diff --git a/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Active Device Manufactured by Company Banned for US Government Use.yaml b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Active Device Manufactured by Company Banned for US Government Use.yaml new file mode 100644 index 0000000..7b124ee --- /dev/null +++ b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Active Device Manufactured by Company Banned for US Government Use.yaml @@ -0,0 +1,13 @@ +title: Active Device Manufactured by Company Banned for US Government Use +description: Asimily detection for active devices manufactured by companies banned for US government use. Detects when such a device is identified by Asimily's threat intelligence. +references: [] +logsource: + category: THIRD_PARTY_LOG + product: Asimily + definition: THIRDPARTY_THIRDPARTY +detection: + string_condition_0: + eventName: "*Active Device Manufactured by Company Banned for US Government Use*" + condition: string_condition_0 +level: info +taxonomy: tm-v1 \ No newline at end of file diff --git a/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Browsing Blacklist Domain.yaml b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Browsing Blacklist Domain.yaml new file mode 100644 index 0000000..881c0ec --- /dev/null +++ b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Browsing Blacklist Domain.yaml @@ -0,0 +1,13 @@ +title: Browsing Blacklist Domain +description: Asimily detection for browsing blacklist domains. Detects when a device attempts to access a domain that has been flagged as malicious by Asimily's threat intelligence. +references: [] +logsource: + category: THIRD_PARTY_LOG + product: Asimily + definition: THIRDPARTY_THIRDPARTY +detection: + string_condition_0: + eventName: "*Browsing Blacklist Domain*" + condition: string_condition_0 +level: info +taxonomy: tm-v1 \ No newline at end of file diff --git a/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/DNS Connection to External IP.yaml b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/DNS Connection to External IP.yaml new file mode 100644 index 0000000..2688c7c --- /dev/null +++ b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/DNS Connection to External IP.yaml @@ -0,0 +1,13 @@ +title: DNS Connection to External IP +description: Asimily detection for DNS connections to external IP addresses. Detects when a DNS connection is made to an IP address that has been flagged as external by Asimily's threat intelligence. +references: [] +logsource: + category: THIRD_PARTY_LOG + product: Asimily + definition: THIRDPARTY_THIRDPARTY +detection: + string_condition_0: + ruleName: "*DNS Connection to External IP*" + condition: string_condition_0 +level: info +taxonomy: tm-v1 \ No newline at end of file diff --git a/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/DNS Lookup of Malicious Domain.yaml b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/DNS Lookup of Malicious Domain.yaml new file mode 100644 index 0000000..c839039 --- /dev/null +++ b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/DNS Lookup of Malicious Domain.yaml @@ -0,0 +1,13 @@ +title: DNS Lookup of Malicious Domain +description: Asimily detection for DNS lookups of malicious domains. Detects when a DNS lookup is made for a domain that has been flagged as malicious by Asimily's threat intelligence. +references: [] +logsource: + category: THIRD_PARTY_LOG + product: Asimily + definition: THIRDPARTY_THIRDPARTY +detection: + string_condition_0: + eventName: "*DNS Lookup of Malicious Domain*" + condition: string_condition_0 +level: info +taxonomy: tm-v1 \ No newline at end of file diff --git a/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/HTTP Connection to Malicious IP.yaml b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/HTTP Connection to Malicious IP.yaml new file mode 100644 index 0000000..42eabe5 --- /dev/null +++ b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/HTTP Connection to Malicious IP.yaml @@ -0,0 +1,13 @@ +title: HTTP Connection to Malicious IP +description: Asimily detection for HTTP connections to malicious IPs. Detects when an HTTP connection is made to an IP address that has been flagged as malicious by Asimily's threat intelligence. +references: [] +logsource: + category: THIRD_PARTY_LOG + product: Asimily + definition: THIRDPARTY_THIRDPARTY +detection: + string_condition_0: + eventName: "*HTTP Connection to Malicious IP*" + condition: string_condition_0 +level: info +taxonomy: tm-v1 \ No newline at end of file diff --git a/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/High-Volume External Data Transfer.yaml b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/High-Volume External Data Transfer.yaml new file mode 100644 index 0000000..f6f6bd3 --- /dev/null +++ b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/High-Volume External Data Transfer.yaml @@ -0,0 +1,13 @@ +title: High-Volume External Data Transfer +description: Asimily detection for high-volume external data transfers. Detects when a device transfers a large volume of data to an external IP address. +references: [] +logsource: + category: THIRD_PARTY_LOG + product: Asimily + definition: THIRDPARTY_THIRDPARTY +detection: + string_condition_0: + ruleName: "*High-Volume External Data Transfer*" + condition: string_condition_0 +level: info +taxonomy: tm-v1 \ No newline at end of file diff --git a/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Insecure Communication - Basic HTTP Authentication in