frack113
|
f91abf8929
|
Fix auditd is a service
|
2021-05-30 08:58:25 +02:00 |
|
Florian Roth
|
b5352ac5f7
|
fix: duplicate UUIDs
|
2021-05-27 10:29:21 +02:00 |
|
phantinuss
|
4b520de373
|
new rule detecting ld.so preload persistence by keyword
|
2021-05-05 15:12:07 +02:00 |
|
Florian Roth
|
8497c8a9e6
|
fix: linux keywords rule
|
2021-05-05 12:56:24 +02:00 |
|
Florian Roth
|
15ab1d5e8b
|
Create lnx_symlink_etc_passwd.yml
|
2021-05-05 11:55:49 +02:00 |
|
Florian Roth
|
161180c357
|
refactor: extended shellshock rule
|
2021-04-28 11:47:24 +02:00 |
|
Florian Roth
|
47504fbd56
|
fix: shellshock expression
|
2021-04-28 11:46:49 +02:00 |
|
Cedric Hien
|
bbdbab700d
|
Fix invalid logsource on lnx_system_info_discovery rule
|
2021-04-17 12:57:30 +02:00 |
|
Thomas Patzke
|
90efe974b8
|
Fixes and improvements
|
2021-04-03 00:08:55 +02:00 |
|
Anton Kutepov
|
3f45269296
|
Merge branch 'oscd'
B
B
B
B
A
|
2021-03-02 22:58:41 +03:00 |
|
Anton Kutepov
|
98cc025208
|
Renamed ProcessName field to Image for the process_creation category.
|
2021-02-25 01:57:26 +03:00 |
|
jaegeral
|
e1f43f17c2
|
fixed various spelling errors all over rules and source code
|
2021-02-24 14:43:13 +00:00 |
|
yugoslavskiy
|
fb1f04ec8a
|
Merge pull request #1249 from oscd-initiative/oscd_art_linux_task_18_T1083
[OSCD] ART sync, test T1083: File and Directory Discovery (Linux)
|
2021-02-04 22:34:47 +01:00 |
|
Florian Roth
|
2c48d2b0bb
|
fix: missing global action and sections
|
2021-02-01 20:00:06 +01:00 |
|
Bhabesh Rai
|
63e2f4bbce
|
Added rule for Sudo CVE-2021-3156 Exploitation Attempt
|
2021-02-01 23:08:45 +05:45 |
|
yugoslavskiy
|
05c91cd12f
|
Merge pull request #1238 from alx1m1k/oscd-3
[OSCD] T1030: Split A File Into Pieces - Lin/macOS
|
2021-01-06 00:33:12 +03:00 |
|
yugoslavskiy
|
057c33354a
|
Merge pull request #1237 from alx1m1k/oscd-2
[OSCD] T1027.001: Binary Padding - Lin/macOS
|
2021-01-06 00:33:05 +03:00 |
|
yugoslavskiy
|
a217a3cfc7
|
Merge pull request #1213 from alx1m1k/oscd
[OSCD] T1552.003: Suspicious history file operations - Linux/macOS
|
2021-01-06 00:21:19 +03:00 |
|
yugoslavskiy
|
e0286abb62
|
Merge pull request #1197 from w0rk3r/oscd_rules_improvement2
[OSCD] Small improvements on others rules
|
2021-01-06 00:18:36 +03:00 |
|
yugoslavskiy
|
aeb448cd4d
|
Merge pull request #1171 from alejandroortuno/network-sniffing
[OSCD] MacOS Network Sniffing
|
2021-01-06 00:15:52 +03:00 |
|
yugoslavskiy
|
ebc6451b86
|
Merge pull request #1170 from alejandroortuno/startup-items
[OSCD] MacOS Startup Items
|
2021-01-06 00:15:45 +03:00 |
|
yugoslavskiy
|
ad739f7f29
|
Merge pull request #1169 from remotephone/oscd_t1113
[OSCD] - T1113 - macOS Screencapture via builtin screencapture utility
|
2021-01-06 00:15:37 +03:00 |
|
yugoslavskiy
|
d50c081f3f
|
Merge pull request #1168 from remotephone/oscd_t1056_002
[OSCD] macOS - T1056.002 - GUI Input capture
|
2021-01-06 00:15:30 +03:00 |
|
yugoslavskiy
|
635ac44949
|
Merge pull request #1132 from remotephone/oscd_t1070_002
[OSCD] Adding t1070_002 - Clear mac system logs
|
2021-01-05 23:16:57 +03:00 |
|
yugoslavskiy
|
793d271d37
|
Merge pull request #1131 from oscd-initiative/oscd_sigma_art_macos_task_63
[OSCD] macOS hidden user creation
|
2021-01-05 23:16:36 +03:00 |
|
yugoslavskiy
|
a4101a6808
|
Merge pull request #1128 from alejandroortuno/local-group
[OSCD] Local System Groups Discovery
|
2021-01-05 23:14:47 +03:00 |
|
yugoslavskiy
|
db66f8365e
|
Merge pull request #1127 from alejandroortuno/account-creation
[OSCD] MacOS local account creation
|
2021-01-05 23:14:28 +03:00 |
|
yugoslavskiy
|
e492263a31
|
Merge pull request #1091 from alejandroortuno/sigma-local-account-rule
[OSCD] Local System Accounts Discovery
|
2021-01-05 23:10:09 +03:00 |
|
yugoslavskiy
|
d9a0f6c41a
|
Merge pull request #1090 from alejandroortuno/sigma-cron-rule
