Sigma Rules to detect HopToDesk RMM (#12)

* Add files via upload

* Update hoptodesk_network_sigma.yml

detections/sigma/hoptodesk_network_sigma.yml

@@ -0,0 +1,22 @@
+title: Potential HopToDesk RMM Tool Network Activity
+logsource:
+  product: windows
+  category: network_connection
+detection:
+  selection:
+    DestinationHostname|endswith:
+    - signal.hoptodesk.com
+    - api.hoptodesk.com
+    - turn.hoptodesk.com
+    - hoptodesk.com
+  condition: selection
+status: experimental
+description: Detects potential network activity of HopToDesk RMM tool
+author: LOLRMM Project
+date: 2024/09/19
+tags:
+- attack.execution
+- attack.t1219
+falsepositives:
+- Legitimate use of HopToDesk
+level: medium

detections/sigma/hoptodesk_processes_sigma.yml

@@ -0,0 +1,20 @@
+title: Potential HopToDesk RMM Tool Process Activity
+logsource:
+  product: windows
+  category: process_creation
+detection:
+  selection:
+    ParentImage|endswith:
+    - hoptodesk.exe
+    - HopToDesk.exe
+  condition: selection
+status: experimental
+description: Detects potential processes activity of HopToDesk RMM tool
+author: LOLRMM Project
+date: 2024/09/19
+tags:
+- attack.execution
+- attack.t1219
+falsepositives:
+- Legitimate use of HopToDesk
+level: medium