valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 17:35:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
7,962 Commits 20 Branches 25 Tags 21 MiB
30955c4884
Commit Graph

5908 Commits

Author SHA1 Message Date
Cyb3rEng
250a307414
Resolved more issues from last commit as per comments 
Added the following fixes to text inside the rule:
date
attack.defense_evasion
added custome id
 2021-09-09 21:17:38 -06:00
Cyb3rEng
2be4c699fc
Resolved more issues from last commit as per comments 
Added the following fixes to text inside the rule:
date
attack.defense_evasion
added custome id
 2021-09-09 21:16:38 -06:00
Cyb3rEng
1102def1bf
Resolved more issues from last commit as per comments 
Added the following fixes to text inside the rule:
date
attack.defense_evasion
added custome id
 2021-09-09 21:14:08 -06:00
Cyb3rEng
cfe11cdf17
Resolved more issues from last commit as per commetns 
Added the following fixes to text inside the rule:
date
attack.defense_evasion
added custome id
 2021-09-09 21:13:02 -06:00
Cyb3rEng
d3b4a6aa7a
Changed title based on comments 
title: File Creation by Office Applications
 2021-09-09 21:09:24 -06:00
Cyb3rEng
918bcfbf8a
Completed requested changes 
selection2:
    Image|endswith:
 2021-09-09 21:04:09 -06:00
Cyb3rEng
ff08de6d20
Completed Changes based on review 
selection2:
     ParentPrcessName|endswith:
 2021-09-09 21:02:11 -06:00
Cyb3rEng
5470c40ca6
Resolving Comment 
selection2:
   ParentImage:

removed - since there is only one attribute.
 2021-09-09 20:56:11 -06:00
Pawel Mazur
5a5769cce6 New Rule - Linux - Steganography Unzip Hidden Information From Picture File 2021-09-09 20:38:25 +02:00
zakibro
3fbe5478c3
Update and rename lnx_auditd_hidden_files_steganography.yml to lnx_auditd_hidden_zip_files_steganography.yml 
Splitting the rule into separate rules
 2021-09-09 20:34:20 +02:00
frack113
ffbeec134d
Update image_load_wmiprvse_wbemcomn_dll_hijack.yml 2021-09-09 19:56:20 +02:00
zakibro
458973af81
Update lnx_auditd_hidden_files_steganography.yml 
Adding missing field: action
 2021-09-09 16:52:58 +02:00
zakibro
62db796fc2
Update lnx_auditd_hidden_files_steganography.yml 
Formatting changes
 2021-09-09 16:46:41 +02:00
zakibro
0971fe1d49
Update lnx_auditd_hidden_files_steganography.yml 
Fixing the listing issue
 2021-09-09 16:27:57 +02:00
Pawel Mazur
41458d8a5a New Rule - Linux Auditd Hidden Files - Steganography 2021-09-09 16:13:27 +02:00
frack113
d9cd1652f2 Split global sysmon rules 2021-09-09 16:11:41 +02:00
frack113
217be6cd8a
Merge pull request #2005 from frack113/tags_end 
Add  missing tags to rule
 2021-09-09 15:04:26 +02:00
Florian Roth
f00aaf8461
refactor: exclude case in which upper ticks are used 2021-09-09 12:55:10 +02:00
Florian Roth
6d86c7df6c
Revert "refactor: 2nd condition in CVE-2021-40444 rule" 
This reverts commit 015573c450.