[OSCD] Scheduled Task/Job: Cron
|
2021-01-05 23:09:59 +03:00 |
|
yugoslavskiy
|
c8da05fa5d
|
Merge pull request #1086 from remotephone/oscd
[OSCD] T1016 - linux/macOS firewall enumeration
|
2021-01-05 23:09:15 +03:00 |
|
yugoslavskiy
|
caf01c57bf
|
Merge pull request #1083 from omergunal/patch-8
[OSCD] T1082: System Information Discovery - Linux
|
2021-01-05 23:08:19 +03:00 |
|
yugoslavskiy
|
e002ffa404
|
Merge pull request #1079 from omergunal/patch-6
[OSCD] T1070.004: File Deletion - Linux
|
2021-01-05 23:06:12 +03:00 |
|
yugoslavskiy
|
1939b815d6
|
Merge pull request #1078 from omergunal/patch-5
[OSCD] T1070.002: Clear Linux or Mac System Logs - Linux
|
2021-01-05 23:06:02 +03:00 |
|
yugoslavskiy
|
75feffb016
|
Merge pull request #1082 from omergunal/patch-7
[OSCD] T1201: Password Policy Discovery - Linux
|
2021-01-05 23:02:06 +03:00 |
|
yugoslavskiy
|
3ef76437e4
|
Merge pull request #1055 from omergunal/patch-2
[OSCD] Scheduled Task/Job: At
|
2021-01-05 22:59:09 +03:00 |
|
yugoslavskiy
|
f65e7100ec
|
Merge pull request #1057 from omergunal/patch-4
[OSCD] T1057: Process Discovery
|
2021-01-05 22:58:35 +03:00 |
|
yugoslavskiy
|
57947fbd39
|
Merge pull request #1044 from omergunal/patch-1
[OSCD] Linux - Install Root Certificate
|
2021-01-05 22:56:18 +03:00 |
|
yugoslavskiy
|
733277d490
|
Merge pull request #1248 from oscd-initiative/oscd_art_macos_task_28_T1083
[OSCD] ART sync, test T1083: File and Directory Discovery (macOS)
|
2021-01-05 22:55:40 +03:00 |
|
yugoslavskiy
|
f825003690
|
Merge pull request #1239 from alx1m1k/oscd-4
[OSCD] T1529: System Shutdown/Reboot - Lin/macOS
|
2021-01-05 22:55:14 +03:00 |
|
Thomas Patzke
|
9b4c1662b0
|
Merge pull request #1240 from alx1m1k/oscd-5
[OSCD] T1070.006: File Time Attribute Change - Lin/macOS
|
2020-12-30 23:00:54 +01:00 |
|
Thomas Patzke
|
1dcc56a0b0
|
Merge pull request #1241 from alx1m1k/oscd-6
[OSCD] T1552.001: Credentials In Files - Lin/macOS
|
2020-12-30 22:59:49 +01:00 |
|
Thomas Patzke
|
e0f7dc125c
|
Merge pull request #1244 from oscd-initiative/oscd_art_macos_task_3_T1027
[OSCD] ART sync, test T1027: Obfuscated Files or Information (macOS)
|
2020-12-30 22:58:26 +01:00 |
|
Thomas Patzke
|
810485993a
|
Merge pull request #1245 from oscd-initiative/oscd_art_linux_task_4_T1027
[OSCD] ART sync, test T1027: Obfuscated Files or Information (Linux)
|
2020-12-30 22:57:59 +01:00 |
|
Thomas Patzke
|
aa5396cb9f
|
Merge pull request #1246 from oscd-initiative/oscd_art_macos_task_14_T1049
[OSCD] ART sync, test T1049: System Network Connections Discovery (macOS)
|
2020-12-30 22:57:29 +01:00 |
|
Thomas Patzke
|
fb9698345b
|
Merge pull request #1247 from oscd-initiative/oscd_art_linux_task_8__T1049
[OSCD] ART sync, test T1049: System Network Connections Discovery (Linux)
|
2020-12-30 22:57:11 +01:00 |
|
Thomas Patzke
|
6a7991ee96
|
Merge pull request #1250 from oscd-initiative/oscd_art_macos_task_41_T1518.001
[OSCD] ART sync, test T1518.001: Security Software Discovery (macOS)
|
2020-12-30 22:41:18 +01:00 |
|
Thomas Patzke
|
a88c853237
|
Merge pull request #1251 from oscd-initiative/oscd_art_linux_task_26_T1518.001
[OSCD] ART sync, test T1518.001: Security Software Discovery (Linux)
|
2020-12-30 22:40:32 +01:00 |
|
Thomas Patzke
|
436fd37655
|
Merge pull request #1252 from oscd-initiative/oscd_art_macos_task_55_T1553.001
[OSCD] ART sync, test T1553.001: Gatekeeper Bypass (macOS)
|
2020-12-30 22:39:36 +01:00 |
|
Thomas Patzke
|
5de952d488
|
Merge pull request #1253 from oscd-initiative/oscd_art_macos_task_60_T1562.001
[OSCD] ART sync, test T1562.001: Disable or Modify Tools (macOS)
|
2020-12-30 22:39:15 +01:00 |
|
Thomas Patzke
|
e223d34a6e
|
Merge pull request #1257 from alejandroortuno/service-scanning
[OSCD] Network Service Scanning
|
2020-12-30 22:35:47 +01:00 |
|