229 Commits

Author	SHA1	Message	Date
Thomas Patzke	2c0e76be3d	Escaped * where required	2018-08-10 13:53:08 +02:00
Lurkkeli	7cdc13ef11	Update	2018-08-08 17:05:51 +02:00
Lurkkeli	392351af25	Adding ATT&CK tag	2018-08-08 16:43:54 +02:00
Lurkkeli	4d721f1803	Updating fps	2018-08-08 16:42:26 +02:00
Lurkkeli	b9f433414d	hiding files with attrib.exe	2018-08-08 16:19:39 +02:00
Thomas Patzke	92c0e0321a	Merge pull request #144 from samsson/patch-7 ... Added att&ck tags	2018-08-07 11:19:36 +02:00
Lurkkeli	a245820519	added att&ck tag	2018-08-07 08:54:53 +02:00
Lurkkeli	294677a2cc	added att&ck tag	2018-08-07 08:50:01 +02:00
Lurkkeli	a57e87b345	added att&ck tag	2018-08-07 08:49:05 +02:00
Lurkkeli	99253763af	added att&ck tag	2018-08-07 08:45:58 +02:00
Lurkkeli	0bff27ec21	added att&ck tactic ... added att&ck tactic, no specific techniques applicable	2018-08-07 08:37:51 +02:00
Lurkkeli	198cb63182	added att&ck tactic ... added att&ck tactic, no specific techniques applicable	2018-08-07 08:36:53 +02:00
Thomas Patzke	518e21fcd2	Merge pull request #134 from nikseetharaman/sysmon_cmstp_com_object_access ... Add CMSTP UAC Bypass via COM Object Access	2018-08-07 08:33:33 +02:00
Thomas Patzke	b9fdf07926	Extended tagging	2018-08-07 08:33:18 +02:00
Lurkkeli	b50c13dd1f	Update att&ck tag	2018-08-07 08:27:24 +02:00
Thomas Patzke	5d5d42eb9b	Merge pull request #140 from yt0ng/master ... Possible Shim Database Persistence via sdbinst.exe	2018-08-07 08:22:32 +02:00
Thomas Patzke	80eaedab8b	Fixed tag and date	2018-08-07 08:22:11 +02:00
Thomas Patzke	3509fbd201	Merge pull request #142 from samsson/patch-5 ... Added ATT&CK tag	2018-08-07 08:20:22 +02:00
Thomas Patzke	b049210641	Fixed tags	2018-08-07 08:20:09 +02:00
Lurkkeli	3456f9a74d	Update sysmon_susp_wmi_execution.yml	2018-08-07 08:19:58 +02:00
Thomas Patzke	64fa3b162d	Tag fixes	2018-08-07 08:18:16 +02:00
Lurkkeli	6472be5e19	Update sysmon_uac_bypass_sdclt.yml	2018-08-07 08:08:53 +02:00
Lurkkeli	21bee17ffd	Update sysmon_uac_bypass_eventvwr.yml	2018-08-07 08:07:49 +02:00
yt0ng	fc091fe3d7	Added ATTCK Mapping	2018-08-05 14:00:22 +02:00
yt0ng	b65cb5eaca	Possible Shim Database Persistence via sdbinst.exe	2018-08-05 13:55:04 +02:00
Nik Seetharaman	b938fdb0a3	Add CMSTP UAC Bypass via COM Object Access	2018-07-27 02:28:28 -05:00
James Dickenson	5fc118dcac	added a few mitre attack tags to windows sysmon rules	2018-07-26 21:15:07 -07:00
Florian Roth	a9fcecab88	Merge pull request #130 from samsson/patch-4 ... Fixed typo / Created a rule	2018-07-26 22:34:46 +02:00
Florian Roth	089498b0b3	Merge pull request #131 from yt0ng/master ... Possible SafetyKatz Dump of debug.bin	2018-07-25 07:41:38 +02:00
Florian Roth	dd857c4470	Cosmetics ... If it's only 1 value we write it like this to avoid it being interpreted as a list with 1 element and to avoid an extra line.	2018-07-25 07:37:17 +02:00
yt0ng	b415fc8d42	Possible SafetyKatz Dump of debug.bin ... https://github.com/GhostPack/SafetyKatz	2018-07-24 23:51:46 +02:00
Lurkkeli	0e9c5bb14a	Update sysmon_rundll32_net_connections.yml	2018-07-24 20:01:47 +02:00
Thomas Patzke	01e7675e24	Merge pull request #124 from samsson/patch-1 ... ATT&CK tagging	2018-07-24 07:58:50 +02:00
Thomas Patzke	30d255ab6f	Fixed tag	2018-07-24 07:58:25 +02:00
Lurkkeli	1898157df5	ATT&CK tagging ... Added tag for technique t1015	2018-07-23 23:57:15 +02:00
yt0ng	16160dfc80	added additional binaries and attack tactics/techniques	2018-07-23 15:47:56 +02:00
Suleyman Ozarslan	e6cbc17c12	ATT&CK tagging of Scheduled Task Creation	2018-07-22 15:56:47 +03:00
Suleyman Ozarslan	8d9b12be07	ATT&CK tagging of Default PowerSploit Schtasks Persistence	2018-07-22 15:53:56 +03:00
Suleyman Ozarslan	080892b5ab	ATT&CK tagging of MSHTA Spawning Windows Shell	2018-07-20 09:53:55 +03:00
Suleyman Ozarslan	76f277d5fe	ATT&CK tagging of Malicious Named Pipe rule	2018-07-20 09:41:54 +03:00
Suleyman Ozarslan	7e74527344	ATT&CK software tag is added to Bitsadmin Download rule	2018-07-20 09:35:35 +03:00
Florian Roth	1e61adfad1	rule: Changed Registry persistence Explorer RUN key rule	2018-07-19 16:27:19 -06:00
Florian Roth	83d6f12ce3	rule: Registry persistence in Explorer RUN key pointing to suspicious folder	2018-07-19 16:27:19 -06:00
Thomas Patzke	f98158f5ad	Further ATT&CK tagging	2018-07-19 23:36:13 +02:00
Suleyman Ozarslan	05b91847cd	ATT&CK tagging of Suspicious Certutil Command rule	2018-07-19 16:42:39 +03:00
Thomas Patzke	bdea097b80	ATT&CK tagging	2018-07-17 23:58:11 +02:00
Florian Roth	9e92b97661	Merge pull request #111 from nikseetharaman/cmstp_execution ... Add sysmon_cmstp_execution	2018-07-17 14:39:56 -06:00
Florian Roth	3f0040b983	Removed duplicate status field	2018-07-16 15:55:31 -06:00
Florian Roth	429474b6d6	Merge pull request #113 from megan201296/patch-9 ... fixed typo	2018-07-16 15:38:52 -06:00
megan201296	02ea2cf923	fixed typo	2018-07-16 16:20:33 -05:00