yt0ng
eda6f3b9ca
rules/windows/sysmon/sysmon_powershell_DLL_execution.yml
2018-08-25 16:33:54 +02:00
yt0ng
c7d4b4853d
removing sysmon_powershell_AMSI_bypass.yml
2018-08-23 10:17:19 +02:00
Thomas Patzke
49af499353
Merge pull request #151 from nikseetharaman/workflow_compiler
...
Add Microsoft Workflow Compiler Sysmon Detection
2018-08-23 08:24:35 +02:00
Thomas Patzke
9235175e26
Fixed rule
...
* Added condition
* Replaced Description wirh Image attribute and improved search pattern
2018-08-23 08:20:28 +02:00
Thomas Patzke
73535e58a5
Merge pull request #153 from megan201296/patch-10
...
Add ATT&CK Matrix tags
2018-08-23 08:06:58 +02:00
Thomas Patzke
d647a7de07
Merge pull request #154 from megan201296/patch-11
...
Add MITRE ATT&CK tagging
2018-08-23 08:06:39 +02:00
Florian Roth
040ba0338d
fix: Added Event ID in second selection
2018-08-22 17:03:13 +02:00
megan201296
3f5c32c6da
Add MITRE ATT&CK tagging
2018-08-22 09:35:06 -05:00
megan201296
76aabe7e05
Add ATT&CK Matrix tags
2018-08-22 09:30:55 -05:00
Nik Seetharaman
e371d945ed
Add Microsoft Workflow Compiler Sysmon Detection
2018-08-18 00:53:28 -05:00
yt0ng
ca7e8d6468
removing for new pull request
2018-08-17 18:42:10 +02:00
yt0ng
5bb6f566ba
::Merge remote-tracking branch 'upstream/master'
2018-08-17 18:39:36 +02:00
yt0ng
8ecf167e85
Powershell AMSI Bypass via .NET Reflection
...
[Ref].Assembly.GetType('http://System.Management .Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
seen in recent activity https://www.hybrid-analysis.com/sample/0ced17419e01663a0cd836c9c2eb925e3031ffb5b18ccf35f4dea5d586d0203e?environmentId=120
2018-08-17 18:26:04 +02:00
Thomas Patzke
2715c44173
Converted first Sysmon rule to generic process_execution rule
2018-08-14 21:34:54 +02:00
Thomas Patzke
2c0e76be3d
Escaped * where required
2018-08-10 13:53:08 +02:00
Lurkkeli
7cdc13ef11
Update
2018-08-08 17:05:51 +02:00
Lurkkeli
392351af25
Adding ATT&CK tag
2018-08-08 16:43:54 +02:00
Lurkkeli
4d721f1803
Updating fps
2018-08-08 16:42:26 +02:00
Lurkkeli
b9f433414d
hiding files with attrib.exe
2018-08-08 16:19:39 +02:00
Thomas Patzke
92c0e0321a
Merge pull request #144 from samsson/patch-7
...
Added att&ck tags
2018-08-07 11:19:36 +02:00
Lurkkeli
a245820519
added att&ck tag
2018-08-07 08:54:53 +02:00
Lurkkeli
294677a2cc
added att&ck tag
2018-08-07 08:50:01 +02:00
Lurkkeli
a57e87b345
added att&ck tag
2018-08-07 08:49:05 +02:00
Lurkkeli
99253763af
added att&ck tag
2018-08-07 08:45:58 +02:00
Lurkkeli
0bff27ec21
added att&ck tactic
...
added att&ck tactic, no specific techniques applicable
2018-08-07 08:37:51 +02:00
Lurkkeli
198cb63182
added att&ck tactic
...
added att&ck tactic, no specific techniques applicable
2018-08-07 08:36:53 +02:00
Thomas Patzke
518e21fcd2
Merge pull request #134 from nikseetharaman/sysmon_cmstp_com_object_access
...
