Florian Roth
|
1e76fc38dc
|
Merge pull request #1647 from frack113/fix_windows_field_name
fix invalid windows fields name
|
2021-07-07 10:03:15 +02:00 |
|
frack113
|
bb970de5b7
|
fix invalid fields name
|
2021-07-07 09:05:00 +02:00 |
|
Florian Roth
|
bcf2bf2e4d
|
Merge pull request #1635 from frack113/fix_win_susp_failed_logons_single_source_kerberos
Fix invalid field name
|
2021-07-06 14:35:06 +02:00 |
|
Florian Roth
|
ff0f1a0222
|
Merge pull request #1633 from leegengyu/art_convert_yaml_to_md
Convert ART reference links from .yaml to .md
|
2021-07-06 13:39:37 +02:00 |
|
frack113
|
12fb71b83b
|
fix invalid field name
|
2021-07-06 12:53:38 +02:00 |
|
leegengyu
|
1f19f79da9
|
Convert ART reference links from .yaml to .md
|
2021-07-06 17:56:38 +08:00 |
|
Florian Roth
|
705415c2bd
|
Merge pull request #1632 from frack113/process_creation_OriginalFileName
change OriginalFilename case
|
2021-07-06 11:45:21 +02:00 |
|
leegengyu
|
3791ab4b12
|
Updated ART reference links from .yaml to .md
|
2021-07-06 17:43:20 +08:00 |
|
leegengyu
|
69d5d9734d
|
Updated ART reference links from .yaml
|
2021-07-06 17:39:25 +08:00 |
|
leegengyu
|
5eb9547d5b
|
Updated ART reference links from .yaml to .md and sub-technique links.
|
2021-07-06 17:30:57 +08:00 |
|
leegengyu
|
7557732ca2
|
Updated ART reference links from .yaml to .md and sub-technique links.
|
2021-07-06 17:21:22 +08:00 |
|
Florian Roth
|
8beb70e970
|
Merge pull request #1631 from leegengyu/patch-5
Update mordordatasets links
|
2021-07-06 10:45:15 +02:00 |
|
Florian Roth
|
223ae079ea
|
Merge pull request #1627 from SigmaHQ/rule-devel
rule: PrinterNightmare Mimikatz update
|
2021-07-06 10:44:48 +02:00 |
|
Florian Roth
|
e31f0c8f7f
|
Merge pull request #1628 from d4rk-d4nph3/master
Added and updated Defender's tamper related rules
|
2021-07-06 10:44:33 +02:00 |
|
Florian Roth
|
17f7bbc063
|
Merge pull request #1630 from frack113/fix_childimage
childimage do not exist in sysmon schema
|
2021-07-06 10:44:00 +02:00 |
|
Florian Roth
|
86bd175bac
|
Merge pull request #1629 from leegengyu/patch-4
Update win_mal_service_installs.yml - Add service & event ID
|
2021-07-06 10:43:33 +02:00 |
|
Florian Roth
|
229f49f24a
|
Merge pull request #1581 from BlackB0lt/patch-5
Create aws_securityhub_disable_finding.yml
|
2021-07-06 10:42:59 +02:00 |
|
leegengyu
|
5d10cc68da
|
Update mordordatasets references
|
2021-07-06 16:35:20 +08:00 |
|
G Y
|
7f15b0a075
|
Update win_smb_file_creation_admin_shares.yml - Dead link
Updated dead link.
|
2021-07-06 16:24:02 +08:00 |
|
frack113
|
cfccdea28e
|
change OriginalFilename case
|
2021-07-06 10:09:47 +02:00 |
|
G Y
|
aab65361da
|
Update rules/windows/builtin/win_mal_service_installs.yml
Add modified date.
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
|
2021-07-06 00:50:23 -07:00 |
|
frack113
|
9c94cf42fe
|
childimage do not exist in sysmon schema
|
2021-07-06 09:26:43 +02:00 |
|
G Y
|
a0407cf477
|
Update win_mal_service_installs.yml - Add new Event ID
Added event ID 4697, which is equivalent to existing event ID 7045.
|
2021-07-06 12:11:32 +08:00 |
|
G Y
|
c01ec60e7d
|
Update win_mal_service_installs.yml - Add new service
Add new malicious service (javamtsup) by APT29 and add reference links.
