14 Commits

Author	SHA1	Message	Date
Florian Roth	c1cebe627a	refactor: reworked CS pipe rule	2021-05-26 17:22:34 +02:00
Florian Roth	ba12057919	Merge pull request #1505 from WojciechLesicki/master ... Update rule regarding other named pipe	2021-05-26 14:35:22 +02:00
WojciechLesicki	8b707bc948	Added also \status_ pipe.	2021-05-25 21:58:22 +02:00
WojciechLesicki	f1a0308e73	Add one more pipe, references etc.	2021-05-25 21:07:23 +02:00
WojciechLesicki	38552e98cf	Adding some pipes	2021-05-25 15:47:34 +02:00
Jonhnathan	c7f7eb6698	Update Threat Hunter Playbook Reference	2021-05-22 01:02:43 -03:00
Florian Roth	ecb133f97d	docs: extended authors of malicious pipe rule	2021-05-04 09:28:17 +02:00
Florian Roth	c6aeee958e	rule: more named pipes by @blueteam0ps	2021-05-04 09:27:11 +02:00
Florian Roth	f2fa8dd956	rules: CobaltStrike named pipes	2021-04-23 17:16:09 +02:00
Steven	d263b937b4	Clean-up service: sysmon as it will be replaced by filling the category	2021-04-15 02:02:25 +02:00
Steven	7b679cc1f7	- Modified rules to use categories instead of hardcoded event IDs ... - Added file_delete category (Sysmon Event ID 23) to the generic translation file	2021-04-15 01:40:31 +02:00
Steven	850a002840	Merge branch 'master' of https://github.com/SigmaHQ/sigma	2021-04-15 01:25:48 +02:00
Steven	0c9a82af89	- Remove 'service: sysmon' since defining the categories made the rules generic	2020-10-02 09:37:52 +02:00
Steven	8b74abe0bc	- Created new categories for sysmon events ... - Replaced the explicit EventIDs with the reference to the category - Moved the rules to the corresponding directories	2020-09-30 20:44:14 +02:00