Add CMSTP UAC Bypass via COM Object Access
2018-08-07 08:33:33 +02:00
Thomas Patzke
b9fdf07926
Extended tagging
2018-08-07 08:33:18 +02:00
Lurkkeli
b50c13dd1f
Update att&ck tag
2018-08-07 08:27:24 +02:00
Thomas Patzke
5d5d42eb9b
Merge pull request #140 from yt0ng/master
...
Possible Shim Database Persistence via sdbinst.exe
2018-08-07 08:22:32 +02:00
Thomas Patzke
80eaedab8b
Fixed tag and date
2018-08-07 08:22:11 +02:00
Thomas Patzke
3509fbd201
Merge pull request #142 from samsson/patch-5
...
Added ATT&CK tag
2018-08-07 08:20:22 +02:00
Thomas Patzke
b049210641
Fixed tags
2018-08-07 08:20:09 +02:00
Lurkkeli
3456f9a74d
Update sysmon_susp_wmi_execution.yml
2018-08-07 08:19:58 +02:00
Thomas Patzke
64fa3b162d
Tag fixes
2018-08-07 08:18:16 +02:00
Lurkkeli
6472be5e19
Update sysmon_uac_bypass_sdclt.yml
2018-08-07 08:08:53 +02:00
Lurkkeli
21bee17ffd
Update sysmon_uac_bypass_eventvwr.yml
2018-08-07 08:07:49 +02:00
yt0ng
fc091fe3d7
Added ATTCK Mapping
2018-08-05 14:00:22 +02:00
yt0ng
b65cb5eaca
Possible Shim Database Persistence via sdbinst.exe
2018-08-05 13:55:04 +02:00
Nik Seetharaman
b938fdb0a3
Add CMSTP UAC Bypass via COM Object Access
2018-07-27 02:28:28 -05:00
James Dickenson
5fc118dcac
added a few mitre attack tags to windows sysmon rules
2018-07-26 21:15:07 -07:00
Florian Roth
a9fcecab88
Merge pull request #130 from samsson/patch-4
...
Fixed typo / Created a rule
2018-07-26 22:34:46 +02:00
Florian Roth
089498b0b3
Merge pull request #131 from yt0ng/master
...
Possible SafetyKatz Dump of debug.bin
2018-07-25 07:41:38 +02:00
Florian Roth
dd857c4470
Cosmetics
...
If it's only 1 value we write it like this to avoid it being interpreted as a list with 1 element and to avoid an extra line.
2018-07-25 07:37:17 +02:00
yt0ng
b415fc8d42
Possible SafetyKatz Dump of debug.bin
...
https://github.com/GhostPack/SafetyKatz
2018-07-24 23:51:46 +02:00
Lurkkeli
0e9c5bb14a
Update sysmon_rundll32_net_connections.yml
2018-07-24 20:01:47 +02:00
Thomas Patzke
01e7675e24
Merge pull request #124 from samsson/patch-1
...
ATT&CK tagging
2018-07-24 07:58:50 +02:00
Thomas Patzke
30d255ab6f
Fixed tag
2018-07-24 07:58:25 +02:00
Lurkkeli
1898157df5
ATT&CK tagging
...
Added tag for technique t1015
2018-07-23 23:57:15 +02:00
yt0ng
16160dfc80
added additional binaries and attack tactics/techniques
2018-07-23 15:47:56 +02:00
Suleyman Ozarslan
e6cbc17c12
ATT&CK tagging of Scheduled Task Creation
2018-07-22 15:56:47 +03:00
Suleyman Ozarslan
8d9b12be07
ATT&CK tagging of Default PowerSploit Schtasks Persistence
2018-07-22 15:53:56 +03:00
Suleyman Ozarslan
080892b5ab
ATT&CK tagging of MSHTA Spawning Windows Shell
2018-07-20 09:53:55 +03:00
Suleyman Ozarslan
76f277d5fe
ATT&CK tagging of Malicious Named Pipe rule
2018-07-20 09:41:54 +03:00
Suleyman Ozarslan
7e74527344
ATT&CK software tag is added to Bitsadmin Download rule
2018-07-20 09:35:35 +03:00
Florian Roth
1e61adfad1
rule: Changed Registry persistence Explorer RUN key rule
2018-07-19 16:27:19 -06:00
Florian Roth
83d6f12ce3
rule: Registry persistence in Explorer RUN key pointing to suspicious folder
2018-07-19 16:27:19 -06:00
Thomas Patzke
f98158f5ad
Further ATT&CK tagging
2018-07-19 23:36:13 +02:00
Suleyman Ozarslan
05b91847cd
ATT&CK tagging of Suspicious Certutil Command rule
2018-07-19 16:42:39 +03:00
Thomas Patzke
bdea097b80
ATT&CK tagging
2018-07-17 23:58:11 +02:00
Florian Roth
9e92b97661
Merge pull request #111 from nikseetharaman/cmstp_execution
...
