3916 Commits

Author	SHA1	Message	Date
yugoslavskiy	3c75bc922a	Update win_susp_squirrel_lolbin.yml	2020-11-28 17:47:16 +01:00
Jonhnathan	06cc5049a4	Update sysmon_dns_serverlevelplugindll.yml	2020-11-28 13:46:02 -03:00
yugoslavskiy	42f27a41cb	Update win_susp_rundll32_by_ordinal.yml	2020-11-28 17:44:30 +01:00
yugoslavskiy	ca0a6547fb	Update win_susp_run_locations.yml	2020-11-28 17:42:47 +01:00
Jonhnathan	f1455e0c38	Update win_win10_sched_task_0day.yml	2020-11-28 13:42:30 -03:00
Jonhnathan	fe3ed329ef	Update win_webshell_recon_detection.yml	2020-11-28 13:41:11 -03:00
yugoslavskiy	ea550cf551	Update win_susp_regsvr32_anomalies.yml	2020-11-28 17:40:40 +01:00
Jonhnathan	f0bf3d13b5	Update win_webshell_detection.yml	2020-11-28 13:38:34 -03:00
Jonhnathan	9f4bbb7e65	Update win_webshell_detection.yml	2020-11-28 13:35:50 -03:00
yugoslavskiy	bcf62fba72	Update win_susp_ps_appdata.yml	2020-11-28 17:34:34 +01:00
yugoslavskiy	2ed4b26291	Update win_susp_procdump.yml	2020-11-28 17:33:02 +01:00
Jonhnathan	0d0f58c830	Update win_system_exe_anomaly.yml	2020-11-28 13:32:44 -03:00
yugoslavskiy	a3e436363e	Update win_susp_powershell_parent_combo.yml	2020-11-28 17:31:37 +01:00
Jonhnathan	c9b5ba10f8	Update win_susp_wmi_execution.yml	2020-11-28 13:30:34 -03:00
yugoslavskiy	c01c05b826	Update win_susp_powershell_enc_cmd.yml	2020-11-28 17:29:15 +01:00
Jonhnathan	f6117eebc7	Update win_susp_sysvol_access.yml	2020-11-28 13:27:28 -03:00
Jonhnathan	88b4d4c4e5	Update win_susp_sysvol_access.yml	2020-11-28 13:26:22 -03:00
yugoslavskiy	66a504078b	Update win_susp_ping_hex_ip.yml	2020-11-28 17:25:52 +01:00
Jonhnathan	7aa831eac3	Remove additional backslash	2020-11-28 13:25:28 -03:00
Jonhnathan	0357472635	Update win_susp_squirrel_lolbin.yml	2020-11-28 13:24:38 -03:00
Jonhnathan	f70bd415a3	Update win_susp_run_locations.yml	2020-11-28 13:21:04 -03:00
Jonhnathan	5cbefe3737	Update win_susp_regsvr32_anomalies.yml	2020-11-28 13:18:38 -03:00
Jonhnathan	e99f63f811	Update win_susp_ps_appdata.yml	2020-11-28 13:15:24 -03:00
Jonhnathan	fc842c22b2	Update win_susp_prog_location_process_starts.yml	2020-11-28 13:11:15 -03:00
Jonhnathan	a78eb61d92	Remove additional backslash	2020-11-28 13:08:51 -03:00
Jonhnathan	27f47a8ffc	Update win_susp_procdump.yml	2020-11-28 13:08:21 -03:00
Jonhnathan	b61707e7f3	Remove additional backslash	2020-11-28 13:07:06 -03:00
Jonhnathan	c9461506f2	Update win_susp_powershell_enc_cmd.yml	2020-11-28 13:06:10 -03:00
Jonhnathan	2364e9870d	Update win_susp_powershell_enc_cmd.yml	2020-11-28 13:05:47 -03:00
Jonhnathan	f4f8174199	Update win_susp_powershell_enc_cmd.yml	2020-11-28 13:04:36 -03:00
Jonhnathan	53e1201bea	Update win_susp_ping_hex_ip.yml	2020-11-28 13:01:42 -03:00
Jonhnathan	b24945999e	Update win_susp_ping_hex_ip.yml	2020-11-28 13:01:24 -03:00
Jonhnathan	1c56dc463a	Remove additional backslash	2020-11-28 12:38:19 -03:00
Jonhnathan	198bdb9659	Remove Additional backslash	2020-11-28 12:34:06 -03:00
Jonhnathan	63adc6fc09	Update win_susp_direct_asep_reg_keys_modification.yml	2020-11-28 12:32:35 -03:00
Jonhnathan	3481b0dd9e	Update win_susp_curl_start_combo.yml	2020-11-28 12:31:55 -03:00
yugoslavskiy	245a0d3438	Update win_susp_outlook.yml	2020-11-28 13:34:57 +01:00
yugoslavskiy	36299f5139	Update win_susp_net_execution.yml	2020-11-28 13:33:30 +01:00
yugoslavskiy	501791945f	Update win_susp_msiexec_web_install.yml	2020-11-28 13:32:01 +01:00
yugoslavskiy	8293fd8e5b	Update win_susp_iss_module_install.yml	2020-11-28 13:30:27 +01:00
yugoslavskiy	1896a45572	Update win_susp_ntdsutil.yml	2020-11-28 13:28:00 +01:00
Jonhnathan	4411fc5b0e	Update win_susp_commands_recon_activity.yml	2020-11-28 09:14:56 -03:00
Jonhnathan	2bf4644b48	Update win_renamed_paexec.yml	2020-11-28 09:08:48 -03:00
Jonhnathan	4e59fc0dfd	Update win_renamed_binary_highly_relevant.yml	2020-11-28 09:08:09 -03:00
yugoslavskiy	4354303174	Update win_susp_execution_path.yml	2020-11-28 13:07:22 +01:00
yugoslavskiy	77cf5d2563	Update win_susp_exec_folder.yml	2020-11-28 13:04:05 +01:00
yugoslavskiy	201377fa29	Update win_susp_csc_folder.yml	2020-11-28 13:01:03 +01:00
yugoslavskiy	c4a35036a0	Update win_susp_csc.yml	2020-11-28 12:54:18 +01:00
yugoslavskiy	5d7f42a4a6	Update win_susp_crackmapexec_execution.yml	2020-11-28 12:53:00 +01:00
yugoslavskiy	38e7853891	Update win_susp_copy_lateral_movement.yml	2020-11-28 12:44:54 +01:00
yugoslavskiy	34e64a6570	Update win_susp_codepage_switch.yml	2020-11-28 12:42:27 +01:00
yugoslavskiy	5278fcd476	Update win_susp_cmd_http_appdata.yml	2020-11-28 12:34:28 +01:00
yugoslavskiy	fd102c1b5f	Update win_susp_certutil_encode.yml	2020-11-28 12:31:40 +01:00
yugoslavskiy	68365f29c2	Update win_susp_certutil_command.yml	2020-11-28 12:29:30 +01:00
yugoslavskiy	c9596d7e30	Update win_susp_adfind.yml	2020-11-28 12:11:53 +01:00
yugoslavskiy	331a177f69	Update win_proc_wrong_parent.yml	2020-11-28 12:10:37 +01:00
yugoslavskiy	dbb054777a	Update win_plugx_susp_exe_locations.yml	2020-11-28 12:02:16 +01:00
yugoslavskiy	0fdd8e7128	Update win_netsh_port_fwd_3389.yml	2020-11-28 11:32:35 +01:00
yugoslavskiy	5d457f4f79	Update win_netsh_port_fwd.yml	2020-11-28 11:31:27 +01:00
yugoslavskiy	78193d3e3a	Update win_mal_adwind.yml	2020-11-28 11:25:28 +01:00
yugoslavskiy	de41e34d53	Update win_apt_sofacy.yml	2020-11-28 11:21:23 +01:00
yugoslavskiy	fe499d8838	Update win_apt_judgement_panda_gtr19.yml	2020-11-28 11:14:23 +01:00
yugoslavskiy	11c18e14d8	Update win_hack_koadic.yml	2020-11-28 11:12:06 +01:00
yugoslavskiy	eaf2fde6eb	Update win_netsh_fw_add_susp_image.yml	2020-11-28 11:05:04 +01:00
yugoslavskiy	5eec5d485b	Update sysmon_in_memory_assembly_execution.yml	2020-11-28 10:55:18 +01:00
yugoslavskiy	9445d18474	Update win_netsh_wifi_credential_harvesting.yml	2020-11-28 10:39:37 +01:00
yugoslavskiy	687f6d8946	Update win_powershell_download.yml	2020-11-28 10:37:30 +01:00
yugoslavskiy	fe0029e738	Update win_powersploit_empire_schtasks.yml	2020-11-28 10:29:07 +01:00
yugoslavskiy	de5cac99d9	Update win_malware_wannacry.yml	2020-11-28 10:28:04 +01:00
yugoslavskiy	5a4b01662e	Update win_netsh_fw_add.yml	2020-11-28 10:22:24 +01:00
yugoslavskiy	9ae26e2674	Update win_apt_cloudhopper.yml	2020-11-28 10:20:12 +01:00
yugoslavskiy	4a2cce0b40	Update win_apt_chafer_mar18.yml	2020-11-28 10:15:39 +01:00
Florian Roth	30c0b440e2	Merge pull request #1228 from stvetro/oscd-GfxDownloadWrapper ... [OSCD] GfxDownloadWrapper downloads file (LoLBin)	2020-11-28 10:10:30 +01:00
Florian Roth	1ea4bb0b87	wrong field name	2020-11-28 10:10:00 +01:00
yugoslavskiy	17813c947c	Update win_apt_bluemashroom.yml	2020-11-28 09:48:30 +01:00
yugoslavskiy	26fa500e21	Update win_control_panel_item.yml	2020-11-28 09:38:49 +01:00
yugoslavskiy	2e5e4a20d2	Update powershell_clear_powershell_history.yml	2020-11-28 09:26:18 +01:00
yugoslavskiy	016a89c186	Update win_susp_net_recon_activity.yml	2020-11-28 08:00:07 +01:00
Jonhnathan	702f697168	Update win_powershell_download.yml	2020-11-27 16:10:10 -03:00
Jonhnathan	fb119d6112	Remove additional backslash	2020-11-27 16:06:15 -03:00
Jonhnathan	bf5aa947e3	Update win_office_spawn_exe_from_users_directory.yml	2020-11-27 16:04:55 -03:00
Jonhnathan	f6aaa957ff	Update win_netsh_wifi_credential_harvesting.yml	2020-11-27 16:01:25 -03:00
Jonhnathan	d996e97fdd	Update win_netsh_port_fwd_3389.yml	2020-11-27 16:00:04 -03:00
Jonhnathan	b816754018	Update win_netsh_port_fwd_3389.yml	2020-11-27 15:59:25 -03:00
Jonhnathan	5acd8d622b	Update win_netsh_port_fwd.yml	2020-11-27 15:57:53 -03:00
Jonhnathan	9171d8913c	Remove Additional backslash	2020-11-27 15:45:08 -03:00
Jonhnathan	0bf996d66e	Update win_netsh_fw_add.yml	2020-11-27 15:44:22 -03:00
Jonhnathan	3f5a2af2db	Update win_mshta_spawn_shell.yml	2020-11-27 15:43:29 -03:00
Jonhnathan	345c6627a8	Update win_mmc_spawn_shell.yml	2020-11-27 15:42:22 -03:00
Jonhnathan	3854a0ed8d	Update Logic	2020-11-27 15:38:16 -03:00
Jonhnathan	84b35dd6b8	Update win_malware_script_dropper.yml	2020-11-27 15:30:53 -03:00
Jonhnathan	217dd53c62	Update win_malware_notpetya.yml	2020-11-27 15:29:29 -03:00
Jonhnathan	3410a1eece	Update win_malware_formbook.yml	2020-11-27 15:26:15 -03:00
Jonhnathan	253c0839ec	Update logic	2020-11-27 15:25:38 -03:00
Florian Roth	c17c034cb5	Changed selections and condition ... see manpage for security tool on macOS https://gist.github.com/Capybara/6228955	2020-11-27 19:23:31 +01:00
Jonhnathan	5f5af0bd36	Update win_malware_dridex.yml	2020-11-27 15:10:31 -03:00
Jonhnathan	7672db2aeb	Update Logic	2020-11-27 12:37:04 -03:00
Jonhnathan	22ae395e4a	Update win_impacket_lateralization.yml	2020-11-27 12:35:27 -03:00
Jonhnathan	e18829697f	Update Logic	2020-11-27 12:33:31 -03:00
Jonhnathan	9331686368	Update Logic	2020-11-27 12:27:23 -03:00
Jonhnathan	dbd97647f6	Remove Additional backslash and update logic	2020-11-27 12:22:04 -03:00