 2021-09-09 09:41:03 +02:00
Florian Roth
015573c450
refactor: 2nd condition in CVE-2021-40444 rule 2021-09-09 09:33:45 +02:00
Florian Roth
e8b633f54f
Merge pull request #2006 from SigmaHQ/rule-devel 
docs: changed level and reference in CVE-2021-40444 rule
 2021-09-09 09:29:08 +02:00
Florian Roth
2777187fd9
docs: changed level and reference in CVE-2021-40444 rule 2021-09-09 08:46:34 +02:00
Florian Roth
b1f5c22805
Merge pull request #2003 from SigmaHQ/rule-devel 
CVE-2021-40444 process pattern
 2021-09-09 08:44:52 +02:00
Florian Roth
36a5d7ec04
CVE-2021-40444 false positives 2021-09-09 08:12:36 +02:00
frack113
312ffe69e2
Update Monitor_LOLBins_process_creations_with_Wmiprvse_parent_process.yml 2021-09-09 06:28:48 +02:00
frack113
caa5c7af1a
Update Monitor_LOLBins_process_creations_with_Wmiprvse_parent_process.yml 2021-09-09 06:27:23 +02:00
Cyb3rEng
b2c44ebd6e
Changed selection1 
completed the following change to selection1 to keep inline with rule creation guideline
- CommandLine|contains: 'wmic '
 2021-09-08 21:27:15 -06:00
Cyb3rEng
fe9b91c504
Completed changes to selection1 
changed to the following to follow rule creation guidelines:
    - Image|endswith: '\wbem\WMIC.exe'
    - ProcessCommandLine|contains: 'wmic '
 2021-09-08 21:26:01 -06:00
Cyb3rEng
851dfeee46
Changed selection2 condition 
changed from "\\wbem\\WmiPrvSE.exe" to "\wbem\WmiPrvSE.exe" to follow rule creation guidelines
 2021-09-08 21:24:18 -06:00
Cyb3rEng
77ee51dd76
Changed the category 
Changed category to file_event
 2021-09-08 21:22:26 -06:00
Cyb3rEng
5bbe3dec9b
Completed changes to selection1 and selection2 
changes were completed to remove ( * ) and stay within rule creation guide:
    - Image|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'

 WMIcommand|contains: 'Win32_Process\:\:Create'
 2021-09-08 21:14:58 -06:00
Cyb3rEng
49df2358de
Completed changes to selection1 
completed changes to selection1 to comply with rule creation guide with no ( * ) or ( \\ ) 

  - Image|endswith: '\wbem\WMIC.exe'
  - ProcessCommandLine|contains: 'wmic '
 2021-09-08 21:12:27 -06:00
Cyb3rEng
a3236e62a2
Changed selection2 conditions 
replaced *\wbem\WMIC.exe with Image|endswith: '\wbem\WMIC.exe' and ProcessCommandLine: *wmic * with ProcessCommandLine|contains: 'wmic '
 2021-09-08 21:10:47 -06:00
Cyb3rEng
1f577174f9
Changed endswith condition 
removed double // from "\wbem\WmiPrvSE.exe"
 2021-09-08 21:06:41 -06:00
Cyb3rEng
6ddc83901b
Changed Category 
Category Changed from process_creation to file_event
 2021-09-08 20:38:07 -06:00
Cyb3rEng
5ac0fded26
Merge branch 'SigmaHQ:master' into master 2021-09-08 20:26:59 -06:00
Sittikorn S
36ed5ee9d4
Update sysmon_dns_over_https_enabled.yml 2021-09-09 08:04:54 +07:00
frack113
8eb527d042 Update process_mailboxexport_share.yml 2021-09-08 20:21:02 +02:00
frack113
deb0ddfe09 fix duplicate tags 2021-09-08 20:16:53 +02:00
frack113
af8bf06b30 add missing tags 2021-09-08 20:14:49 +02:00
Florian Roth
b1540d65b9
refactor: simplified rule 2021-09-08 17:35:50 +02:00
Sittikorn S
c633e825e0
Update sysmon_dns_over_https_enabled.yml 2021-09-08 22:23:51 +07:00
Sittikorn S
847b8f49b4
Update sysmon_dns_over_https_enabled.yml 
Remove HKEY_LOCAL_MACHINE\ and revise Firefox object
 2021-09-08 22:22:53 +07:00
Florian Roth
e388bc6bfa
remove unsupported tag 2021-09-08 16:56:04 +02:00
Florian Roth
c9b4f5d326
CVE-2021-40444 2021-09-08 16:49:49 +02:00
Florian Roth
72ffe99b20
Merge pull request #2001 from SigmaHQ/rule-devel 
filter: empty thumbprint, PetitPotam rule
 2021-09-08 09:09:58 +02:00
frack113
993112c7eb