Add sysmon_cmstp_execution
2018-07-17 14:39:56 -06:00
Florian Roth
3f0040b983
Removed duplicate status field
2018-07-16 15:55:31 -06:00
Florian Roth
429474b6d6
Merge pull request #113 from megan201296/patch-9
...
fixed typo
2018-07-16 15:38:52 -06:00
megan201296
02ea2cf923
fixed typo
2018-07-16 16:20:33 -05:00
megan201296
60310e94c6
fixed typo
2018-07-16 16:13:24 -05:00
Nik Seetharaman
3630386230
Add sysmon_cmstp_execution
2018-07-16 02:53:41 +03:00
Florian Roth
70ab83eb65
Merge pull request #109 from megan201296/patch-6
...
Fixed typo
2018-07-14 18:31:21 -06:00
megan201296
be7a3b0774
Update sysmon_susp_mmc_source.yml
2018-07-13 18:49:08 -05:00
megan201296
a6455cc612
typo fix
2018-07-13 18:48:36 -05:00
megan201296
8944be1efd
Update sysmon_susp_driver_load.yml
2018-07-13 18:36:12 -05:00
Florian Roth
57727d2397
Merge pull request #107 from megan201296/typo-fixes
...
Typo fixes
2018-07-10 10:29:10 -06:00
megan201296
24d2d0b258
Fixed typo
2018-07-10 09:14:37 -05:00
megan201296
d6ea0a49fc
Fixed typoes
2018-07-10 09:14:07 -05:00
megan201296
3ec67393cd
Fixed typo
2018-07-10 09:13:41 -05:00
megan201296
b0bc3b66ed
Fixed typo
2018-07-09 13:32:16 -05:00
megan201296
120479abb7
removed duplicates
2018-07-09 12:32:41 -05:00
megan201296
c4bd267151
Fixed typo
2018-07-09 12:02:42 -05:00
megan201296
a7ccfcb50d
Fixed spelling mistake
2018-07-09 09:13:31 -05:00
Florian Roth
c8fef4d093
fix: removed unnecessary lists
2018-07-07 15:43:56 -06:00
Florian Roth
dea019f89d
fix: some threat levels adjusted
2018-07-07 13:00:23 -06:00
yt0ng
6a014a3dc8
MSHTA spwaned by SVCHOST as seen in LethalHTA
...
"Furthermore it can be detected by an mshta.exe process spawned by svchost.exe."
2018-07-06 19:52:58 +02:00
Florian Roth
ed470feb21
Merge pull request #99 from yt0ng/master
...
Detects ImageLoad by uncommon Image
2018-07-06 10:11:02 -06:00
yt0ng
b21afc3bc8
user subTee was removed from Twitter
2018-07-04 17:29:05 +02:00
yt0ng
f84c33d005
Known powershell scripts names for exploitation
...
Detects the creation of known powershell scripts for exploitation
2018-07-04 17:24:18 +02:00
Florian Roth
7867838540
fix: typo in rule description
2018-07-03 05:05:44 -06:00
Florian Roth
e7465d299f
fix: false positive with MsMpEng.exe and svchost.exe as child process
2018-07-03 05:05:44 -06:00
yt0ng
42941ee105
Detects ImageLoad by uncommon Image
...
