1708 Commits

Author	SHA1	Message	Date
leegengyu	1f19f79da9	Convert ART reference links from .yaml to .md	2021-07-06 17:56:38 +08:00
leegengyu	69d5d9734d	Updated ART reference links from .yaml	2021-07-06 17:39:25 +08:00
leegengyu	5eb9547d5b	Updated ART reference links from .yaml to .md and sub-technique links.	2021-07-06 17:30:57 +08:00
leegengyu	7557732ca2	Updated ART reference links from .yaml to .md and sub-technique links.	2021-07-06 17:21:22 +08:00
Florian Roth	8069b53e5e	Merge pull request #1625 from SigmaHQ/rule-devel ... Kaseya patterns, PrinterNightmare Mimikatz update	2021-07-05 13:29:23 +02:00
Florian Roth	7fab22ddc2	rule: more Kaseya patterns	2021-07-05 12:03:35 +02:00
Florian Roth	a02b7a2390	Merge pull request #1617 from SigmaHQ/rule-devel ... rule: REvil Kaseya patterns	2021-07-03 17:32:18 +02:00
Florian Roth	1d82ac50e4	refactor: additional pattern, extended description	2021-07-03 17:03:40 +02:00
Florian Roth	57b816f49d	rule: REvil Kaseya patterns	2021-07-03 16:34:02 +02:00
frack113	02100f1a3c	Tune detection in win_renamed_powershell.yml	2021-07-03 15:18:01 +02:00
frack113	895a2f6154	fix 3 times the same name file	2021-07-02 11:01:07 +02:00
Florian Roth	9899dd9b82	Merge pull request #1579 from frack113/fix_pr_1022 ... Fix file from PR 1022	2021-06-29 12:51:08 +02:00
Florian Roth	863941bff5	Merge pull request #1586 from BlackB0lt/patch-7 ... Update sysmon_rclone_execution.yml	2021-06-29 12:46:24 +02:00
Florian Roth	1425ede905	Merge pull request #1588 from SigmaHQ/rule-devel ... CVE-2021-1675 Print Spooler Exploitation	2021-06-29 12:31:37 +02:00
Sittikorn S	56004fc49b	Update sysmon_rclone_execution.yml ... Add RClone Command that used by DarkSide malware	2021-06-29 13:44:03 +07:00
Florian Roth	9e3caf4ceb	refactor: non-interactive Powershell to "low"	2021-06-28 16:38:34 +02:00
Florian Roth	f4ac416ef4	Merge pull request #1582 from SigmaHQ/rule-devel ... Rule devel	2021-06-28 11:36:21 +02:00
Florian Roth	d1f1e8e7c4	rule: reg add run key	2021-06-28 09:39:12 +02:00
Florian Roth	ab0502f893	refactor: add wscript.exe to mshta rule	2021-06-28 09:39:04 +02:00
Florian Roth	d48009748f	rule: mshta shell spawn	2021-06-28 09:32:28 +02:00
Florian Roth	e7d9f1b427	Merge pull request #1577 from austinsonger/master ... Update win_susp_disable_eventlog.yml	2021-06-28 08:46:17 +02:00
Florian Roth	faf5e4a514	Update win_run_virtualbox.yml	2021-06-28 08:42:09 +02:00
Austin Songer	8e6ab7fd79	Update win_susp_disable_eventlog.yml	2021-06-28 00:59:53 -05:00
Austin Songer	bfe969f071	Update win_susp_disable_eventlog.yml	2021-06-28 00:53:52 -05:00
Austin Songer	d1fba0e1a5	Update win_susp_disable_eventlog.yml	2021-06-27 20:26:44 -05:00
frack113	e096b853cf	Fix file from PR 1022	2021-06-27 18:24:56 +02:00
wagga40	d6afa46e68	Added missing "modified" fields. Removed trailing wildcard.	2021-06-27 17:36:32 +02:00
wagga40	d6c430408f	Removed duplicate field	2021-06-27 15:54:26 +02:00
wagga40	3f0dd2417b	Removed Drive letter before "Users" directory	2021-06-27 15:32:46 +02:00
wagga40	11df697cdc	Updated rules with modifiers instead of '*' and remove trailing '\\'	2021-06-27 14:51:29 +02:00
Austin Songer	f1d937cbd6	Update win_susp_disable_eventlog.yml	2021-06-26 12:22:54 -05:00
Austin Songer	de6fac1d18	Update win_susp_disable_eventlog.yml	2021-06-26 03:15:05 -05:00
Florian Roth	537d89d185	Merge pull request #1575 from SigmaHQ/rule-devel ... rules: PurpleSharp, WMIC ActiveScriptEventConsumer	2021-06-25 12:15:35 +02:00
Florian Roth	7b6208c05c	rules: PurpleSharp, WMIC ActiveScriptEventConsumer	2021-06-25 09:56:42 +02:00
Andreas Hunkeler	3de0679d5a	Add fp note to PortProxy rules	2021-06-24 11:22:41 +02:00
Florian Roth	1dd557e543	fix: global action unneeded	2021-06-23 09:23:08 +02:00
Sittikorn S	c0724e533f	Update and rename win_renamed_meg.yml to win_renamed_megasync.yml	2021-06-23 09:24:42 +07:00
Sittikorn S	a310806dbf	Update win_renamed_meg.yml	2021-06-23 08:35:12 +07:00
Sittikorn S	10488512ae	Update win_renamed_meg.yml	2021-06-22 22:27:34 +07:00
Sittikorn S	177442d6df	Update win_renamed_meg.yml	2021-06-22 22:20:49 +07:00
Sittikorn S	6328ce8ef6	Update win_renamed_meg.yml	2021-06-22 22:17:51 +07:00
Sittikorn S	f55cd9ed1b	Update win_renamed_meg.yml	2021-06-22 22:03:56 +07:00
Sittikorn S	268a4c31e3	Update win_renamed_meg.yml ... Change mitre tags T1218.001 to T1218	2021-06-22 22:00:35 +07:00
Sittikorn S	e6d08d0ad6	Update win_renamed_meg.yml	2021-06-22 21:55:09 +07:00
Sittikorn S	a08b6c4e0a	Create win_renamed_meg.yml	2021-06-22 21:50:07 +07:00
Florian Roth	7e748fa91a	Merge pull request #1567 from BlackB0lt/patch-2 ... Create win_script_event_consumer_spawn new rule	2021-06-22 12:43:34 +02:00
Sittikorn S	d9a749eec0	Update and rename win_script_event_consumer_spawn to win_script_event_consumer_spawn.yml	2021-06-22 16:35:46 +07:00
Florian Roth	cbe97206de	fix: several indentation issues, casing in tags	2021-06-22 11:03:17 +02:00
Andreas Hunkeler	cd0b46ab62	rule: add port proxy registry rule and add references	2021-06-22 08:16:56 +02:00
Sittikorn S	1bcac7b04a	Create win_script_event_consumer_spawn	2021-06-21 21:20:39 +07:00