Merge pull request #2002 from frack113/missing_tag 
Add missing Tags #1974
 2021-09-08 06:26:55 +02:00
frack113
e712d9696b
Merge pull request #2000 from frack113/split_global 
Split frack113 global rules
 2021-09-08 06:26:35 +02:00
Cyb3rEng
e3b376e945
Completed Changes Based on Comments 
Removed :
unnecessary event ID
 2021-09-07 21:26:42 -06:00
Cyb3rEng
4130ceb208
Completed Changes Based on Comments 
Removed :
unnecessary event ID
 2021-09-07 21:25:52 -06:00
Cyb3rEng
8d47f9531b
Completed Changes Based on Comments 
Removed :
unnecessary event ID
 2021-09-07 21:22:01 -06:00
Cyb3rEng
13e6262055
Completed Changes Based on Comments 
Removed :
unnecessary event ID
 2021-09-07 21:20:51 -06:00
Cyb3rEng
8dc1b03fef
Completed Changes Based on Comments 
Removed :
unnecessary event ID
 2021-09-07 21:19:43 -06:00
Cyb3rEng
bd4d21c41c
Completed changes based on comments 
Removed :
unnecessary event ID
 2021-09-07 21:17:12 -06:00
Cyb3rEng
75a6e5c95b
Completed Changes as per comments 
Removed :
unnecessary event ID
 2021-09-07 21:14:06 -06:00
Cyb3rEng
3b2ebe1580
Completed changes 
Removed :
unnecessary event ID
 2021-09-07 21:12:02 -06:00
Cyb3rEng
8467d5a65a
Modified Rule 
Removed :
unnecessary event ID
 2021-09-07 21:09:07 -06:00
Cyb3rEng
f0f3ecfe2f
Converted to LF 
Removed :
unnecessary event ID
 2021-09-07 21:00:35 -06:00
Cyb3rEng
932b7cf2ba
Merge branch 'SigmaHQ:master' into master 2021-09-07 19:58:09 -06:00
Thomas Patzke
d9edc9f0e3 Merge branch 'fix' 2021-09-08 00:19:09 +02:00
Thomas Patzke
143744bc12 Various fixes 
* Backslashes in regular expressions
* Casing of condition operators
* Further small errors
 2021-09-07 23:38:07 +02:00
frack113
4c3f8821c4 add missing tags 2021-09-07 18:16:46 +02:00
frack113
4e394d83a1 add missing tags 2021-09-07 17:45:41 +02:00
Rachel Rice
be5351947c
Unset date update 
Signed-off-by: Rachel Rice <rachel.rice@lacework.net>
 2021-09-07 16:36:59 +01:00
Florian Roth
1a55f4a294
filter: empty thumbprint, PetitPotam rule 2021-09-07 14:37:03 +02:00
Rachel Rice
eef6e71e2e
Update AWS Update Login Profile Rule fields 
Missed updating field from `responseElements.accessKey.userName` to `requestParameters.userName` on last update.
 2021-09-07 12:39:56 +01:00
frack113
0e5e4fa19d Split global rules 2021-09-07 13:30:32 +02:00
Florian Roth
cfbde22d2d
rule: PRIVATELOG image load 2021-09-07 10:10:14 +02:00
Florian Roth
3a305e82b9
fix: remove renamed files 2021-09-07 09:28:20 +02:00
Florian Roth
a8d8d878a0
remove uppercase files 2021-09-07 09:27:11 +02:00
Florian Roth
8b4fce3473
removed unneeded upper ticks 2021-09-07 09:21:44 +02:00
Florian Roth
c082ce0fe0
Merge branch 'master' into rule-devel 2021-09-07 09:20:47 +02:00
Florian Roth
57bfdc7a02
fix: more upper case chars 2021-09-07 09:19:23 +02:00
Florian Roth
0cce1c0245
fix: missing lowercase chars 2021-09-07 09:17:25 +02:00
Florian Roth
33be089ea2
fix: filename to lowercase 2021-09-07 09:16:35 +02:00
frack113
4f6b87fed5
Merge pull request #1997 from zakibro/master 
New Rule - Linux Hidden Files and Directories
 2021-09-07 09:12:04 +02:00
zakibro
bba66ca762
Update lnx_auditd_hidden_files_directories.yml 
Updating arguments section
 2021-09-07 07:57:50 +02:00
frack113
be442182fe convert to LF 2021-09-06 21:10:08 +02:00
frack113
9ef299c4f4 Change to LF 2021-09-06 21:07:49 +02:00
frack113
3b95b0c913
Remove useless Eventid 
Use tools/config/generic/windows-audit.yml to convert for security 4688
 2021-09-06 20:56:41 +02:00
zakibro
e9fa5bde2b
Update lnx_auditd_hidden_files_directories.yml 
Correction of tag
 2021-09-06 18:55:58 +02:00
Pawel Mazur