|
2021-07-06 11:03:08 +08:00 |
|
Bhabesh Rai
|
3bc6532049
|
Added and updated Defender's tamper related rules
|
2021-07-05 20:30:07 +05:45 |
|
Florian Roth
|
e5849a08f1
|
rule: PrinterNightmare Mimikatz update
51dc7c0363 (diff-cf4373b6c7195386ac1973681e5561bd96e1bb9e099cfd3febd1111e986bd17cL1450-R1451)
|
2021-07-05 15:29:52 +02:00 |
|
Florian Roth
|
4b487f49fc
|
Merge pull request #1624 from frack113/fix_pr_869
Fix PR 869
|
2021-07-05 15:26:50 +02:00 |
|
Florian Roth
|
0da297dbef
|
Merge pull request #1626 from frack113/description_is_null
fix missing description
|
2021-07-05 15:26:31 +02:00 |
|
Florian Roth
|
8069b53e5e
|
Merge pull request #1625 from SigmaHQ/rule-devel
Kaseya patterns, PrinterNightmare Mimikatz update
|
2021-07-05 13:29:23 +02:00 |
|
frack113
|
0245d58065
|
fix missing description
|
2021-07-05 12:56:05 +02:00 |
|
Florian Roth
|
6c4f36c473
|
fix: minor typo - no \ at the end of the expression
|
2021-07-05 12:05:57 +02:00 |
|
Florian Roth
|
7e9d6600eb
|
rule: PrinterNightmare - new mimikatz printer name
|
2021-07-05 12:03:56 +02:00 |
|
Florian Roth
|
7fab22ddc2
|
rule: more Kaseya patterns
|
2021-07-05 12:03:35 +02:00 |
|
frack113
|
d05f3efd1b
|
fix pr 869
|
2021-07-04 19:44:50 +02:00 |
|
Florian Roth
|
d101c9893a
|
Merge pull request #1623 from SigmaHQ/rule-devel
rule: mimikatz printernightmare
|
2021-07-04 14:28:44 +02:00 |
|
Florian Roth
|
400fae4dba
|
Merge pull request #1609 from cianmcgovern/graylog-fix
Escape spaces in graylog backend
|
2021-07-04 14:20:07 +02:00 |
|
Florian Roth
|
1e152bf594
|
Merge pull request #1615 from leegengyu/patch-1
Update powershell_data_compressed.yml - Outdated link
|
2021-07-04 14:19:55 +02:00 |
|
Florian Roth
|
062198550d
|
Merge pull request #1620 from leegengyu/patch-2
Update win_susp_sdelete.yml - Outdated Link and Typo
|
2021-07-04 14:19:31 +02:00 |
|
Florian Roth
|
4de3378e5a
|
Merge pull request #1621 from leegengyu/patch-3
Update sysmon_susp_pfx_file_creation.yml - Typo
|
2021-07-04 14:19:18 +02:00 |
|
Florian Roth
|
3d47fec2d8
|
Merge pull request #1622 from frack113/elastalert_issue
Change getRuleName() to get 'id-title' instead of ('id' or 'title')
|
2021-07-04 14:19:02 +02:00 |
|
Florian Roth
|
fd5b7506d1
|
refactor: changed rule contents, removed eventIDs
|
2021-07-04 14:03:28 +02:00 |
|
Florian Roth
|
62b25cadf1
|
rule: mimikatz printernightmare
|
2021-07-04 13:47:56 +02:00 |
|
frack113
|
8fd81acee4
|
Change getRuleName() to get 'id-title' instead of ('id' or 'title')
|
2021-07-04 11:56:59 +02:00 |
|
G Y
|
a60a2feb17
|
Update sysmon_susp_pfx_file_creation.yml
Fixed typo.
|
2021-07-04 10:38:53 +08:00 |
|
G Y
|
268c97f23a
|
Update win_susp_sdelete.yml
Update old links and typo.
|
2021-07-04 09:53:23 +08:00 |
|
G Y
|
c63439e74d
|
Update powershell_data_compressed.yml
Changed reference link from `.yaml` to `.md`.
|
2021-07-04 08:15:29 +08:00 |
|
Florian Roth
|
a02b7a2390
|
Merge pull request #1617 from SigmaHQ/rule-devel
rule: REvil Kaseya patterns
|
2021-07-03 17:32:18 +02:00 |
|
Florian Roth
|
d188932748
|
Merge pull request #1616 from frack113/update_win_renamed_powershell.yml
Tune detection in win_renamed_powershell.yml
|
2021-07-03 17:04:52 +02:00 |
|
Florian Roth
|
48621d68ff
|
Merge pull request #1613 from leegengyu/powershell_powerview_malicious_commandlets_additions
Update powershell_powerview_malicious_commandlets.yml - Addition and Miscellaneous
|
2021-07-03 17:04:29 +02:00 |
|
Florian Roth
|
1d82ac50e4
|
refactor: additional pattern, extended description
|
2021-07-03 17:03:40 +02:00 |
|