Use.yaml b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Insecure Communication - Basic HTTP Authentication in Use.yaml new file mode 100644 index 0000000..4e9cb4a --- /dev/null +++ b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Insecure Communication - Basic HTTP Authentication in Use.yaml @@ -0,0 +1,14 @@ +title: Insecure Communication - Basic HTTP Authentication in Use +description: Asimily detection for devices using basic HTTP authentication. Detects when a device attempts to use basic HTTP authentication, which is considered insecure. +references: [] +logsource: + category: THIRD_PARTY_LOG + product: Asimily + definition: THIRDPARTY_THIRDPARTY +detection: + string_condition_0: + category: "*Insecure Communication*" + eventName: "*Basic HTTP Authentication in Use*" + condition: string_condition_0 +level: info +taxonomy: tm-v1 \ No newline at end of file diff --git a/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Insecure Communication - Expired SSL-TLS Certificate In Use.yaml b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Insecure Communication - Expired SSL-TLS Certificate In Use.yaml new file mode 100644 index 0000000..a5b732a --- /dev/null +++ b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Insecure Communication - Expired SSL-TLS Certificate In Use.yaml @@ -0,0 +1,14 @@ +title: Insecure Communication - Expired SSL-TLS Certificate In Use +description: Asimily detection for devices using expired SSL-TLS certificates. Detects when a device attempts to use an expired SSL-TLS certificate, which is considered insecure. +references: [] +logsource: + category: THIRD_PARTY_LOG + product: Asimily + definition: THIRDPARTY_THIRDPARTY +detection: + string_condition_0: + category: "*Insecure Communication*" + eventName: "*Expired SSL-TLS Certificate In Use*" + condition: string_condition_0 +level: info +taxonomy: tm-v1 \ No newline at end of file diff --git a/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/IoMT device Browsing Non-Whitelist Domains.yaml b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/IoMT device Browsing Non-Whitelist Domains.yaml new file mode 100644 index 0000000..0c5b3b5 --- /dev/null +++ b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/IoMT device Browsing Non-Whitelist Domains.yaml @@ -0,0 +1,13 @@ +title: IoMT device Browsing Non-Whitelist Domains +description: Asimily detection for IoMT devices browsing non-whitelisted domains. Detects when an IoMT device attempts to access a domain that is not on the approved list. +references: [] +logsource: + category: THIRD_PARTY_LOG + product: Asimily + definition: THIRDPARTY_THIRDPARTY +detection: + string_condition_0: + eventName: "*IoMT device Browsing Non-Whitelist Domains*" + condition: string_condition_0 +level: info +taxonomy: tm-v1 \ No newline at end of file diff --git a/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Possible Exploit Attempt Identified.yaml b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Possible Exploit Attempt Identified.yaml new file mode 100644 index 0000000..2cbf357 --- /dev/null +++ b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Possible Exploit Attempt Identified.yaml @@ -0,0 +1,13 @@ +title: Possible Exploit Attempt Identified +description: Asimily detection for possible exploit attempts. Detects when a potential exploit attempt is identified by Asimily's threat intelligence. +references: [] +logsource: + category: THIRD_PARTY_LOG + product: Asimily + definition: THIRDPARTY_THIRDPARTY +detection: + string_condition_0: + category: "*Exploit Attempt*" + condition: string_condition_0 +level: info +taxonomy: tm-v1 \ No newline at end of file diff --git a/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Possible Reconnaissance Attempt Identified.yaml b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Possible Reconnaissance Attempt Identified.yaml new file mode 100644 index 0000000..66e0e6b --- /dev/null +++ b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Possible Reconnaissance Attempt Identified.yaml @@ -0,0 +1,13 @@ +title: Possible Reconnaissance Attempt Identified +description: Asimily detection for possible reconnaissance attempts. Detects when a potential reconnaissance attempt is identified by Asimily's threat intelligence. +references: [] +logsource: + category: THIRD_PARTY_LOG + product: Asimily + definition: THIRDPARTY_THIRDPARTY +detection: + string_condition_0: + category: "*Reconnaissance Attempt*" + condition: string_condition_0 +level: info +taxonomy: tm-v1 \ No newline at end of file diff --git a/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Telnet Connection to or from External IP.yaml b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Telnet Connection to or from External IP.yaml new file mode 100644 index 0000000..6c8648b --- /dev/null +++ b/tm-v1-sigma-rules/third_party_logs/Asimily/IOT Security/Telnet Connection to or from External IP.yaml @@ -0,0 +1,13 @@ +title: Telnet Connection to or from External IP +description: Asimily detection for Telnet connections to or from external IP addresses. Detects when a Telnet connection is made to or from an IP address that has been flagged as external by Asimily's threat intelligence. +references: [] +logsource: + category: THIRD_PARTY_LOG + product: Asimily + definition: THIRDPARTY_THIRDPARTY +detection: + string_condition_0: + eventName: '*Telnet Connection to*from External IP*' + condition: string_condition_0 +level: info +taxonomy: tm-v1 \ No newline at end of file