Florian Roth
fe80ae7885
Rule: Linux auditd 'program execution in suspicious folders'
2018-01-23 11:13:23 +01:00
Florian Roth
228ca1b765
Rule: Linux auditd 'suspicious commands'
2018-01-23 11:13:23 +01:00
Florian Roth
379b2dd207
New recon activity rule
2017-12-11 09:31:54 +01:00
Florian Roth
8e2aef035c
Removed commands - false positive reduction
2017-12-11 09:31:54 +01:00
Florian Roth
1464ab4ab8
Renamed rule: recon activity > net recon activity - to be more specific
2017-12-11 09:31:54 +01:00
Florian Roth
285f5bab4f
Removed duplicate string
2017-12-11 09:31:54 +01:00
Thomas Patzke
9adaf4c411
Cleanup
2017-12-07 16:21:02 +01:00
Björn Kimminich
8a8387c43e
SQL Injection error message patterns
...
Rule file that detects error messages from different DB providers that would occur during SQL Injection probing
2017-11-27 22:52:17 +01:00
Florian Roth
78854b79c4
Rule: System File Execution Location Anomaly
2017-11-27 14:09:22 +01:00
Florian Roth
93fbc63691
Rule to detect droppers exploiting CVE-2017-11882
2017-11-23 00:58:31 +01:00
Thomas Patzke
2ec5919b9e
Fixed win_disable_event_logging by multiline description
2017-11-19 22:49:40 +01:00
Nate Guagenti
a796ff329e
Create win_disable_event_logging
2017-11-15 21:56:30 -05:00
Florian Roth
3a378f08ea
Bugfix in Adwind rule - typo in typo
2017-11-10 12:51:54 +01:00
Florian Roth
6e4e857456
Improved Adwind Sigma rule
2017-11-10 12:39:08 +01:00
Florian Roth
57d56dddb7
Improved Adwind RAT rule
2017-11-09 18:53:46 +01:00
Florian Roth
b558f5914e
Added reference to Tom Ueltschie's slides
2017-11-09 18:30:50 +01:00
Florian Roth
781db7404e
Updated Adwind RAT rule
2017-11-09 18:28:27 +01:00
Florian Roth
970f01f9f2
Renamed file for consistency
2017-11-09 15:43:32 +01:00
Florian Roth
a042105aa1
Rule: Adwind RAT / JRAT javaw.exe process starts in AppData folder
2017-11-09 15:43:32 +01:00
Florian Roth
a0ac61229c
Rule: Detect plugged USB devices
2017-11-09 08:40:46 +01:00
Florian Roth
fd801a61a5
Bronze Butler Daserf malware User Agents in Proxy Logs
2017-11-08 12:52:11 +01:00
Florian Roth
e5383be163
Rule: Proxy suspicious downloads from Dyndns hosts
2017-11-08 11:32:30 +01:00
Florian Roth
4540088aa9
Rule: Extended proxy suspicious TLD white list rule
2017-11-08 00:38:26 +01:00
Florian Roth
ad53cc7cc2
Rule: Sysmon Turla Commands
2017-11-08 00:33:17 +01:00
Florian Roth
acc430c4b6
Rule: Proxy download from blacklisted TLDs
2017-11-07 14:03:16 +01:00
Florian Roth
58f20d3cfb
Rule: Proxy download whitelist bugfix and improvements
2017-11-07 14:02:56 +01:00
Florian Roth
59e5b3b999
Sysmon: Named Pipe detection for APT malware
2017-11-06 14:24:42 +01:00
Florian Roth
ea840632f3
Sysmon: Named Pipe detection for Turla malware by @markus_neis
2017-11-06 14:22:09 +01:00
Florian Roth
37cea85072
Rundll32.exe suspicious network connections
2017-11-04 14:44:30 +01:00
Thomas Patzke
5035c9c490
Converted Windows 4688-only rules into 4688 and Sysmon/1 collections
2017-11-01 22:12:14 +01:00
Thomas Patzke
f3a809eb00
Improved admin logon rules and removed duplicates
2017-11-01 21:33:01 +01:00
Thomas Patzke
0055eedb83
Merge pull request #54 from juju4/CAR-2016-04-005b
...
