Karneades
b47900fbee
Add default path to filter for explorer in exe anomaly rule
2019-04-21 17:42:47 +02:00
Thomas Patzke
49beb5d1a8
Integrated PR from @P4T12ICK in existing rule
...
PR #321
2019-04-21 00:28:40 +02:00
Florian Roth
aab3dbee4f
Rule: Detect Empire PowerShell Default Cmdline Params
2019-04-20 09:38:41 +02:00
Florian Roth
03d8184990
Rule: Extended PowerShell Susp Cmdline Enc Commands
2019-04-20 09:38:41 +02:00
Florian Roth
d5fa51eab9
Merge pull request #305 from Karneades/patch-3
...
Remove too loose filter in notepad++ updater rule
2019-04-19 12:40:24 +02:00
Florian Roth
e32708154f
Merge pull request #304 from Karneades/patch-2
...
Remove too loose filter in mshta rule
2019-04-19 09:51:45 +02:00
Florian Roth
74dd008b10
FP note for HP software
2019-04-19 09:51:32 +02:00
Karneades
d75ea35295
Restrict whitelist filter in system exe anomaly rule
2019-04-18 22:06:12 +02:00
Florian Roth
f78413deab
Merge pull request #309 from jmlynch/master
...
added rules for renamed wscript, cscript and paexec. Added two direct…
2019-04-17 23:59:27 +02:00
Florian Roth
4808f49e0d
More exact path
2019-04-17 23:45:15 +02:00
Florian Roth
1a4a74b64b
fix: dot mustn't be escaped
2019-04-17 23:44:36 +02:00
Florian Roth
76780ccce2
Too many different trusted cscript imphashes
2019-04-17 23:33:56 +02:00
Florian Roth
7c5f985f6f
Modifications
2019-04-17 23:30:49 +02:00
Florian Roth
4298abffb7
Modifications
2019-04-17 23:29:29 +02:00
Florian Roth
615a802a8e
Modifications
2019-04-17 23:26:20 +02:00
Sam0x90
0e8a46aaf7
Update win_subp_svchost rule
...
Adding rpcnet.exe as ParentImage
2019-04-16 15:00:06 +02:00
Florian Roth
17470d1545
Rule: extended parent list for legitimate svchost starts
...
https://twitter.com/Sam0x90/status/1117768799816753153
2019-04-15 14:54:35 +02:00
Florian Roth
612a7642d2
Added Local directory
2019-04-15 08:47:53 +02:00
Florian Roth
1d3159bef0
Rule: Extended Office Shell rule
2019-04-15 08:13:35 +02:00
Karneades
d872c52a43
Add restricted filters to notepad++ gup.exe rule
2019-04-15 08:12:12 +02:00
Florian Roth
1e262f5055
Merge pull request #303 from Karneades/patch-1
...
Remove too loose filter in wmi spwns powershell rule
2019-04-14 23:11:57 +02:00
Karneades
75d36165fc
Remove non-generic falsepositives
...
There are tons of FPs for that... :)
2019-04-11 12:55:24 +02:00
Karneades
51e65be98b
Remove loose wildcard filter in powershell encoded cmd rule
2019-04-11 12:53:12 +02:00
Jason Lynch
89fb726875
added win_office_spawn_exe_from_users_directory.yml. Detects executable in users directory started via office program. Helpful for adversaries that tend to drop and execute renamed binaries in this location such as fin7
2019-04-09 09:45:07 -04:00
Jason Lynch
f0c8c428bb
added rules for renamed wscript, cscript and paexec. Added two directories to the existing sysmon_susp_prog_location_network_connection rule. These additions are all fin7 related.
2019-04-08 08:07:30 -04:00
Karneades
97376c00de
Fix condition
2019-04-04 22:33:32 +02:00
Karneades
766b8b8d18
Fix condition
2019-04-04 22:32:47 +02:00
Karneades
788e75ef1b
Fix condition
2019-04-04 22:32:21 +02:00
Karneades
840eb2f519
Remove too loose filter in notepad updater rule
2019-04-04 22:25:05 +02:00
Karneades
eb690d8902
Remove too loose filter in mshta rule
2019-04-04 22:16:24 +02:00
Karneades
1915561351
Remove to loose wildcard from wmi spwns powershell rule
2019-04-04 22:12:28 +02:00
yt0ng
e0459cec1c
renamed file
2019-04-03 17:39:17 +02:00
t0x1c-1
7e058e611c
WMI spawning PowerShell seen in various attacks
2019-04-03 16:56:45 +02:00
Unknown
9ada22b8e0
adjusted link
2019-04-03 16:40:18 +02:00
Unknown
d2e605fc5c
Auto stash before rebase of "Neo23x0/master"
2019-04-03 16:25:18 +02:00
Florian Roth
e473efb7c3
Trying to fix ATT&CK framework tag
2019-04-01 10:36:35 +02:00
Florian Roth
3f2ce4b71f
Lowered level to medium
2019-04-01 09:47:14 +02:00
t0x1c-1
51c42a15a7
Allow Incoming Connections by Port or Application on Windows Firewall
2019-04-01 08:16:56 +02:00
Nate Guagenti
60c4fed2e0
Create win_etw_trace_evasion.yml
...
there are two versions of clear and two variations of set that can be used with something like wevtutil
`wevtutil cl | wevtutil clear-log | wevtutil sl | wevtutil set-log `
Also, I am adding a `*` match at the end, because there are other parameters that could be placed on the end -- so unless this was used on a general search on a text/analyzed field then the `*` is necessary.
example `wevtutil set-log Microsoft-Windows-WMI-Activity/Trace /e:disable /q:true`
2019-03-22 11:36:55 -04:00
Florian Roth
ffac77fb37
Rule: extended LockerGoga description
2019-03-22 11:03:48 +01:00
Florian Roth
1adb040e0b
Rule: LockerGoga
2019-03-22 10:59:31 +01:00
Florian Roth
2ad2ba9589
fix: rule field fix in proc_creation rule
2019-03-22 10:59:18 +01:00
Thomas Patzke
be25aa2c37
Added CAR tags
2019-03-16 00:37:09 +01:00
Thomas Patzke
8512417de0
Incorporated MITRE CAR mapping from #55
2019-03-16 00:03:27 +01:00
Yugoslavskiy Daniil
5d54e9c8a1
nbstat.exe -> nbtstat.exe
2019-03-11 19:28:29 +01:00
Thomas Patzke
3c1948f089
Merge pull request #277 from megan201296/patch-18
...
Remove invalid link
2019-03-07 23:49:13 +01:00
Yugoslavskiy Daniil
475113b1c1
fixed incorrect date format
2019-03-07 22:52:11 +01:00
megan201296
c2a16591af
Remove invalid link
...
Cybereason link was broken. Couldn't find anything with a super similar file path. The below link might be a valid replacement but went better safe than sorry and just removed it completely. https://www.cybereason.com/hubfs/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty-Part1.pdf
2019-03-07 14:22:29 -06:00
Yugoslavskiy Daniil
cb7243de5d
fixed wrong tags
2019-03-06 06:18:38 +01:00
Yugoslavskiy Daniil
8bec627ff1
fixed multiple tags issue
2019-03-06 06:09:37 +01:00
Yugoslavskiy Daniil
5154460726
changed service to product
2019-03-06 05:57:01 +01:00
Yugoslavskiy Daniil
05cc7e455d
atc review
2019-03-06 05:25:12 +01:00
yugoslavskiy
725ab99e90
Merge pull request #1 from AverageS/master
...
Fix rules
2019-03-06 04:31:01 +01:00
Wydra Mateusz
534f250c35
Merge branch 'master' of https://github.com/krakow2600/sigma
2019-03-06 00:45:16 +01:00
Wydra Mateusz
bb95347745
rules update
2019-03-06 00:43:42 +01:00
mrblacyk
6232362f04
Missing tags
2019-03-06 00:16:40 +01:00
mrblacyk
07807837ee
Missing tags
2019-03-06 00:02:37 +01:00
mikhail
be108d95cc
Merge branch 'master' of https://github.com/AverageS/sigma
2019-03-06 01:57:38 +03:00
mikhail
40241c1fdf
Fix 4 rules
2019-03-06 01:56:05 +03:00
mrblacyk
99595a7f89
Added missing tags and some minor improvements
2019-03-05 23:25:49 +01:00
Florian Roth
7b3d67ae66
fix: bugfix in new proc creation rule
2019-03-02 11:28:13 +01:00
Florian Roth
1a583c158d
fixed typo as in pull request by @m0jtaba
2019-03-02 08:16:25 +01:00
Florian Roth
2188001f98
Extended filter list provided by @Ov3rflow
2019-03-02 08:13:29 +01:00
Thomas Patzke
56a1ed1eac
Merge branch 'project-1'
2019-03-02 00:26:10 +01:00
Thomas Patzke
7602309138
Increased indentation to 4
...
* Converted (to generic sigma) rules
* Converter outputs by default with indentation 4
2019-03-02 00:14:20 +01:00
Thomas Patzke
6bdb4ab78a
Merge cleanup
2019-02-27 22:05:27 +01:00
Thomas Patzke
c922f7d73f
Merge branch 'master' into project-1
2019-02-26 00:24:46 +01:00
Thomas Patzke
96eb460944
Converted Sysmon/1 and Security/4688 to generic process creation rules
2019-01-16 23:36:31 +01:00
Thomas Patzke
7622b17415
Moved test rule to final location/naming scheme
2019-01-14 23:58:25 +01:00
