687 Commits

Author	SHA1	Message	Date
Sam0x90	0e8a46aaf7	Update win_subp_svchost rule ... Adding rpcnet.exe as ParentImage	2019-04-16 15:00:06 +02:00
Florian Roth	17470d1545	Rule: extended parent list for legitimate svchost starts ... https://twitter.com/Sam0x90/status/1117768799816753153	2019-04-15 14:54:35 +02:00
Florian Roth	daaee558a1	Rule: added date to Tom's WMI rule	2019-04-15 09:06:53 +02:00
Florian Roth	65b81dad32	Rule: Suspicious scripting in a WMI consumer	2019-04-15 08:13:35 +02:00
Florian Roth	1d3159bef0	Rule: Extended Office Shell rule	2019-04-15 08:13:35 +02:00
Florian Roth	1e262f5055	Merge pull request #303 from Karneades/patch-1 ... Remove too loose filter in wmi spwns powershell rule	2019-04-14 23:11:57 +02:00
Florian Roth	cb0a87e21e	Merge pull request #316 from megan201296/patch-19 ... Update win_mal_ursnif.yml	2019-04-14 23:10:16 +02:00
megan201296	eb8a0636c5	Update win_mal_ursnif.yml ... After @thomaspatzke changed to HKU, I did some reading. HKU is for HKEY_User, not HKEY_Current_User (what this threat is tied to. However, he was correct that HKCU does not exist as a prefix for sysmon (see the notes section under event id 13 here: https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml). Changed to ignore the key name, confirmed that the key is still uniique.	2019-04-14 11:51:13 -05:00
Karneades	75d36165fc	Remove non-generic falsepositives ... There are tons of FPs for that... :)	2019-04-11 12:55:24 +02:00
Karneades	51e65be98b	Remove loose wildcard filter in powershell encoded cmd rule	2019-04-11 12:53:12 +02:00
Karneades	766b8b8d18	Fix condition	2019-04-04 22:32:47 +02:00
Karneades	1915561351	Remove to loose wildcard from wmi spwns powershell rule	2019-04-04 22:12:28 +02:00
Florian Roth	81693d81b6	Merge pull request #295 from sbousseaden/master ... Create win_atsvc_task.yml	2019-04-04 18:32:13 +02:00
sbousseaden	c4b8f75940	Update win_lm_namedpipe.yml	2019-04-04 18:22:50 +02:00
sbousseaden	22958c45a3	Update win_GPO_scheduledtasks.yml	2019-04-03 21:50:55 +02:00
sbousseaden	b4ac9a432f	Update win_susp_psexec.yml	2019-04-03 21:50:25 +02:00
sbousseaden	353e457104	Update win_lm_namedpipe.yml	2019-04-03 21:49:58 +02:00
sbousseaden	d5818a417b	Update win_impacket_secretdump.yml	2019-04-03 21:49:30 +02:00
sbousseaden	9c5575d003	Update win_atsvc_task.yml	2019-04-03 21:48:38 +02:00
sbousseaden	edb98f2781	Update win_account_discovery.yml	2019-04-03 21:40:59 +02:00
Florian Roth	13f86e9333	Merge pull request #296 from Karneades/patch-1 ... Remove backslashes in CommandLine for sticky key rule	2019-04-03 19:44:02 +02:00
yt0ng	e0459cec1c	renamed file	2019-04-03 17:39:17 +02:00
t0x1c-1	7e058e611c	WMI spawning PowerShell seen in various attacks	2019-04-03 16:56:45 +02:00
Unknown	9ada22b8e0	adjusted link	2019-04-03 16:40:18 +02:00
Unknown	d2e605fc5c	Auto stash before rebase of "Neo23x0/master"	2019-04-03 16:25:18 +02:00
Karneades	865d971704	Remove backslashes in CommandLine for sticky key rule ... Example command line is exactly "cmd.exe sethc.exe 211". => the detection with *\cmd.exe... would not match.	2019-04-03 16:16:18 +02:00
sbousseaden	eda5298457	Create win_account_backdoor_dcsync_rights.yml	2019-04-03 16:16:05 +02:00
sbousseaden	0756b00cdf	Create win_susp_psexec.yml	2019-04-03 15:59:46 +02:00
sbousseaden	9c1a5a5264	Create win_lm_namedpipe.yml	2019-04-03 15:48:42 +02:00
sbousseaden	56b68a0266	Create win_GPO_scheduledtasks.yml	2019-04-03 15:36:24 +02:00
sbousseaden	b941f6411f	Create win_impacket_secretdump.yml	2019-04-03 15:18:42 +02:00
sbousseaden	516c8f3ea1	Create win_account_discovery.yml	2019-04-03 14:41:11 +02:00
sbousseaden	3d69727332	Create sysmon_rdp_settings_hijack.yml	2019-04-03 14:16:25 +02:00
sbousseaden	016261cacf	Update sysmon_lsass_memdump.yml	2019-04-03 14:06:49 +02:00
sbousseaden	a85c668f6f	Update sysmon_lsass_memdump.yml	2019-04-03 14:00:51 +02:00
sbousseaden	d62bc41bfb	Create win_svcctl_remote_service.yml	2019-04-03 13:58:20 +02:00
sbousseaden	32c6b34746	Create sysmon_lsass_memdump.yml	2019-04-03 13:51:59 +02:00
sbousseaden	548145ce10	Create win_susp_raccess_sensitive_fext.yml	2019-04-03 13:22:42 +02:00
sbousseaden	ddb2d92a98	Create sysmon_tsclient_filewrite_startup.yml	2019-04-03 13:19:59 +02:00
sbousseaden	e3f99c323b	Create win_atsvc_task.yml	2019-04-03 13:08:12 +02:00
Thomas Patzke	8e854b06f6	Specified source to prevent EventID collisions ... Issue #263	2019-04-01 23:45:55 +02:00
Florian Roth	e473efb7c3	Trying to fix ATT&CK framework tag	2019-04-01 10:36:35 +02:00
Florian Roth	3f2ce4b71f	Lowered level to medium	2019-04-01 09:47:14 +02:00
t0x1c-1	51c42a15a7	Allow Incoming Connections by Port or Application on Windows Firewall	2019-04-01 08:16:56 +02:00
Florian Roth	ffac77fb37	Rule: extended LockerGoga description	2019-03-22 11:03:48 +01:00
Florian Roth	1adb040e0b	Rule: LockerGoga	2019-03-22 10:59:31 +01:00
Florian Roth	2ad2ba9589	fix: rule field fix in proc_creation rule	2019-03-22 10:59:18 +01:00
Thomas Patzke	be25aa2c37	Added CAR tags	2019-03-16 00:37:09 +01:00
Thomas Patzke	8512417de0	Incorporated MITRE CAR mapping from #55	2019-03-16 00:03:27 +01:00
yugoslavskiy	33db032a16	added missed service	2019-03-14 00:44:26 +01:00