SigmaHQ / sigma

Main Sigma Rule Repository
Other
8.37k stars 2.2k forks source link

Update dns_query_win_remote_access_software_domains_non_browsers.yml #4980

Closed Mahir-Ali-khan closed 2 months ago

Mahir-Ali-khan commented 2 months ago

Summary of the Pull Request

Added domain tailscale.com and twingate.com which was observed in below report and was abused by threat group Scattered Spider https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a https://blog.sekoia.io/scattered-spider-laying-new-eggs/ Added domain remoteassistance.support.services.microsoft.com this help us to monitor when quick assist application was used to create remote connection. https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist#disable-quick-assist-within-your-organization

Changelog

update: DNS Query To Remote Access Software Domain From Non-Browser App - Add remoteassistance.support.services.microsoft.com, tailscale.com, twingate.com

Example Log Event

N/A

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions