Florian Roth
56172ae174
Corrected CrackMapExec rule
2018-04-09 08:40:03 +02:00
Florian Roth
a9c7fe202e
Rule: Windows shell spawning suspicious program
2018-04-09 08:37:30 +02:00
Florian Roth
8ddd40e18e
PowerShell Cradle - WebDAV UA
2018-04-09 08:37:30 +02:00
Florian Roth
e53826e167
Extended Sysmon Office Shell rule
2018-04-09 08:37:30 +02:00
Florian Roth
6eb8cdfeab
TSCookie UA
2018-04-09 08:37:30 +02:00
Thomas Patzke
05928d4f8f
Merge pull request #76 from HacknowledgeCH/es-dsl
...
es-dsl backend
2018-04-08 23:39:23 +02:00
Thomas Patzke
f113832c04
Merge pull request #69 from jmallette/rules
...
Create cmdkey recon rule
2018-04-08 23:23:30 +02:00
Thomas Patzke
35d43c5ed9
Merge pull request #77 from yt0ng/sigma-yt0ng
...
added NCSC CrackMapExecWin Description in apt_dragonfly.yml
2018-04-08 23:21:49 +02:00
root
69671733a8
added NCSC CrackMapExecWin Description in apt_dragonfly.yml
2018-04-08 17:10:00 +02:00
milkmix
0b3b0c3aaf
imported es-dsl code from repo
2018-04-06 17:36:11 +02:00
Thomas Patzke
24d94d39b8
CI: Testing backend es-qs against Elasticsearch
2018-04-04 00:32:48 +02:00
Thomas Patzke
4183b1b59e
Sigma tools release 0.3.3
2018-03-29 11:17:03 +02:00
Thomas Patzke
22ee6f4521
sigmac: escaped wildcards (\* and \?) are passed in generated query
2018-03-29 11:15:20 +02:00
Thomas Patzke
17c1c1adff
Added field name mappings to HELK configuration
2018-03-27 14:41:02 +02:00
Thomas Patzke
a3e02ea70f
Various rule fixes
...
* Field name: LogonProcess -> LogonProcessName
* Field name: Message -> AuditPolicyChanges
* Field name: ProcessCommandLine -> CommandLine
* Removed Type match in Kerberos RC4 encryption rule
Problematic because text representation not unified and audit failures are possibly interesting events
* Removed field 'Severity' from rules (Redundant)
* Rule decomposition of win_susp_failed_logons_single_source) because of different field names
* Field name: SubjectAccountName -> SubjectUserName
* Field name: TargetProcess -> TargetImage
* Field name: TicketEncryption -> TicketEncryptionType
* Field name: TargetFileName -> TargetFilename
2018-03-27 14:35:49 +02:00
Thomas Patzke
b1bfa64231
Removed redundant 'EventLog' conditions
2018-03-26 00:36:40 +02:00
Thomas Patzke
f68af2a5da
Added reference to Kerberos RC4 rule
2018-03-25 23:19:01 +02:00
Thomas Patzke
dacc6ae3d3
Fieldname case: Commandline -> CommandLine
2018-03-25 23:08:28 +02:00
Florian Roth
e141a834ff
Rule: Ping hex IP address
...
https://github.com/vysec/Aggressor-VYSEC/blob/master/ping.cna
2018-03-23 17:00:00 +01:00
Florian Roth
c10da5b734
Improved Chafer activity rule
2018-03-23 10:50:40 +01:00
Florian Roth
a797a281ac
Rule: Chafer / OilRig activity Mar 18
...
https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/
2018-03-23 08:59:16 +01:00
Thomas Patzke
3962520848
Merge branch 'devel-sigmac'
2018-03-22 00:05:51 +01:00
Thomas Patzke
5f8b60cc24
sigmac: Improved fieldlist backend
...
* Unique list of fields for multiple rules
* Aggregation support
2018-03-22 00:03:51 +01:00
Florian Roth
f220e61adc
Fixed second selection in rule
2018-03-21 10:47:14 +01:00
Florian Roth
70c2f973a3
Rule: Smbexec.py Service Installation
2018-03-21 10:44:37 +01:00
Florian Roth
3c968d4ec6
Fixed rule for any ControlSets
2018-03-21 10:44:37 +01:00
Thomas Patzke
5c0f811f4a
Sigma tools release 0.3.2
2018-03-21 01:15:19 +01:00
Thomas Patzke
0018503501
sigmac: Fixed rulecommend backend option
2018-03-21 01:13:10 +01:00
Thomas Patzke
7360a68741
Sigma tools release 0.3.1
2018-03-21 00:59:23 +01:00
Thomas Patzke
4a9849b161
sigmac: improved backend options
...
* parsing in main class
* help
2018-03-21 00:53:44 +01:00
Thomas Patzke
bd20ffdad9
sigmac/kibana: curl URL quoted
2018-03-21 00:22:00 +01:00
Thomas Patzke
177e2acf8e
Updated README
2018-03-20 23:54:00 +01:00
Florian Roth
97204d8dc0
Renamed rule
2018-03-20 15:04:11 +01:00
Florian Roth
e9fcfcba7f
Improved NetNTLM downgrade rule
2018-03-20 15:03:55 +01:00
Florian Roth
a7eb4d3e34
Renamed rule
2018-03-20 11:12:35 +01:00
Florian Roth
b84bbd327b
Rule: NetNTLM Downgrade Attack
...
https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
2018-03-20 11:07:21 +01:00
Florian Roth
a6d293e31d
Improved tscon rule
2018-03-20 10:54:04 +01:00
Florian Roth
8fb6bc7a8a
Rule: Suspicious taskmgr as LOCAL_SYSTEM
2018-03-19 16:36:39 +01:00
Florian Roth
af8be8f064
Several rule updates
2018-03-19 16:36:15 +01:00
Florian Roth
648ac5a52e
Rules: tscon.exe anomalies
...
http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
2018-03-17 19:14:13 +01:00
Thomas Patzke
3f5f3a8d50
sigmac: Remove problematic characters from rule identifiers
2018-03-17 00:44:50 +01:00
Thomas Patzke
f6858c436a
sigmac: Kibana curl output generates one index pattern line per pattern
2018-03-16 23:53:12 +01:00
Thomas Patzke
578118315c
Merge branch 'devel-sigmac' into helk
2018-03-16 23:48:13 +01:00
Thomas Patzke
e162ba0155
Added HELK configuration
2018-03-16 23:42:31 +01:00
Florian Roth
ff45901ea3
Merge pull request #71 from Karneades/patch-1
...
Add missing binaries
2018-03-16 11:49:37 +01:00
Karneades
49c12f1df8
Add missing binaries
2018-03-16 10:52:43 +01:00
Florian Roth
a257b7d9d7
Rule: Stickykey improved
2018-03-16 09:10:07 +01:00
Florian Roth
8b31767d31
Rule: PsExec usage
2018-03-15 19:54:22 +01:00
Florian Roth
0460e7f18a
Rule: Suspicious process started from taskmgr
2018-03-15 19:54:03 +01:00
Florian Roth
f5494c6f5f
Rule: StickyKey-ike backdoor usage
2018-03-15 19:53:34 +01:00