Admin user remote login
2017-11-01 21:22:09 +01:00
Thomas Patzke
613f922976
Merge pull request #43 from juju4/master
...
New rules
2017-11-01 21:21:30 +01:00
Thomas Patzke
118e8af738
Simplified rule collection
2017-11-01 10:00:35 +01:00
Thomas Patzke
732f01878f
Sigma rule collection YAML action documents
2017-11-01 00:17:55 +01:00
Thomas Patzke
d0b2bd9875
Multiple rules per file
...
* New wrapper class SigmaCollectionParser parses all YAML documents
contained in file and handles multiple SigmaParser instantiation.
* Exemplary extended one security/4688 rule to security/4688 + sysmon/1
2017-10-31 23:06:18 +01:00
Thomas Patzke
9d96a998d7
Merge pull request #56 from juju4/CAR-2013-05-002b
...
Detects Suspicious Run Locations - MITRE CAR-2013-05-002
2017-10-30 00:27:56 +01:00
Thomas Patzke
720c992573
Dropped within keyword
...
Covered by timeframe attribute.
Fixes issue #26 .
2017-10-30 00:25:56 +01:00
Thomas Patzke
c865b0e9a8
Removed within keyword in rule
2017-10-30 00:15:01 +01:00
Thomas Patzke
0df60fe004
Merge branch 'CAR-2013-04-002b' of https://github.com/juju4/sigma into juju4-CAR-2013-04-002b
2017-10-30 00:13:21 +01:00
Thomas Patzke
27227855b5
Merge branch 'devel-sigmac'
2017-10-29 23:59:49 +01:00
Thomas Patzke
012cb6227f
Added proper handling of null/not null values
...
Fixes issue #25
2017-10-29 23:57:39 +01:00
juju4
4b64fc1704
double quotes = escape
2017-10-29 14:42:40 -04:00
juju4
07185247cb
double quotes = escape
2017-10-29 14:32:52 -04:00
juju4
f5f20c3f75
Admin user remote login
2017-10-29 14:30:11 -04:00
juju4
19dd69140b
Detects Suspicious Run Locations - MITRE CAR-2013-05-002
2017-10-29 14:27:01 -04:00
juju4
ad27a0a117
Detects Quick execution of a series of suspicious commands - MITRE CAR-2013-04-002
2017-10-29 14:24:53 -04:00
juju4
9d968de337
Merge remote-tracking branch 'upstream/master'
2017-10-29 14:14:47 -04:00
Florian Roth
b7e8000ccb
Improved Office Shell rule > added 'schtasks.exe'
2017-10-25 23:53:45 +02:00
Florian Roth
e680da1b50
Suspicious flash player download location / BadRabbit
2017-10-25 08:40:30 +02:00
Florian Roth
801d739a3b
US CERT TA17-293A report - renamed PsExec execution
2017-10-22 12:55:26 +02:00
Florian Roth
d9f933fec9
Fixed the fixed PSAttack rule
2017-10-19 09:52:40 +02:00
Florian Roth
0b0435bf7a
Fixed PSAttack rule
2017-10-18 21:49:38 +02:00
Thomas Patzke
d7c659128c
Removed unneeded array
2017-10-18 15:12:29 +02:00
Florian Roth
deea224421
Rule: New RUN Key Pointing to Suspicious Folder
2017-10-17 16:19:56 +02:00
juju4
e6661059c2
Merge remote-tracking branch 'upstream/master'
2017-10-15 11:58:01 -04:00
Florian Roth
00baa4ed40
Executables Started in Suspicious Folder
2017-10-14 23:23:04 +02:00
Florian Roth
358d1ffba0
Executables Started in Suspicious Folder
2017-10-14 23:22:20 +02:00
juju4
45aea1cc8a
Merge remote-tracking branch 'upstream/master'
2017-10-07 15:00:23 -04:00
Florian Roth
f4720d5149
APT17 malware UA
...
