Detecting Lateral Movement through Tracking Event Logs about sigma HOT 1 CLOSED

Hi! Thanks for the pointer! I picked up the nice work from JPCERT few weeks ago and created some Sigma rules from it, at least:

• windows/builtin/win_mal_wceaux_dll.yml
• windows/builtin/win_susp_sdelete.yml
• windows/other/win_tool_psexec.yml

resulted from this work. Others, like windows/sysmon/sysmon_password_dumper_lsass.yml were already contained in the rule set from our own research.

Unfortunately, most tools cause only very generic log entries. Searching for them in a Windows environment would result in huge noise, so I didn't created rules for these. I still have a list of chapters from the JPCERT document where I have to check, if the indicators are specific enough to create Sigma rules from it.

from sigma.