Process Hollowing Described by SubTee using notepad https://twitter.com/subTee/status/1012657434702123008
2018-07-01 15:47:17 +02:00
Florian Roth
9e0abc5f0b
Adjusted rules to the new specs reg "not null" usage
2018-06-28 09:30:31 +02:00
Florian Roth
a61052fc0a
Rule fixes
2018-06-27 18:47:52 +02:00
Florian Roth
fc72bd16af
Fixed bugs
2018-06-27 09:20:41 +02:00
Florian Roth
f4b150def8
Rule: Powershell remote thread creation in Rundll32
2018-06-25 15:23:19 +02:00
Florian Roth
1a1011b0ad
Merge pull request #96 from yt0ng/master
...
Detects the creation of a schtask via PowerSploit Default Configuration
2018-06-23 17:15:14 +02:00
yt0ng
c59d0c7dca
Added additional options
2018-06-23 15:54:31 +02:00
yt0ng
cc3fd9f5d0
Detects the creation of a schtask via PowerSploit Default Configuration
...
8690399ef7/Persistence/Persistence.psm1
2018-06-23 15:45:58 +02:00
Florian Roth
d1d4473505
Rule: ADS with executable
...
https://twitter.com/0xrawsec/status/1002478725605273600
2018-06-03 02:08:57 +02:00
Florian Roth
49877a6ed0
Moved and renamed rule
2018-04-18 16:53:11 +02:00
Markus Härnvi
cf237cf658
"author" should be a string and not a list, according to the specification
2018-04-16 23:42:51 +02:00
Florian Roth
d8bbf26f2c
Added msiexec to rule in order to cover new threats
...
https://twitter.com/DissectMalware/status/984252467474026497
2018-04-12 09:12:50 +02:00
Florian Roth
58517907ad
Improved rule to provide support for for old sysmon \REGISTRY syntax
2018-04-11 20:15:17 +02:00
Florian Roth
0ffd226293
Moved new rule to sysmon folder
2018-04-11 20:11:54 +02:00
Florian Roth
52d405bb1b
Improved shell spawning rule
2018-04-11 20:09:42 +02:00
Florian Roth
a9c7fe202e
Rule: Windows shell spawning suspicious program
2018-04-09 08:37:30 +02:00
Florian Roth
e53826e167
Extended Sysmon Office Shell rule
2018-04-09 08:37:30 +02:00
Thomas Patzke
f113832c04
Merge pull request #69 from jmallette/rules
...
Create cmdkey recon rule
2018-04-08 23:23:30 +02:00
Thomas Patzke
a3e02ea70f
Various rule fixes
...
* Field name: LogonProcess -> LogonProcessName
* Field name: Message -> AuditPolicyChanges
* Field name: ProcessCommandLine -> CommandLine
* Removed Type match in Kerberos RC4 encryption rule
Problematic because text representation not unified and audit failures are possibly interesting events
* Removed field 'Severity' from rules (Redundant)
* Rule decomposition of win_susp_failed_logons_single_source) because of different field names
* Field name: SubjectAccountName -> SubjectUserName
* Field name: TargetProcess -> TargetImage
* Field name: TicketEncryption -> TicketEncryptionType
* Field name: TargetFileName -> TargetFilename
2018-03-27 14:35:49 +02:00
Thomas Patzke
dacc6ae3d3
Fieldname case: Commandline -> CommandLine
2018-03-25 23:08:28 +02:00
Florian Roth
e141a834ff
Rule: Ping hex IP address
...
https://github.com/vysec/Aggressor-VYSEC/blob/master/ping.cna
2018-03-23 17:00:00 +01:00
Florian Roth
97204d8dc0
Renamed rule
2018-03-20 15:04:11 +01:00
Florian Roth
e9fcfcba7f
Improved NetNTLM downgrade rule
2018-03-20 15:03:55 +01:00
Florian Roth
a7eb4d3e34
Renamed rule
2018-03-20 11:12:35 +01:00
Florian Roth
b84bbd327b
Rule: NetNTLM Downgrade Attack
...
