized to make the changes. level: high
Near-miss passage: Sigma rule: Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be h. Logsource: windows / ps_script. Rule: title: Suspicious Service DACL Modification Via Set-Service Cmdlet - PS id: 22d80745-6f2c-46da-826b-77adaededd74 related: - id: a95b9b42-1308-4735-a1af-abb1c5e6f5ac type: similar status: test description: Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7) references: - https://twitter.com/Alh4zr3d/status/1580925761996828672 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-24 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_sddl_flag: ScriptBlockText|contains: - '-SecurityDescriptorSddl ' - '-sd ' selection_set_service: ScriptBlockText|contains|all: - 'Set-Service ' - D;; ScriptBlockText|contains: - ;;;IU - ;;;SU - ;;;BA - ;;;SY - ;;;WD condition: all of selection_* falsepositives: - Rare intended use of hidden services - Rare FP could occur due to the non linearity of the ScriptBlockText log level: high