# Guia de regras de correlação Este repositório contém um conjunto abrangente de regras, designado para reforçar a segurança de sua organização através da detecção de vários tipos de atividades suspeitas e possíveis ameaças. Cada regra é categorizada para facilitar uma navegação e uma abordagem estruturada à detecção de ameaças. Ao utilizar as regras deste pacote, você pode melhorar significativamente sua habilidade de detectar e responder a incidentes de segurança, garantindo defesas mais robustas contra uma ampla faixa de ameaças cibernéticas. ## Attacker tool Estas regras detectam a presença e o uso de ferramentas de ataque conhecidas. - [WinPeas Detection](https://www.manageengine.com/log-management/correlation-rules/winpeas-tool.html) - [MimiKatz Detection](https://www.manageengine.com/log-management/correlation-rules/mimikatz-tool.html) - [SharpShares Detection](https://www.manageengine.com/log-management/correlation-rules/sharpshares-tool.html) - [BadPotato Detection](https://www.manageengine.com/log-management/correlation-rules/badpotato-tool.html) - [Bloodhound Detection](https://www.manageengine.com/log-management/correlation-rules/bloodhound-tool.html) - [SharpView Detection](https://www.manageengine.com/log-management/correlation-rules/sharpview-tool.html) - [SafetyKatz Detection](https://www.manageengine.com/log-management/correlation-rules/safetykatz-tool.html) - [SharPersist Detection](https://www.manageengine.com/log-management/correlation-rules/sharpersist-tool.html) - [SharpZeroLogon Detection](https://www.manageengine.com/log-management/correlation-rules/sharpzerologon-tool.html) - [SharpDump Detection](https://www.manageengine.com/log-management/correlation-rules/sharpdump-tool.html) - [SafetyDump Detection](https://www.manageengine.com/log-management/correlation-rules/safetydump-tool.html) - [VulnRecon Detection](https://www.manageengine.com/log-management/correlation-rules/vulnrecon-tool.html) - [PrintSpoofer Detection](https://www.manageengine.com/log-management/correlation-rules/printspoofer-tool.html) - [SharpHound Detection](https://www.manageengine.com/log-management/correlation-rules/sharphound-tool.html) - [SharpUp Detection](https://www.manageengine.com/log-management/correlation-rules/sharpup-tool.html) - [SprayKatz Detection](https://www.manageengine.com/log-management/correlation-rules/spraykatz-tool.html) - [Metasploit Detection](https://www.manageengine.com/log-management/correlation-rules/detecting-metasploit.html) - [Hashcat Detection](https://www.manageengine.com/log-management/correlation-rules/detecting-hashcat.html) - [Petitpotam Detection](https://www.manageengine.com/log-management/correlation-rules/detecting-petitpotam.html) - [Rubeus Detection](https://www.manageengine.com/log-management/correlation-rules/detecting-rubeus.html) - [Crackmapexec Detection](https://www.manageengine.com/log-management/correlation-rules/detecting-crackmapexec.html) - [SweetPotato Detection](https://www.manageengine.com/log-management/correlation-rules/detecting-sweetpotato.html) - [John The Ripper](https://www.manageengine.com/log-management/correlation-rules/detecting-john-the-ripper.html) - [Kerbrute Detection](https://www.manageengine.com/log-management/correlation-rules/detecting-kerbrute.html) - [Hydra Detection](https://www.manageengine.com/log-management/correlation-rules/detecting-hydra.html) ## Processo suspeito Estas regras identificam processos suspeitos que talvez indiquem atividade maliciosa. - [Spoolsv Spawning Rundll32](https://www.manageengine.com/log-management/correlation-rules/spoolsv-spawning-rundll32.html) - [Tentativa excessiva de desabilitar serviços](https://www.manageengine.com/log-management/correlation-rules/excessive-attempts-disable-services.html) - [Uso excessivo de Taskkill](https://www.manageengine.com/log-management/correlation-rules/excessive-usage-taskkill.html) - [Pacote Office está gerando MSHTA](https://www.manageengine.com/log-management/correlation-rules/office-product-spawning-mshta.html) - [Windows está mascarando o Explorer como processo filho](https://www.manageengine.com/log-management/correlation-rules/windows-masquerading-explorer-child-process.html) - [Geração do processo de execução do Wsmprovhost LOLBAS](https://www.manageengine.com/log-management/correlation-rules/wsmprovhost-lolbas-execution.html) - [Comando Ryuk Wake on LAN](https://www.manageengine.com/log-management/correlation-rules/ryuk-wake-on-lan-command.html) - [Adicionar ou definir exclusão do Windows Defender](https://www.manageengine.com/log-management/correlation-rules/add-set-windows-defender-exclusion.html) - [Desabilitar o monitoramento de segurança](https://www.manageengine.com/log-management/correlation-rules/powershell-disable-security-monitoring.html) ## Processo parental suspeito Estas regras detectam processos entre pais e filhos suspeitos para identificar ataques em potencial. - [Suspicious parent spawning autochk](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-autochk.html) - [Suspicious parent spawning fontdrvhost](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-fontdrvhost.html) - [Suspicious parent spawning