Vendor-native detections for T1100

rule atlassian_confluence_download_attachments_remote_code_executiondirectory_traversal {
 meta:
    author = "Halil Ibrahim Cosgun"
    description = "Detects Atlassian Confluence RCE via Attachment Download. Sample regex added to detect directory traversal, it can be improved.  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/pCBpTAya0HBi"
    version = "0.01"
    created = "2021-03-09"
    product = "proxy"
    mitre = "initial_access, persistence, privilege_escalation, T1190, T1100"

  events:
($selection.network.http.method = "POST" and re.regex($selection.target.url, `/plugins/drag-and-drop/upload\.action\?pageId.*&filename=^\(\?!\..*\\/\.\\/\.\)\.{0,200}$.*&size=.*&mimeType=.*atl_token=.*&name=^\(\?!\..*\\/\.\\/\.\)\.{0,200}$.*`))

  condition:
    $selection
}

rule turla_backdoor_sysmon {
 meta:
    author = "Dmitriy Dyakon, SOC Prime"
    description = "Turla Backdoor Detector.  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/vYABlVudO8eM"
    version = "0.01"
    created = "2018/01/02"
    product = "windows"
    service = "sysmon"
    mitre = "T1064, T1100, Command and Control"

  events:
($selection_hashes.metadata.product_event_type = "1" and ($selection_hashes.target.file.md5 = "fd898c5a4cd57c3e9cef41f6fd4f71a7" or $selection_hashes.target.file.md5 = "9dab3dd7b7e7f4980397da908fbc9ff7" or $selection_hashes.target.file.md5 = "3eb5f44492ce1147790450d950954a52"))

  condition:
    $selection_hashes
}