Jonhnathan	421ab4dc5f	Update win_exploit_cve_2017_0261.yml	2020-11-27 12:18:06 -03:00
Jonhnathan	3f9edf19a9	Update win_control_panel_item.yml	2020-11-27 12:15:12 -03:00
Jonhnathan	bde2b95cdc	Remove Additional backslash	2020-11-27 12:14:34 -03:00
Jonhnathan	e58333f808	Update win_commandline_path_traversal.yml	2020-11-27 12:13:45 -03:00
Jonhnathan	a403082631	Update win_bypass_squiblytwo.yml	2020-11-26 23:33:00 -03:00
Jonhnathan	d5803b89ef	Update win_apt_zxshell.yml	2020-11-26 23:31:10 -03:00
Jonhnathan	89a4aa84bf	Update win_apt_winnti_pipemon.yml	2020-11-26 23:29:10 -03:00
Jonhnathan	df93846117	Update win_apt_unidentified_nov_18.yml	2020-11-26 23:26:18 -03:00
Jonhnathan	b234d577d6	Update win_apt_sofacy.yml	2020-11-26 23:21:53 -03:00
Jonhnathan	77bae30bef	Update win_apt_slingshot.yml	2020-11-26 23:18:32 -03:00
Jonhnathan	f2dd516b7c	Fix logic	2020-11-26 23:16:03 -03:00
Jonhnathan	127607c5e7	Remove Additional backslash	2020-11-26 23:14:51 -03:00
Jonhnathan	bce74198ab	Remove Additional backslash	2020-11-26 23:14:24 -03:00
Jonhnathan	fda266adb6	Update win_apt_hurricane_panda.yml	2020-11-26 23:12:26 -03:00
Jonhnathan	d0b6694767	Update win_apt_greenbug_may20.yml	2020-11-26 23:05:44 -03:00
Jonhnathan	707fbe048e	Update win_apt_evilnum_jul20.yml	2020-11-26 23:05:08 -03:00
Jonhnathan	a113c0f3b4	Remove Additional backslash	2020-11-26 23:00:05 -03:00
Jonhnathan	d57d7c1e5b	Remove Additional backslash	2020-11-26 22:59:35 -03:00
Jonhnathan	f61317b2f9	Update sysmon_in_memory_assembly_execution.yml	2020-11-26 22:50:48 -03:00
Jonhnathan	784cab1dfe	Fix missing logic and Field	2020-11-26 22:46:17 -03:00
Jonhnathan	48f16a0ca8	Update win_susp_net_recon_activity.yml	2020-11-26 22:39:49 -03:00
Tim I	78d201ad15	Fix value modifier and add a slash	2020-11-24 23:06:21 +03:00
Alejandro Ortuno	000c038ede	Retrigger tests	2020-11-20 09:30:43 +01:00
Alejandro Ortuno	cfcda8d25f	Trigger new test execution	2020-11-20 09:29:09 +01:00
Jonhnathan	31e0cfb13f	Update win_susp_covenant.yml	2020-11-20 02:36:20 -03:00
Jonhnathan	ec1944e2d7	Update win_susp_copy_system32.yml	2020-11-20 02:31:26 -03:00
Jonhnathan	5d7131bbf2	Update win_susp_compression_params.yml	2020-11-20 02:29:41 -03:00
Jonhnathan	32ed588adb	Update detection Logic	2020-11-20 02:27:58 -03:00
Jonhnathan	b274be8d4e	Update detection Logic	2020-11-20 02:25:32 -03:00
Jonhnathan	c31c0d981a	Update detection logic	2020-11-20 02:23:18 -03:00
Jonhnathan	23edcc6dc6	Update win_susp_certutil_command.yml	2020-11-20 02:21:55 -03:00
Jonhnathan	8af17dda5b	Update win_spn_enum.yml	2020-11-20 02:17:31 -03:00
Jonhnathan	d5cb4246c2	Remove additional backlash	2020-11-20 02:16:51 -03:00
Jonhnathan	0606cd3dde	Update detection Logic	2020-11-20 02:10:27 -03:00
Jonhnathan	ebb4580378	Remove additional backlash	2020-11-20 02:04:28 -03:00
Jonhnathan	2ba146be07	Remove additional backlash	2020-11-20 02:03:06 -03:00
Jonhnathan	493fa3d5ee	Update sysmon_susp_mic_cam_access.yml	2020-11-20 02:02:26 -03:00
