You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: CVE-2023-22518 Exploit Chain
description: Access to endpoint vulnerable to CVE-2023-22518 with suspicious process creation.
status: experimental
correlation:
type: temporal
rules:
- a902d249-9b9c-4dc4-8fd0-fbe528ef965c
- 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
group-by:
- Computer
timespan: 10s
level: high
(Note: when testing you can use any two rules that find two different events within a short period of time.)
I think this is similar to the count rules we already have but instead of treating multiple rules as OR, we treat them as AND. And then we ignore the part about aggregating fields, so should actually be easier to implement. 😄 (Well, except for filtering to check if they have certain same fields, defined by group-by)
@fukusuket I think this one will be very easy for you, so I will assign you. 😉
The text was updated successfully, but these errors were encountered:
Support Temporal Proximity correlation
https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-correlation-rules-specification.md#temporal-proximity-temporal
Reference: https://blog.sigmahq.io/introducing-sigma-correlations-52fe377f2527
Sample rule from blog:
(Note: when testing you can use any two rules that find two different events within a short period of time.)
I think this is similar to the
count
rules we already have but instead of treating multiple rules as OR, we treat them as AND. And then we ignore the part about aggregating fields, so should actually be easier to implement. 😄 (Well, except for filtering to check if they have certain same fields, defined bygroup-by
)@fukusuket I think this one will be very easy for you, so I will assign you. 😉
The text was updated successfully, but these errors were encountered: