frack113
37c637066b
add process_creation_conti_cmd_ransomware.yml
2021-10-12 20:57:12 +02:00
frack113
9b2b8dd2c3
Merge pull request #2134 from frack113/new_category
...
New category for powershell rules
2021-10-11 15:43:55 +01:00
frack113
b9fc29bc05
Merge pull request #2131 from frack113/Powershell
...
Powershell order
2021-10-11 15:43:32 +01:00
frack113
f1d5605f10
fix yml space
2021-10-11 07:44:48 +02:00
frack113
9810a9fe73
add powershell.yml
2021-10-11 07:42:04 +02:00
frack113
d081d20a13
Merge pull request #2119 from austinsonger/privilege_escalation_pass_role_to_lambda_function.yml
...
passed_role_to_glue_development_endpoint.yml and passed_role_to_lambda_function.yml
2021-10-10 11:01:36 +02:00
frack113
7497fdb484
Merge pull request #2129 from d4rk-d4nph3/master
...
Added rule for possible persistence via VMTools
2021-10-10 10:55:06 +02:00
frack113
1337116d84
Cleanup selection name
2021-10-10 10:17:24 +02:00
Bhabesh Rai
a241f526ef
Added more strict path
2021-10-10 07:54:40 +05:45
Austin Songer
1987897a76
Update aws_pass_role_to_lambda_function.yml
2021-10-09 15:26:38 -05:00
Austin Songer
de52890a62
Update passed_role_to_glue_development_endpoint.yml
2021-10-09 15:24:49 -05:00
Florian Roth
30213dba87
Merge pull request #2132 from SigmaHQ/rule-devel
...
New Rules
2021-10-09 19:19:45 +02:00
Florian Roth
195db4cffc
refactor: made Apache RCE rule more robust
2021-10-09 18:48:02 +02:00
Florian Roth
4ab3ebf6b2
Merge pull request #2128 from OTRF/feature/Susp-ADFS-NamedPipe
...
Detect suspicious named pipe connections to an AD FS WID
2021-10-09 16:47:25 +02:00
Florian Roth
2379907f26
docs: extended the description by a word
2021-10-09 16:42:42 +02:00
Florian Roth
f475b90ee3
fix: typo in description
2021-10-09 16:41:48 +02:00
frack113
5c68c42058
order powershell_script
2021-10-09 10:30:36 +02:00
Florian Roth
6c4e24d0de
rule: coin miner param --cpu-priority
2021-10-09 10:28:16 +02:00
frack113
77749510b7
fix yml
2021-10-09 10:01:40 +02:00
frack113
41d098b253
fix yml error
2021-10-09 09:59:21 +02:00
frack113
9b0f744f75
order powershell_script
2021-10-09 09:57:45 +02:00
frack113
fe7fbfd5fc
order powershell_module
2021-10-09 09:50:49 +02:00
Florian Roth
5b49b5ee17
Merge pull request #2130 from phantinuss/master
...
fix: prevent FP triggering of other sources utilising ID 1102
2021-10-08 20:14:08 +02:00
phantinuss
04c37d977b
fix: prevent FP triggering of other sources utilising ID 1102
2021-10-08 16:43:14 +02:00
frack113
98b24d30ae
Merge pull request #2125 from frack113/nuclei_iis_fuzzing
...
Nuclei iis fuzzing
2021-10-08 16:40:01 +02:00
frack113
5e08c121fa
Merge pull request #2127 from mluhta/patch-1
...
Fix Regsvr32 Command Line Without DLL detection logic
2021-10-08 16:38:20 +02:00
Bhabesh Rai
a45e516f99
Added rule for possible persistence via VMTools
2021-10-08 13:28:35 +05:45
Roberto Rodriguez
7f17eaeb87
added rule to detect suspicious named pipe connections to an AD FS server
2021-10-08 01:57:22 -04:00
Mika Luhta
e70d17745e
Update modified field
2021-10-07 18:42:22 +02:00
Mika Luhta
0ee777e3b4
Fix rule detection logic
...
Changed ParentImage to Image
2021-10-07 14:25:18 +03:00
frack113
0d04b469f7
order powershell_classic
2021-10-07 07:40:53 +02:00
frack113
930d2d4223
fix id
2021-10-06 17:53:16 +02:00
frack113
dfd316c0ce
Add web_iis_tilt_shortname_scan.yml
2021-10-06 17:46:15 +02:00
frack113
6d56e400d2
Merge pull request #2121 from frack113/update_test
...
Update test adding logsource to duplicate logic test
2021-10-06 14:46:48 +02:00
Florian Roth
7cf01c2f0c
extended CVE-2021-41773 rule
2021-10-06 12:43:10 +02:00
Florian Roth
539756c884
Merge pull request #2124 from SigmaHQ/rule-devel
...
rule: Apache Path Traversal - CVE-2021-41773
2021-10-06 10:55:26 +02:00
frack113
d0561d361b
Merge pull request #2123 from rachelrice/update_aws_rules
...
Update AWS SAML and Lambda rules
2021-10-05 19:49:54 +02:00
Rachel Rice
d9e5da6c86
Use startswith for eventName selection
...
Signed-off-by: Rachel Rice <rachel.rice@lacework.net>
2021-10-05 17:52:52 +01:00
Florian Roth
5576f50470
fix: title, add my name
2021-10-05 17:35:09 +02:00
Florian Roth
0fde46b602
Merge branch 'master' into rule-devel
2021-10-05 17:33:48 +02:00
Florian Roth
482df0a0ad
rule: Apache Vuln CVE-2021-41773
2021-10-05 17:33:37 +02:00
frack113
651d453aeb
Merge pull request #2122 from frack113/move_file
...
Move file to correct directory
2021-10-05 16:58:26 +02:00
frack113
ba3356cdb0
Merge pull request #2120 from MetallicHack/master
...
azure_ad_user_added_to_admin_role.yml
2021-10-05 16:57:58 +02:00
Rachel Rice
4ae3ece314
Update AWS SAML and Lambda rules
...
Use correct case for `AssumeRoleWithSAML` event name.
`UpdateFunctionConfiguration`, `UpdateFunctionConfiguration20150331` and `UpdateFunctionConfiguration20150331v2` are all valid event names for updating Lambda function configuration, added selection condition for any of these.
2021-10-05 14:08:40 +01:00
MetallicHack
030fc2a03e
change title and tags in order to match sigmarules
2021-10-05 09:40:25 +02:00
MetallicHack
a4100e76b9
change title and tags in order to match sigmarules
2021-10-05 09:39:03 +02:00
frack113
ad9362e043
Update passed_role_to_glue_development_endpoint.yml
2021-10-05 07:41:41 +02:00
frack113
3b01425936
Update aws_pass_role_to_lambda_function.yml
2021-10-05 07:40:42 +02:00
frack113
80d09483d9
move to builtin
2021-10-05 07:33:50 +02:00
frack113
4f86a245f8
Order file i correct directory
2021-10-05 07:30:43 +02:00