dwm](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-dwm.html) - [Suspicious parent spawning Consent](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-consent.html) - [Suspicious parent spawning tiworker](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-tiworker.html) - [Suspicious parent spawning runtimebroker](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-runtimebroker.html) - [Suspicious parent spawning searchindexer](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-searchindexer.html) - [Suspicious parent spawning searchprotocolhost](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-searchprotocolhost.html) - [Suspicious parent spawning dllhost](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-dllhost.html) - [Suspicious parent spawning smss](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-smss.html) - [Suspicious parent spawning csrss](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-csrss.html) - [Suspicious parent spawning wininit](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-wininit.html) - [Suspicious parent spawning winlogon](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-winlogon.html) - [Suspicious parent spawning lsass](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-lsass.html) - [Suspicious Parent Spawning lsaIso](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-lsaiso.html) - [Suspicious parent spawning LogonUI](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-logonui.html) - [Suspicious parent spawning services](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-services.html) - [Suspicious parent spawning svchost](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-svchost.html) - [Suspicious parent spawning spoolsv](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-spoolsv.html) - [Suspicious parent spawning taskhost](https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-taskhost.html) ## Processo filho suspeito Estas regras identificam processos filho suspeito gerado por processos parentais específicos para detectar possíveis malwares. - [SearchProtocolHost Spawning Suspicious Child](https://www.manageengine.com/log-management/correlation-rules/searchprotocolhost-spawning-suspicious-child.html) - [taskhost Spawning Suspicious Child](https://www.manageengine.com/log-management/correlation-rules/taskhost-spawning-suspicious-child.html) - [csrss Spawning Suspicious Child](https://www.manageengine.com/log-management/correlation-rules/csrss-spawning-suspicious-child.html) - [autochk Spawning Suspicious Child](https://www.manageengine.com/log-management/correlation-rules/csrss-spawning-suspicious-child.html) - [smss Spawning Suspicious Child](https://www.manageengine.com/log-management/correlation-rules/smss-spawning-suspicious-child.html) - [wermgr Spawning Suspicious Child](https://www.manageengine.com/log-management/correlation-rules/wermgr-spawning-suspicious-child.html) - [conhost spawning suspicious Child](https://www.manageengine.com/log-management/correlation-rules/conhost-spawning-suspicious-host.html) - [Excel Spawning Windows Script Host](https://www.manageengine.com/log-management/correlation-rules/excel-spawning-windows-script-host.html) - [Office Product Spawning Windows Script Host](https://www.manageengine.com/log-management/correlation-rules/office-product-spawning-windows-script-host.html) ## Detecção “Living-Off-The-Land” Estas regras detectam uso incomum de ferramentas de sistema como PowerShell e WMI para identificar ataques ocultos. - [Modificação do grupo local de contas privilegiadas](https://www.manageengine.com/log-management/correlation-rules/local-privileged-account-group-modification.html) - [Roubo de credenciais por meio do Procdump ou do comsvcs](https://www.manageengine.com/log-management/correlation-rules/credential-theft-using-procdump-comsvcs.html) - [Linha de comando do PowerShell com codificação suspeita](https://www.manageengine.com/log-management/correlation-rules/suspicious-encoded-powershell-command-line.html) - [Execução suspeita de CertOC](https://www.manageengine.com/log-management/correlation-rules/suspicious-execution-of-certoc.html) - [Criação de arquivo suspeito com Colorcpl](https://www.manageengine.com/log-management/correlation-rules/suspicious-file-creation-colorcpl.html) - [Execução suspeita de ConfigSecurityPolicy](https://www.manageengine.com/log-management/correlation-rules/suspicious-execution-configsecuritypolicy.html) - [Comando Certreq suspeito para fazer download ou upload](https://www.manageengine.com/log-management/correlation-rules/suspicious-certreq-command-download-upload.html) - [Serviço de cópia de sombra de volume excluído usando VSSADMIN ou wmic](https://www.manageengine.com/log-management/correlation-rules/volume-shadow-copy-deleted-vssadmin-wmic.html) - [Ignorar o UAC via CMSTP](https://www.manageengine.com/log-management/correlation-rules/bypass-uac-via-cmstp.html) - [Ignorar os controles de segurança.](https://www.manageengine.com/log-management/correlation-rules/bypassing-security-controls.html) - [Comando Certutil suspeito](https://www.manageengine.com/log-management/correlation-rules/suspicious-certutil-command-execution.html)