7c2895c73f New Rule - Linux Hidden Files and Directories 2021-09-06 18:43:49 +02:00
Pawel Mazur
59eb7ce032 Merge branch 'master' of https://github.com/zakibro/sigma 2021-09-06 18:41:19 +02:00
Pawel Mazur
9f5f25e480 New Rule - Linux Hidden Files and Directories 2021-09-06 18:40:39 +02:00
zakibro
f52860d6ab
Merge branch 'SigmaHQ:master' into master 2021-09-06 18:40:02 +02:00
Pawel Mazur
3eb354e34c Merge branch 'master' of https://github.com/zakibro/sigma 2021-09-06 18:37:45 +02:00
Pawel Mazur
ef3efd8fd3 New Rule Linux - Hidden Files and Directories 2021-09-06 18:37:02 +02:00
Austin Songer
0de95e355a
Update azure_federation_modified.yml 2021-09-06 11:31:52 -05:00
Austin Songer
e6e3fc2eec
Update azure_federation_modified.yml 2021-09-06 11:16:35 -05:00
Austin Songer
6025df63ee
Create azure_federation_modified.yml 2021-09-06 11:06:58 -05:00
Florian Roth
6b2bacd2cc
Merge pull request #1979 from frack113/test_global 
Change ID in global action rule
 2021-09-06 08:44:14 +02:00
frack113
013eb2e11f
Merge pull request #1993 from zakibro/master 
New Rule - Linux-Audio-Capture
 2021-09-05 18:30:45 +02:00
frack113
44a5792be3 Revert win_apt_apt29_tor.yml 2021-09-05 12:34:24 +02:00
frack113
ca4c156fa4 Update win_apt_apt29_tor.yml 2021-09-05 11:20:57 +02:00
frack113
acf2bfbd27 Update sigma_uuid verify 
Make a better verify code
 2021-09-05 10:43:42 +02:00
zakibro
5042ba65ac
Update lnx_auditd_audio_capture.yml 
Added more references about arecord.
 2021-09-05 09:28:53 +02:00
Austin Songer
fa5554660c
Update sysmon_mal_cobaltstrike_re.yml 2021-09-04 17:33:05 -05:00
Pawel Mazur
caf78b5ea1 New Rule - Linux-Audio-Capture 2021-09-04 22:10:34 +02:00
Austin Songer
e7c5827776
Update azure_service_principal_removed.yml 2021-09-03 22:43:11 -05:00
Austin Songer
0612ea7f6e
Update azure_device_no_longer_managed_or_compliant.yml 2021-09-03 22:42:26 -05:00
Austin Songer
c420a17e05
Update azure_service_principal_removed.yml 2021-09-03 22:29:21 -05:00
Austin Songer
fda1e3362e
Update azure_owner_removed_from_application_or_service_principal.yml 2021-09-03 22:29:12 -05:00
Austin Songer
9d26116d27
Update azure_device_no_longer_managed_or_compliant.yml 2021-09-03 22:29:02 -05:00
Austin Songer
8fe7bfc452
Update azure_application_deleted.yml 2021-09-03 22:28:53 -05:00
Austin Songer
c021ae9e7c
Update and rename azure_device_or_configuration_deleted.yml to azure_device_or_configuration_modified_or_deleted.yml 2021-09-03 22:28:35 -05:00
Austin Songer
6744fb7f2e
Create azure_application_deleted.yml 2021-09-03 22:25:34 -05:00
Austin Songer
70ac0104cf
Create azure_service_principal_removed.yml 2021-09-03 22:25:01 -05:00
Austin Songer
6e15618c75
Create azure_device_or_configuration_deleted.yml 2021-09-03 22:24:32 -05:00
Austin Songer
b478132769
Create azure_owner_removed_from_application_or_service_principal.yml 2021-09-03 22:23:59 -05:00
Austin Songer
c0bdc3fb1b
Create azure_device_no_longer_managed_or_compliant.yml 2021-09-03 22:23:21 -05:00
frack113
6780182c37
Merge pull request #1974 from frack113/tags_pack2 
Add missing Tags
 2021-09-03 19:13:32 +02:00
frack113
2e474628fa
Merge pull request #1987 from zakibro/master 
New Rule - Linux-Auditd-System Information Discovery
 2021-09-03 19:10:28 +02:00
frack113
688df3405a
Merge pull request #1970 from frack113/red_T1564.004_1 
Redcanary  t1564.004  ADS test 1
 2021-09-03 19:06:51 +02:00
frack113
77c6b74c72
Merge pull request #1985 from mvelazc0/master 
Adding Petitpotam/ADCS attack vector detections
 2021-09-03 19:06:03 +02:00
mvelazco
a7a002cb7f updating fields as per frack113 feedback 2021-09-03 10:01:54 -04:00
frack113
769451dc03