https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
2018-03-20 11:07:21 +01:00
Florian Roth
a6d293e31d
Improved tscon rule
2018-03-20 10:54:04 +01:00
Florian Roth
8fb6bc7a8a
Rule: Suspicious taskmgr as LOCAL_SYSTEM
2018-03-19 16:36:39 +01:00
Florian Roth
af8be8f064
Several rule updates
2018-03-19 16:36:15 +01:00
Florian Roth
648ac5a52e
Rules: tscon.exe anomalies
...
http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
2018-03-17 19:14:13 +01:00
Karneades
49c12f1df8
Add missing binaries
2018-03-16 10:52:43 +01:00
Florian Roth
a257b7d9d7
Rule: Stickykey improved
2018-03-16 09:10:07 +01:00
Florian Roth
0460e7f18a
Rule: Suspicious process started from taskmgr
2018-03-15 19:54:03 +01:00
Florian Roth
f5494c6f5f
Rule: StickyKey-ike backdoor usage
2018-03-15 19:53:34 +01:00
Florian Roth
5ae5c9de19
Rule: Outlook spawning shells to detect Turla like C&C via Outlook
2018-03-10 09:04:11 +01:00
jmallette
aff46be8a3
Create cmdkey recon rule
2018-03-08 13:25:05 -05:00
Thomas Patzke
8ee24bf150
WMI persistence rules derived from blog article
...
https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/#so-to-summarize
2018-03-07 23:05:10 +01:00
Thomas Patzke
8041f77abd
Merged similar rules
2018-03-06 23:19:11 +01:00
Thomas Patzke
84645f4e59
Simplified rule conditions with new condition constructs
2018-03-06 23:14:43 +01:00
Florian Roth
1001afb038
Rule: CVE-2015-1641
2018-02-22 16:59:40 +01:00
Florian Roth
25dc3e78be
Lowered severity of rule - prone to false positives
2018-02-22 16:59:11 +01:00
Florian Roth
9020a9aa32
Fixed file names "vuln" > "exploit"
2018-02-22 13:29:19 +01:00
Florian Roth
5d763581fa
Adding status "experimental" to that rule
2018-02-22 13:28:01 +01:00
Florian Roth
0be687d245
Rule: Detect CVE-2017-0261 exploitation
2018-02-22 13:27:20 +01:00
Florian Roth
fa4dbc0f2e
Rule: QuarksPwDump temp dump file
2018-02-10 15:25:36 +01:00
SherifEldeeb
348728bdd9
Cleaning up empty list items
2018-01-28 02:36:39 +03:00
SherifEldeeb
48441962cc
Change All "str" references to be "list"to mach schema update
2018-01-28 02:24:16 +03:00
SherifEldeeb
112a0939d7
Change "reference" to "references" to match new schema
2018-01-28 02:12:19 +03:00
Florian Roth
aca70e57ec
Massive Title Cleanup
2018-01-27 10:57:30 +01:00
Florian Roth
285f5bab4f
Removed duplicate string
2017-12-11 09:31:54 +01:00
Florian Roth
78854b79c4
Rule: System File Execution Location Anomaly
2017-11-27 14:09:22 +01:00
Florian Roth
93fbc63691
Rule to detect droppers exploiting CVE-2017-11882
2017-11-23 00:58:31 +01:00
Florian Roth
59e5b3b999
Sysmon: Named Pipe detection for APT malware
2017-11-06 14:24:42 +01:00
Florian Roth
37cea85072
Rundll32.exe suspicious network connections
2017-11-04 14:44:30 +01:00
Thomas Patzke
720c992573
Dropped within keyword
...
Covered by timeframe attribute.
Fixes issue #26 .
2017-10-30 00:25:56 +01:00
Thomas Patzke
27227855b5
Merge branch 'devel-sigmac'
2017-10-29 23:59:49 +01:00
Thomas Patzke
012cb6227f
Added proper handling of null/not null values
...