https://twitter.com/cyb3rops/status/915135877709549568
2017-10-03 12:47:53 +02:00
Thomas Patzke
8ea18af5f9
Merge branch 'master' of https://github.com/Neo23x0/sigma
2017-09-17 00:33:47 +02:00
Thomas Patzke
9b65f250a8
Renamed rule file (typo)
2017-09-17 00:32:57 +02:00
Thomas Patzke
6b8a5aea4a
Added vhost field to web rules
2017-09-17 00:20:17 +02:00
juju4
cbde0ee5e5
Merge remote-tracking branch 'upstream/master'
2017-09-16 10:03:18 -04:00
Florian Roth
20f9dbb31c
CVE-2017-8759 - Winword.exe > csc.exe
2017-09-15 15:49:56 +02:00
Thomas Patzke
986c9ff9b7
Added field names to first rules
2017-09-12 23:54:04 +02:00
Thomas Patzke
5c465129bd
Fixed rules
...
* Replaced unspecified logsource attribute 'type' with 'category'
* Usage of service 'auth' for linux logs
2017-09-11 00:35:52 +02:00
Thomas Patzke
68cb5e8921
Merge pull request #45 from secman-pl/patch-1
...
Update sysmon_susp_regsvr32_anomalies to detect wscript child process
2017-09-10 22:52:37 +02:00
juju4
e2213347ad
Merge remote-tracking branch 'upstream/master'
2017-09-09 11:33:18 -04:00
Florian Roth
bfe8378455
Rule: Suspicious svchost.exe process
2017-08-31 11:07:45 +02:00
secman-pl
9768f275d0
Update sysmon_susp_regsvr32_anomalies
...
Rule to detect COM scriptlet invocation when wscript.exe is spawned from regsvr32.exe.
example: https://www.hybrid-analysis.com/sample/f34da6d84a9663928606894fbc494cd9bf2f03c98cf0c775462802558d3a50ef?environmentId=100
SCT script code:
var objShell = new ActiveXObject("WScript.shell");
2017-08-29 12:21:47 +02:00
Florian Roth
f3f2c14b3a
Added reference to regsvr32 rule
2017-08-29 08:45:29 +02:00
Florian Roth
55f4c37e22
Rule: Microsoft Binary Github Communication
2017-08-24 18:27:40 +02:00
Florian Roth
f46e86fbb1
WMI persistence modified
2017-08-24 18:27:40 +02:00
Hans-Martin Münch
09e754a8f9
Small Typo fix
2017-08-22 10:56:25 +02:00
Florian Roth
59821d1bcb
Office Shell: Reference added to new entry
2017-08-22 10:04:22 +02:00
Florian Roth
332f7d27da
Win WMI Persistence
...
http://blog.trendmicro.com/trendlabs-security-intelligence/cryptocurrency-miner-uses-wmi-eternalblue-spread-filelessly/
https://twitter.com/mattifestation/status/899646620148539397
2017-08-22 10:02:54 +02:00
Florian Roth
8f4a780c3b
Added regsvr32.exe to suspicious child processes
2017-08-20 23:14:41 +02:00
Florian Roth
e06cf6c43f
Service install - net user persistence
2017-08-16 15:16:57 +02:00
juju4
b109a1277e
Detects suspicious process related to rasdial.exe
2017-08-13 16:20:25 -04:00
juju4
012ed4cd7d
Detects execution of executables that can be used to bypass Applocker whitelisting
2017-08-13 16:20:01 -04:00
juju4
f861969e95
tentative rule to detect admin users remote login
2017-08-13 16:19:24 -04:00
juju4
d2ae98b0de
tentative rule to detect admin users interactive login
2017-08-13 16:18:58 -04:00
juju4
21b1c52d1e
forfiles, bash detection
2017-08-13 16:18:13 -04:00
Thomas Patzke
238f27fa0d
Added OperationalError to relevant Python DB exceptions
2017-08-13 00:10:00 +02:00
Thomas Patzke
33b2ff16cf
Rule for generic Python SQL exceptuons
...
according to PEP 249
2017-08-12 00:44:18 +02:00
Thomas Patzke
7ba62b791c
Application security rules
...