Add missing id 2021-09-03 13:42:15 +02:00
frack113
815134df7f
Cleanup 2021-09-03 13:30:10 +02:00
phantinuss
aa2e86963c
fix: rename filter 2021-09-03 13:26:34 +02:00
phantinuss
f3bdb0e43d
fix: remove unneeded selection 2021-09-03 13:26:23 +02:00
phantinuss
2de2de8433
Addition to UAC Bypasses 2021-09-03 13:26:11 +02:00
zakibro
8bd859f550
Update lnx_auditd_system_info_discovery.yml 2021-09-03 13:07:42 +02:00
ncrqnt
adc3c9e608 fixed date: switched day/month 2021-09-03 12:03:38 +02:00
Pawel Mazur
864286e206 New Rule - Linux-Auditd-System Information Discovery 2021-09-03 11:33:18 +02:00
frack113
89562273cc
Merge pull request #1984 from austinsonger/azure_app_credential_modification.yml 
azure_app_credential_modification.yml
 2021-09-03 08:17:55 +02:00
frack113
88389f945d
Merge pull request #1983 from austinsonger/azure_service_principal_created.yml 
azure_service_principal_created.yml
 2021-09-03 08:14:47 +02:00
frack113
d40cdec062
Merge pull request #1982 from austinsonger/azure_network_firewall_policy_modified_or_deleted.yml 
azure_network_firewall_policy_modified_or_deleted.yml
 2021-09-03 08:13:30 +02:00
frack113
bd1b4c0d70
Merge pull request #1978 from rachelrice/update_aws_login 
Update AWS Update Login Profile rule
 2021-09-03 08:12:28 +02:00
frack113
1fc2a39720
Merge pull request #1975 from frack113/red_T1564.004_2 
Redcanary  t1564.004 test 2
 2021-09-03 08:12:08 +02:00
frack113
11e4b900e4 Update global id 2021-09-03 06:59:40 +02:00
frack113
135d0a2c61 Update global id 2021-09-03 06:50:00 +02:00
frack113
a6bb5574fb Update global id 2021-09-03 06:35:35 +02:00
mvelazco
ba41e922d2 adding Petitpotam host detections 2021-09-03 00:12:49 -04:00
Austin Songer
775c0e8e7f
Update azure_app_credential_modification.yml 2021-09-02 21:00:21 -05:00
Austin Songer
643ec0abe3
Update azure_service_principal_created.yml 2021-09-02 21:00:02 -05:00
Austin Songer
10af7bbdb1
Create azure_app_credential_modification.yml 2021-09-02 20:53:32 -05:00
Austin Songer
d25fd420d6
Create azure_service_principal_created.yml 2021-09-02 20:48:35 -05:00
Austin Songer
1272c76ae7
Create azure_network_firewall_policy_modified_or_deleted.yml 2021-09-02 20:31:27 -05:00
frack113
d02ee1eddd Update global ID 2021-09-02 21:16:55 +02:00
frack113
f90c7558a7 update global id 2021-09-02 21:03:25 +02:00
frack113
ac90ee0002 Update global ID 2021-09-02 20:23:23 +02:00
frack113
086a15fc45 Update global ID 2021-09-02 20:07:03 +02:00
Rachel Rice
78d3fa4795
Update AWS STS AssumeRole Misuse rule 
Update selection criteria for AWS STS AssumeRole Misuse rule for any event by an AssumedRole userIdentity.
Closes SigmaHQ/sigma#1963.
 2021-09-02 17:40:35 +01:00
Rachel Rice
7ccb773b20
Update AWS Update Login Profile rule 
Update selection criteria for AWS Update Login Profile rule to check for mismatch between userIdentity.arn and requestParameters.userName.
Closes SigmaHQ/sigma#1966.
 2021-09-02 17:37:41 +01:00
frack113
9bcefc6a93 move uuid from global 2021-09-02 16:05:05 +02:00
frack113
b731c20594
Merge pull request #1971 from phantinuss/master 
fix: prevent possible FPs
 2021-09-02 15:34:46 +02:00
frack113
a048403089
Merge pull request #1973 from klingerko/cs_namedpipe_updates 
Remove duplicate and regex improvements
 2021-09-02 15:25:01 +02:00
phantinuss
ab721c736c
chore: move level/falsepositives to bottom 2021-09-02 14:55:17 +02:00
klingerko
15e25f9635 update modifed date 2021-09-02 14:50:14 +02:00
phantinuss
0b373ff1e9
fix: remove 2nd selection due to FPs 2021-09-02 14:47:47 +02:00
frack113
6a1b95d947
Findstr covert by win_susp_findstr.yml 2021-09-02 14:22:59 +02:00