Fixes issue #25
2017-10-29 23:57:39 +01:00
Florian Roth
b7e8000ccb
Improved Office Shell rule > added 'schtasks.exe'
2017-10-25 23:53:45 +02:00
Thomas Patzke
d7c659128c
Removed unneeded array
2017-10-18 15:12:29 +02:00
Florian Roth
deea224421
Rule: New RUN Key Pointing to Suspicious Folder
2017-10-17 16:19:56 +02:00
Florian Roth
00baa4ed40
Executables Started in Suspicious Folder
2017-10-14 23:23:04 +02:00
Florian Roth
358d1ffba0
Executables Started in Suspicious Folder
2017-10-14 23:22:20 +02:00
Florian Roth
20f9dbb31c
CVE-2017-8759 - Winword.exe > csc.exe
2017-09-15 15:49:56 +02:00
Thomas Patzke
986c9ff9b7
Added field names to first rules
2017-09-12 23:54:04 +02:00
Thomas Patzke
68cb5e8921
Merge pull request #45 from secman-pl/patch-1
...
Update sysmon_susp_regsvr32_anomalies to detect wscript child process
2017-09-10 22:52:37 +02:00
Florian Roth
bfe8378455
Rule: Suspicious svchost.exe process
2017-08-31 11:07:45 +02:00
secman-pl
9768f275d0
Update sysmon_susp_regsvr32_anomalies
...
Rule to detect COM scriptlet invocation when wscript.exe is spawned from regsvr32.exe.
example: https://www.hybrid-analysis.com/sample/f34da6d84a9663928606894fbc494cd9bf2f03c98cf0c775462802558d3a50ef?environmentId=100
SCT script code:
var objShell = new ActiveXObject("WScript.shell");
2017-08-29 12:21:47 +02:00
Florian Roth
f3f2c14b3a
Added reference to regsvr32 rule
2017-08-29 08:45:29 +02:00
Florian Roth
55f4c37e22
Rule: Microsoft Binary Github Communication
2017-08-24 18:27:40 +02:00
Hans-Martin Münch
09e754a8f9
Small Typo fix
2017-08-22 10:56:25 +02:00
Florian Roth
59821d1bcb
Office Shell: Reference added to new entry
2017-08-22 10:04:22 +02:00
Florian Roth
8f4a780c3b
Added regsvr32.exe to suspicious child processes
2017-08-20 23:14:41 +02:00
Thomas Patzke
4578756cfd
Merge remote-tracking branch 'origin/master'
2017-08-05 00:35:24 +02:00
Thomas Patzke
03985288f6
Removed 'last' from timeframe
2017-08-05 00:32:24 +02:00
Florian Roth
edb52e098a
Extended hh.exe in Office Shell detection
...
https://www.hybrid-analysis.com/sample/6abc2b63f1865a847ff7f5a9d49bb944397b36f5503b9718d6f91f93d60f7cd7?environmentId=100
2017-08-04 09:18:55 +02:00
Thomas Patzke
5706361464
Parsing of "near ... within" aggregation operator
...
* Operator is only parsed. No processing or passing of parsed data to
backends.
* Changed rule sysmon_mimikatz_inmemory_detection.yml accordingly.
2017-08-03 00:05:48 +02:00
Thomas Patzke
f768bf3d61
Fixed parse errors
2017-08-02 22:49:15 +02:00
Thomas Patzke
84418d2045
Merged builtin/win_susp_certutil_activity.yml with Sysmon rule
2017-08-02 00:04:28 +02:00
Florian Roth
cdf0894e6a
Corrected error in certutil rules (-f means force overwrite, not file)
...