* reorganization into separate folder
* adding category
* minor tweaks
2017-08-12 00:43:10 +02:00
Thomas Patzke
1d3b8e58bd
Fixed description
2017-08-06 23:22:31 +02:00
Thomas Patzke
0795d14b41
Spring framework security exceptions rule
2017-08-06 23:21:53 +02:00
Thomas Patzke
f0e6c28e8b
Added Ruby on Rails security-related exceptions rule
2017-08-06 22:57:52 +02:00
Thomas Patzke
98f99cebc0
Added author attribute
2017-08-05 23:56:13 +02:00
Thomas Patzke
f58c1b768b
Django security errors
2017-08-05 00:56:05 +02:00
Thomas Patzke
4578756cfd
Merge remote-tracking branch 'origin/master'
2017-08-05 00:35:24 +02:00
Thomas Patzke
03985288f6
Removed 'last' from timeframe
2017-08-05 00:32:24 +02:00
Florian Roth
edb52e098a
Extended hh.exe in Office Shell detection
...
https://www.hybrid-analysis.com/sample/6abc2b63f1865a847ff7f5a9d49bb944397b36f5503b9718d6f91f93d60f7cd7?environmentId=100
2017-08-04 09:18:55 +02:00
Thomas Patzke
d17604d007
Merge branch 'master' into travis-test
2017-08-03 00:11:08 +02:00
Thomas Patzke
36212fd5c2
Merge branch 'devel-sigmac'
2017-08-03 00:10:37 +02:00
Thomas Patzke
5706361464
Parsing of "near ... within" aggregation operator
...
* Operator is only parsed. No processing or passing of parsed data to
backends.
* Changed rule sysmon_mimikatz_inmemory_detection.yml accordingly.
2017-08-03 00:05:48 +02:00
Thomas Patzke
7706067540
Merge branch 'master' into travis-test
2017-08-02 23:32:40 +02:00
Thomas Patzke
27e5d0c2b4
Fixed further parse error
2017-08-02 23:32:00 +02:00
Thomas Patzke
167b1f0191
Merge branch 'master' into travis-test
2017-08-02 22:53:52 +02:00
Thomas Patzke
f768bf3d61
Fixed parse errors
2017-08-02 22:49:15 +02:00
Thomas Patzke
bfcc119a7f
Merge branch 'master' into travis-test
2017-08-02 00:37:07 +02:00
Thomas Patzke
b82a6fdc51
Added wildcards to windows/builtin/win_susp_rundll32_activity.yml
2017-08-02 00:09:34 +02:00
Thomas Patzke
84418d2045
Merged builtin/win_susp_certutil_activity.yml with Sysmon rule
2017-08-02 00:04:28 +02:00
Thomas Patzke
c350a90b21
Merge branch 'master' into rules-juju4
2017-08-01 23:55:53 +02:00
juju4
5b778c9833
yamllint: quote twitter-formatted nickname
2017-07-30 11:42:25 -04:00
juju4
5b42c64fcd
Merge remote-tracking branch 'upstream/master'
2017-07-30 11:12:03 -04:00
juju4
31b033d492
suspicious rundll32 activity rules
2017-07-30 11:11:45 -04:00
juju4
3a8946a3ac
suspicious phantom dll rules
2017-07-30 11:11:17 -04:00
juju4
fbbf29fd80
suspicious cli escape character rules
2017-07-30 11:10:43 -04:00
juju4
83fa83aa43
suspicious certutil activity rules
2017-07-30 11:09:51 -04:00
juju4
f487451c45
more suspicious cli process
2017-07-30 11:09:24 -04:00
Florian Roth
d1cdb3c480
Certutil duplicate entry and "-ping" command
2017-07-23 14:51:57 -06:00
Florian Roth
433293ea40
'ruler' User Agent
...
https://www.crowdstrike.com/blog/using-outlook-forms-lateral-movement-persistence/
2017-07-22 09:24:45 -06:00
Florian Roth
cdf0894e6a
Corrected error in certutil rules (-f means force overwrite, not file)
...
