New Rule for Suspicious Network Tunneling with QEMU

[threatHNTR]

Summary of the Pull Request

Added a new detection rule for identifying potentially suspicious network tunneling activities initiated through QEMU virtual machine instances on Windows systems.

Changelog

new: Suspicious Network Tunneling with QEMU

Example Log Event

From SecureList Blog:

Focused the detection around the socket connection.

-netdev socket,id=sock,connect=<IP>:443

From QEMU Documentation:

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @threatHNTR 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

[nasbench]

Since #4778 also touches on the same idea. I will merge both rules into one and handle it in that PR. Added your name as author to it as well. Thanks for the contribution.