Jonhnathan	9e3a612953	Remove additional backlash	2020-11-20 02:01:43 -03:00
Jonhnathan	6c88dd700e	Update sysmon_stickykey_like_backdoor.yml	2020-11-20 02:00:53 -03:00
Jonhnathan	1e640b50f9	Remove additional backlash	2020-11-20 01:58:20 -03:00
Jonhnathan	acff5ef4f9	Update sysmon_registry_persistence_key_linking.yml	2020-11-20 01:57:34 -03:00
Jonhnathan	e35b09e1a6	Remove out of context falsepositive	2020-11-20 01:55:48 -03:00
Jonhnathan	d595df2879	Fix	2020-11-20 01:53:15 -03:00
Jonhnathan	6f3daad053	Update sysmon_apt_oceanlotus_registry.yml	2020-11-20 01:51:53 -03:00
Jonhnathan	9967bd1fe5	Update sysmon_apt_oceanlotus_registry.yml	2020-11-20 01:51:01 -03:00
Jonhnathan	1af9e9ed48	Update sysmon_win_reg_persistence.yml	2020-11-20 01:47:19 -03:00
Jonhnathan	8d8c29e0fe	Update sysmon_uac_bypass_sdclt.yml	2020-11-20 01:42:17 -03:00
Jonhnathan	372f000b7f	Update sysmon_uac_bypass_eventvwr.yml	2020-11-20 01:41:20 -03:00
Jonhnathan	e8aa9a854a	Update sysmon_uac_bypass_eventvwr.yml	2020-11-20 01:40:29 -03:00
Jonhnathan	57e98e3957	Remove additional backlash	2020-11-20 01:38:57 -03:00
Jonhnathan	9cf2ea5862	Update sysmon_susp_service_installed.yml	2020-11-20 01:38:17 -03:00
Jonhnathan	1acc19a8d5	Remove additional backlash	2020-11-20 01:37:24 -03:00
Jonhnathan	ab2edd1ff0	Update sysmon_malware_verclsid_shellcode.yml	2020-11-20 01:34:43 -03:00
Jonhnathan	240a8b9aa0	Update sysmon_lazagne_cred_dump_lsass_access.yml	2020-11-20 01:33:04 -03:00
Jonhnathan	ebd9973dcb	Update sysmon_lazagne_cred_dump_lsass_access.yml	2020-11-20 01:32:41 -03:00
Jonhnathan	2194744803	Update sysmon_invoke_phantom.yml	2020-11-20 01:30:58 -03:00
Jonhnathan	4af7f00f4a	Improve logic	2020-11-20 01:30:01 -03:00
Jonhnathan	728276ef13	Improve Logic	2020-11-20 01:22:20 -03:00
Jonhnathan	ee43919eec	Change detection logic	2020-11-20 01:05:06 -03:00
Jonhnathan	c42911cb47	Update win_wmi_persistence.yml	2020-11-20 00:58:49 -03:00
Jonhnathan	718792e0ba	Update win_tool_psexec.yml	2020-11-20 00:57:16 -03:00
Jonhnathan	b3e0b55250	Remove additional backslash	2020-11-20 00:53:13 -03:00
Jonhnathan	813afd4f4c	Remove additional backslash	2020-11-20 00:52:54 -03:00
Jonhnathan	f6a89e9707	Fix Detection Logic	2020-11-20 00:51:22 -03:00
Jonhnathan	0ffd1ef47f	Remove additional backslash	2020-11-19 23:15:38 -03:00
Jonhnathan	351a9920ed	Update win_mal_flowcloud.yml	2020-11-19 23:14:44 -03:00
Jonhnathan	43ffb80d94	Remove additional backslash	2020-11-19 23:09:50 -03:00
Jonhnathan	44652c4ffd	Remove additional backslash	2020-11-19 23:08:40 -03:00
Jonhnathan	9a5b17f2bb	Remove additional backslash	2020-11-19 23:04:26 -03:00
Jonhnathan	f79caba72a	Remove additional backslash	2020-11-19 22:58:50 -03:00
Jonhnathan	6ecafac619	Update sysmon_susp_driver_load.yml	2020-11-19 22:56:34 -03:00
Jonhnathan	f42ef96140	Fix Reference	2020-11-19 22:50:27 -03:00
Jonhnathan	fdd28556cf	Fix ref	2020-11-19 22:48:20 -03:00