> the -urlcache is the relevant command
2017-07-20 12:54:55 -06:00
Florian Roth
3a55b31da2
certutil file download - more generic approach
2017-07-20 12:48:47 -06:00
Florian Roth
b85d96e458
certutil detections (renamed, extended)
...
see https://twitter.com/subTee/status/888102593838362624
2017-07-20 12:38:10 -06:00
Florian Roth
061d3bea27
ZxShell
2017-07-20 12:36:24 -06:00
Florian Roth
4bff14acd1
User-Agent rules split up in separate files
2017-07-08 09:59:05 -06:00
Florian Roth
eeb31964da
User-Agent Rules
2017-07-08 08:37:44 -06:00
Florian Roth
cf42847b74
Suspicious User Agent strings
2017-07-07 20:53:22 -06:00
Florian Roth
cec48ece04
Suspicious User-Agent Strings, starting with empty value
2017-07-07 18:38:32 -06:00
Florian Roth
fc4cd4036e
Linux: Suspicious VSFTPD errors
2017-07-05 18:59:51 -06:00
Florian Roth
ead63fbf75
Linux: Suspicious SSHD errors
2017-06-30 08:47:56 +02:00
Florian Roth
950a00f33e
Updated Petya rule
2017-06-28 12:52:58 +02:00
Florian Roth
ece1d7e3a8
Added perfc.dat keyword to NotPetya rule
2017-06-28 10:35:42 +02:00
Florian Roth
a3e0e37163
NotPetya Title Fixed
2017-06-28 09:12:39 +02:00
Florian Roth
8c437de970
NotPetya Sigma Rule for Sysmon Events
2017-06-28 09:09:12 +02:00
Florian Roth
8f525d2f01
Wannacry Rules Reorg and Renaming
2017-06-28 09:08:53 +02:00
Florian Roth
3f245d27f8
Eventlog cleared ID 104
2017-06-27 17:29:39 +02:00
Thomas Patzke
7fdc78c8bf
Merge pull request #36 from dim0x69/master
...
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm
2017-06-19 15:32:56 +02:00
Florian Roth
d1f1bd59da
Changed level of PsExec events to 'low'
2017-06-17 08:50:16 +02:00
Thomas Patzke
a4c9e24380
File renaming while deletion with SDelete
2017-06-14 16:55:32 +02:00
Thomas Patzke
8c06a5d83f
Access to wceaux.dll while WCE pass-the-hash login on source host
2017-06-14 15:59:45 +02:00
Thomas Patzke
4fcdcc3967
Added rule for PsExec
2017-06-12 23:57:06 +02:00
Florian Roth
576981820b
Moved PlugX rule & used builtin ID 4688 for another rule
2017-06-12 11:02:49 +02:00
Florian Roth
f85d847fa6
PlugX Detection
...
https://docs.google.com/spreadsheets/d/1f5OTQpEEvbiW-NzSfVTrzhmnZJ-hrmAZhRM7JXkDBSY/edit#gid=0
https://countuponsecurity.files.wordpress.com/2017/06/acp-search.png
2017-06-12 10:46:56 +02:00
Thomas Patzke
91b3c39c0d
Amended condition
...
Changed condition according to proposed syntax for related event matching (#4 )
2017-06-11 23:54:19 +02:00
dimi
ac95e372e5
clarification: if executed locally there is no connection to the samr pipe on IPC$. So this rule detects remote changes
2017-06-09 14:15:37 +02:00
dimi
a2a2366dfb
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm
2017-06-09 14:05:40 +02:00
Florian Roth
371b41acd9
Improved regsvr32.exe whitelisting bypass rule
...
thanks to Nick Carr https://twitter.com/ItsReallyNick/status/872409920938946560
2017-06-07 13:46:36 +02:00
Florian Roth
e5ad1b2f84
Improved regsvr32 whitelisting bypass rule
2017-06-07 12:02:55 +02:00
Florian Roth
1fd7a92e87
Regsvr32.exe anomalies (bugfix and new selection)
2017-06-07 11:43:25 +02:00
Florian Roth
21108e60a6
Fixed description and title
2017-06-03 14:53:08 +02:00
Florian Roth
ff5e6e3999
Fireball Sigma Rule
2017-06-03 14:49:06 +02:00
Florian Roth
536e328540
Pandemic Implant
2017-06-01 22:48:59 +02:00
Florian Roth
5dd3d4dd57
Generic Hacktool Use Rule
2017-05-31 08:42:35 +02:00
Florian Roth
0c222134b9
Extended malware script dropper rule
2017-05-25 14:59:16 +02:00
Florian Roth
0685e297c8
Improved Suspicious Net.exe Execution Rule
2017-05-25 12:44:56 +02:00