> the -urlcache is the relevant command
2017-07-20 12:54:55 -06:00
Florian Roth
3a55b31da2
certutil file download - more generic approach
2017-07-20 12:48:47 -06:00
Florian Roth
b85d96e458
certutil detections (renamed, extended)
...
see https://twitter.com/subTee/status/888102593838362624
2017-07-20 12:38:10 -06:00
Florian Roth
8f525d2f01
Wannacry Rules Reorg and Renaming
2017-06-28 09:08:53 +02:00
Florian Roth
576981820b
Moved PlugX rule & used builtin ID 4688 for another rule
2017-06-12 11:02:49 +02:00
Florian Roth
371b41acd9
Improved regsvr32.exe whitelisting bypass rule
...
thanks to Nick Carr https://twitter.com/ItsReallyNick/status/872409920938946560
2017-06-07 13:46:36 +02:00
Florian Roth
e5ad1b2f84
Improved regsvr32 whitelisting bypass rule
2017-06-07 12:02:55 +02:00
Florian Roth
1fd7a92e87
Regsvr32.exe anomalies (bugfix and new selection)
2017-06-07 11:43:25 +02:00
Florian Roth
0c222134b9
Extended malware script dropper rule
2017-05-25 14:59:16 +02:00
Florian Roth
0685e297c8
Improved Suspicious Net.exe Execution Rule
2017-05-25 12:44:56 +02:00
Florian Roth
6ad5f82248
Corrected rule
2017-05-25 12:06:23 +02:00
dimi
0b8c82b75b
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading
...
2) correct typo in dns server rule
2017-05-15 20:58:31 +02:00
Florian Roth
75e55d647b
Fixed and added strings
2017-05-13 18:33:51 +02:00
Florian Roth
46643324a8
Wannacrypt Update
2017-05-13 10:40:41 +02:00
Florian Roth
c40c592fb5
Changed rule as "m.vbs" isn't stable
2017-05-13 08:32:30 +02:00
Florian Roth
7c56992de5
Reference in WannaCrypt rule
2017-05-12 23:02:13 +02:00
Florian Roth
b7837d4cdb
Fixed WannaCrypt rule
2017-05-12 22:32:40 +02:00
Florian Roth
5cdb2b013b
WannaCrypt Ransomware
2017-05-12 21:57:53 +02:00
Florian Roth
16ac2337a4
Suspicious DNS Server Config Error - Sysmon Rule
2017-05-08 13:39:50 +02:00
Florian Roth
c7cc2a00d3
WScript/CScript Dropper
2017-05-05 17:30:46 +02:00
Florian Roth
a5c3f424c1
regsvr32 Anomalies
2017-04-16 12:02:29 +02:00
Florian Roth
769156a83b
Minor fix > list to single value
2017-04-16 12:01:03 +02:00
Florian Roth
8363b25888
Suspicious Control Panel DLL Load
2017-04-15 23:32:26 +02:00
Florian Roth
89e43c1059
Improved MSHTA rule
2017-04-13 09:25:34 +02:00
Florian Roth
059cfbf15a
Removed duplicate
2017-04-13 01:21:46 +02:00
Florian Roth
c2ed7bd9df
MSHTA Rule v1
2017-04-13 01:08:37 +02:00
Florian Roth
92b4a7ad93
Added reference
2017-04-07 15:42:08 +02:00
Florian Roth
0650aa3cbe
Rule: Suspicious cmd.exe combo with http and AppData
2017-04-03 10:41:10 +02:00
Florian Roth
fa90fb2fed
Improved WMIC process call create rule
2017-03-29 22:11:05 +02:00
Florian Roth
e6a81623a8
PowerShell Combo - False Positive with MOM
2017-03-29 22:10:28 +02:00
Florian Roth
f91f813b3f
Improved certutil.exe rules
2017-03-27 22:30:26 +02:00
Florian Roth
b0c8ffb051
Combined vssadmin rule
2017-03-26 01:27:26 +01:00
Florian Roth
800262a738
Renamed and double removed
2017-03-26 01:27:08 +01:00
Michael Haag
5ea6fad999
net.exe and wmic.exe
...
Suspicious execution of net and wmic
2017-03-25 06:48:23 -07:00
Florian Roth
10ee36f26c
Updated Eventvwr UAC evasion
2017-03-22 14:40:55 +01:00
Florian Roth
3bfa9ed121
Bugfix: Minor fix cause Sysmon uses SID as Software key
2017-03-21 10:44:53 +01:00
Florian Roth
b1da8c5b32
Bugfix: Fixed UAC bypass rules
2017-03-21 10:42:22 +01:00