Jonhnathan	4f4fcbc576	Update win_susp_wmi_login.yml	2020-11-19 22:47:20 -03:00
Jonhnathan	ea385767b9	Update win_susp_ntlm_auth.yml	2020-11-19 22:40:43 -03:00
Jonhnathan	5d85bbba56	Improve detection logic	2020-11-19 22:37:13 -03:00
Jonhnathan	c20bce4a77	Update win_susp_msmpeng_crash.yml	2020-11-19 22:30:48 -03:00
Jonhnathan	7fe2c00ac1	Update win_net_ntlm_downgrade.yml	2020-11-19 22:14:37 -03:00
Jonhnathan	371c112143	Fix the detection logic ... ObjectName = admin was included in the query using AND, not OR.	2020-11-19 21:45:19 -03:00
Ömer Günal	1582c5230a	Update lnx_process_discovery.yml	2020-11-18 23:25:15 +03:00
Thomas Patzke	199a897f75	Fix rule indent	2020-11-17 10:12:55 +01:00
v3t0	3d206b08d8	[OSCD] Added a rule to detect potential persistence using registry keys	2020-11-15 19:04:12 -05:00
yugoslavskiy	2939b33ab5	Update lnx_network_service_scanning.yml	2020-11-16 01:00:09 +01:00
Ömer Günal	edc416a1d8	Update lnx_system_info_discovery.yml	2020-11-14 19:24:23 +03:00
Ömer Günal	821bdf8ab4	Update lnx_install_root_certificate.yml	2020-11-14 19:19:28 +03:00
stvetro	19eb8306d3	Removed unnessary antifalse positive	2020-11-14 09:50:29 +04:00
Ömer Günal	19cad11a4a	Update lnx_system_info_discovery.yml	2020-11-10 20:11:49 +03:00
Ömer Günal	ab959394ab	Update lnx_install_root_certificate.yml	2020-11-10 20:09:46 +03:00
Ömer Günal	f41accab33	Update lnx_install_root_certificate.yml	2020-11-10 20:09:03 +03:00
Ryan Plas	d4d694b4da	Logic fix for sysmon_non_priv_program_files_move	2020-11-10 10:01:47 -05:00
Alejandro Ortuno	ad031d97ee	Filter out listening mode on nc	2020-11-09 10:32:56 +01:00
Ömer Günal	577165b7f7	Update lnx_system_info_discovery.yml	2020-11-08 11:09:27 +03:00
Ömer Günal	0e4a5baf1a	Update lnx_install_root_certificate.yml	2020-11-08 11:08:30 +03:00
Ömer Günal	499a8f85b0	Update lnx_install_root_certificate.yml	2020-11-08 11:06:11 +03:00
Ömer Günal	5dc3472af0	Update lnx_system_info_discovery.yml	2020-11-07 11:51:53 +03:00
Ömer Günal	89a24d4bfa	Update lnx_install_root_certificate.yml	2020-11-07 11:50:30 +03:00
yugoslavskiy	c17e8574d0	change the syntax a bit and removed .service suffix as it is ... [redundant](https://www.freedesktop.org/software/systemd/man/systemctl.html]: ``` Unit commands listed above take either a single unit name (designated as UNIT), or multiple unit specifications (designated as PATTERN…). In the first case, the unit name with or without a suffix must be given. If the suffix is not specified (unit name is "abbreviated"), systemctl will append a suitable suffix, ".service" by default, and a type-specific suffix in case of commands which operate only on specific unit types. For example, # systemctl start sshd and # systemctl start sshd.service are equivalent ```	2020-11-06 20:56:08 +01:00
Alejandro Ortuno	7c5067ade4	Making it a global rule	2020-11-06 10:25:59 +01:00
Alejandro Ortuno	a9a90e024c	make it global rule	2020-11-06 09:56:49 +01:00