Florian Roth
29c5a9dc8e
Merge pull request #458 from EccoTheFlintstone/psexec
...
fix: PsExec false positives
2019-09-28 10:15:23 +02:00
Florian Roth
d44f89454e
Merge pull request #462 from EccoTheFlintstone/taskmgr
...
Sysmon rules cleanup and move to process_creation
2019-09-28 09:54:26 +02:00
ecco
5a15687c6c
fix rule: task manager as parent: task manager can be run with higher privileges (show processes from all users --> UAC) and its parent is still the old taskmgr
2019-09-27 11:06:21 -04:00
Galapag0s
1e4ef648db
Added Additional history clearing options
...
history -w will clear the current shell history
shred purposely overwrites data replacing it with random data
2019-09-26 12:53:13 -04:00
ecco
7a1d48cccd
fix: PsExec false positives
2019-09-26 04:50:43 -04:00
Florian Roth
36bcd1c54e
Merge pull request #443 from EccoTheFlintstone/aduserbck
...
fix FP : field null value can be '-'
2019-09-25 17:43:22 +02:00
Florian Roth
3d333290a9
Merge pull request #445 from EccoTheFlintstone/localadmin
...
rule: user added to local administrator: handle non english systems b…
2019-09-25 17:29:41 +02:00
Florian Roth
8063484b0d
Merge pull request #447 from Galapag0s/patch-1
...
Added Sticky Bits
2019-09-25 17:28:48 +02:00
Florian Roth
e77657db2f
Merge pull request #451 from EccoTheFlintstone/sysmon_clean
...
sysmon rules cleanup and move to process_creation
2019-09-25 17:28:23 +02:00
Florian Roth
365a46e27e
Merge pull request #454 from EccoTheFlintstone/no_tab
...
remove TAB from cli escape as it's currently unsupported in sigmac
2019-09-25 17:27:56 +02:00
Florian Roth
596140543d
Merge pull request #455 from EccoTheFlintstone/ruler_fix
...
Ruler fix
2019-09-25 17:26:55 +02:00
Florian Roth
ca5b11c622
Merge pull request #456 from EccoTheFlintstone/pth
...
fix PtH rule : field name in event 4624 is SubjectUserSid with null S…
2019-09-25 17:26:22 +02:00
ecco
4c54e8322a
sysmon eventid 3: filter on outgoing connections (initiated: true) to avoid false positives
2019-09-25 11:11:22 -04:00
Florian Roth
7b8b1db241
rule: proxy ua unknown zero day implant
2019-09-24 18:24:48 +02:00
ecco
a644b938a0
fix PtH rule : field name in event 4624 is SubjectUserSid with null SID value (S-1-0-0)
2019-09-23 05:44:26 -04:00
ecco
6a7f7e0f76
add microsoft reference for events fields names
2019-09-23 05:21:30 -04:00
ecco
d48b63a235
ruler rule field name fix for eventID 4776
2019-09-23 05:17:35 -04:00
ecco
c2868f6e03
remove TAB from cli escape as it's currently unsupported in sigmac
2019-09-23 04:46:10 -04:00
Thomas Patzke
9630635e25
Merge branch 'herrBez-addt push origin master-datefield-xpack-watcher'
2019-09-12 00:20:28 +02:00
Thomas Patzke
19f431b6d2
Changed xpack-watcher dateField default to previous value
2019-09-12 00:19:58 +02:00
ecco
0c96777f6a
sysmon rules cleanup and move to process_creation
2019-09-11 10:24:43 -04:00
ecco
4c5eab88b6
add GroupSid to other configs
2019-09-11 04:53:30 -04:00
herrBez
8f612f743c
Use config dateField in xpack watcher to determine
...
datefield name as in elasticsearch dsl backend
2019-09-11 09:38:03 +02:00
Florian Roth
038900e2fe
fix: renamed powershell rule
2019-09-06 17:33:56 +02:00
Galapag0s
ccdda5e82b
Update lnx_shell_priv_esc_prep.yml
2019-09-06 11:29:42 -04:00
Galapag0s
23021aa110
Added Sticky Bits
...
Attackers may look to exploit binaries with the sticky bits enabled. By being able to run a binary as a different user or group, they may be able to run separate commands as an elevated user.
2019-09-06 11:25:48 -04:00
ecco
b410710338
move wevtutil / fsutil events from ransomware to dedicated rules
2019-09-06 10:57:03 -04:00
ecco
5ae46ac56d
rule: user added to local administrator: handle non english systems by using group sid instead of name
2019-09-06 06:21:42 -04:00
ecco
fe93d84015
fix FP : field null value can be '-'
2019-09-06 05:14:58 -04:00
Florian Roth
7f1b6eb311
fix: duplicate rule
2019-09-06 10:30:47 +02:00
Florian Roth
fcbae16cc8
rule: image debugger
2019-09-06 10:28:20 +02:00
Florian Roth
2ec1f710f3
Merge pull request #441 from EccoTheFlintstone/powershell_rules
...
powershell false positives
2019-09-06 10:19:45 +02:00
ecco
01956f1312
powershell false positives
2019-09-06 03:54:19 -04:00
Thomas Patzke
c80cb418cd
Improved QRadar regular expression support
2019-09-05 15:35:26 +02:00
Thomas Patzke
30b6db8299
Fixed ES backend keyword field mapping wildcard match pattern
2019-09-05 12:55:10 +02:00
Thomas Patzke
3b1cbe529e
Elasticsearch keyword field name blacklisting with wildcards
2019-09-05 12:38:32 +02:00
Thomas Patzke
afe6668fbd
Merge pull request #438 from duzvik/master
...
Escaped '\*' to '\*' where required
2019-09-05 10:57:25 +02:00
Thomas Patzke
2a60c71b9d
Merge pull request #437 from svent/qradar_regex_modifier
...
QRadar backend: add support for re type modifiers
2019-09-05 10:30:18 +02:00
Thomas Patzke
f9f5558ae1
Merge pull request #392 from TareqAlKhatib/shim
...
Fixed commandline to detect any shim install from any location
2019-09-05 10:28:50 +02:00
Thomas Patzke
de5e2045f0
Merge pull request #428 from stevengoossensB/master
...
AQL field selection from signatures
2019-09-05 10:28:02 +02:00
Thomas Patzke
37e179b6a7
Merge pull request #390 from juju4/devel-sumo2
...
sumologic backend: fix index and full mapping coverage
2019-09-05 10:27:19 +02:00
ecco
bdf8f99fdb
fix typo
2019-09-04 11:31:00 -04:00
Florian Roth
7bef822da7
rule: minor improvement to susp ps enc cmd
2019-09-04 16:31:49 +02:00
Denys Iuzvyk
774be4d008
Escaped '\*' to '\*' where required
2019-09-04 14:05:58 +03:00
svent
467c8f694c
QRadar backend: add support for re type modifiers
2019-09-03 22:55:48 +02:00
ecco
fc89804f34
rule: impacket framework lateralization detection
2019-09-03 10:28:59 -04:00
Florian Roth
03d45d57de
rule: emissary panda activity
2019-09-03 15:35:33 +02:00
Florian Roth
3a29835221
Merge pull request #433 from EccoTheFlintstone/master
...
add comcvcs.dll memdump method
2019-09-02 14:13:24 +02:00
ecco
8cad0c638e
add comcvcs.dll memdump method
2019-09-02 07:49:19 -04:00
Florian Roth
dca5a7a248
Merge pull request #432 from EccoTheFlintstone/master
...
add/modify powershell Empire rules
2019-09-02 11:40:36 +02:00
