xkill image added

[CheraghiMilad]

Summary of the Pull Request

Changelog

xkill log

<Event>
  <System>
    <Provider Name="Linux-Sysmon" Guid="{ff032593-a8d3-4f13-b0d6-01fc615a0f97}"/>
    <EventID>1</EventID>
    <Version>5</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2024-12-10T10:58:59.793506000Z"/>
    <EventRecordID>386594</EventRecordID>
    <Correlation/>
    <Execution ProcessID="1252" ThreadID="1252"/>
    <Channel>Linux-Sysmon/Operational</Channel>
    <Computer>caldera-virtual-machine</Computer>
    <Security UserId="0"/>
  </System>
  <EventData>
    <Data Name="RuleName">-</Data>
    <Data Name="UtcTime">2024-12-08 21:32:57.540</Data>
    <Data Name="ProcessGuid">{36fe7a82-1089-6756-b5ef-941b63550000}</Data>
    <Data Name="ProcessId">11554</Data>
    <Data Name="Image">/usr/bin/xkill</Data>
    <Data Name="FileVersion">-</Data>
    <Data Name="Description">-</Data>
    <Data Name="Product">-</Data>
    <Data Name="Company">-</Data>
    <Data Name="OriginalFileName">-</Data>
    <Data Name="CommandLine">xkill</Data>
    <Data Name="CurrentDirectory">/home/caldera</Data>
    <Data Name="User">caldera</Data>
    <Data Name="LogonGuid">{36fe7a82-0000-0000-e803-000000000000}</Data>
    <Data Name="LogonId">1000</Data>
    <Data Name="TerminalSessionId">3</Data>
    <Data Name="IntegrityLevel">no level</Data>
    <Data Name="Hashes">SHA256=feda5b01891aff0c01791e5f60cb7e6bc07761f1534a1f18ce941db0ed84680c</Data>
    <Data Name="ParentProcessGuid">{36fe7a82-6868-6755-d5d6-c908e8550000}</Data>
    <Data Name="ParentProcessId">2352</Data>
    <Data Name="ParentImage">/usr/bin/bash</Data>
    <Data Name="ParentCommandLine">bash</Data>
    <Data Name="ParentUser">caldera</Data>
  </EventData>
</Event>

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions