643 Commits

Author	SHA1	Message	Date
Karneades	766b8b8d18	Fix condition	2019-04-04 22:32:47 +02:00
Karneades	788e75ef1b	Fix condition	2019-04-04 22:32:21 +02:00
Karneades	840eb2f519	Remove too loose filter in notepad updater rule	2019-04-04 22:25:05 +02:00
Karneades	eb690d8902	Remove too loose filter in mshta rule	2019-04-04 22:16:24 +02:00
Karneades	1915561351	Remove to loose wildcard from wmi spwns powershell rule	2019-04-04 22:12:28 +02:00
yt0ng	e0459cec1c	renamed file	2019-04-03 17:39:17 +02:00
t0x1c-1	7e058e611c	WMI spawning PowerShell seen in various attacks	2019-04-03 16:56:45 +02:00
Unknown	9ada22b8e0	adjusted link	2019-04-03 16:40:18 +02:00
Unknown	d2e605fc5c	Auto stash before rebase of "Neo23x0/master"	2019-04-03 16:25:18 +02:00
Florian Roth	e473efb7c3	Trying to fix ATT&CK framework tag	2019-04-01 10:36:35 +02:00
Florian Roth	3f2ce4b71f	Lowered level to medium	2019-04-01 09:47:14 +02:00
t0x1c-1	51c42a15a7	Allow Incoming Connections by Port or Application on Windows Firewall	2019-04-01 08:16:56 +02:00
Nate Guagenti	60c4fed2e0	Create win_etw_trace_evasion.yml ... there are two versions of clear and two variations of set that can be used with something like wevtutil `wevtutil cl | wevtutil clear-log | wevtutil sl | wevtutil set-log ` Also, I am adding a `*` match at the end, because there are other parameters that could be placed on the end -- so unless this was used on a general search on a text/analyzed field then the `*` is necessary. example `wevtutil set-log Microsoft-Windows-WMI-Activity/Trace /e:disable /q:true`	2019-03-22 11:36:55 -04:00
Florian Roth	ffac77fb37	Rule: extended LockerGoga description	2019-03-22 11:03:48 +01:00
Florian Roth	1adb040e0b	Rule: LockerGoga	2019-03-22 10:59:31 +01:00
Florian Roth	2ad2ba9589	fix: rule field fix in proc_creation rule	2019-03-22 10:59:18 +01:00
Thomas Patzke	be25aa2c37	Added CAR tags	2019-03-16 00:37:09 +01:00
Thomas Patzke	8512417de0	Incorporated MITRE CAR mapping from #55	2019-03-16 00:03:27 +01:00
Yugoslavskiy Daniil	5d54e9c8a1	nbstat.exe -> nbtstat.exe	2019-03-11 19:28:29 +01:00
Thomas Patzke	3c1948f089	Merge pull request #277 from megan201296/patch-18 ... Remove invalid link	2019-03-07 23:49:13 +01:00
Yugoslavskiy Daniil	475113b1c1	fixed incorrect date format	2019-03-07 22:52:11 +01:00
megan201296	c2a16591af	Remove invalid link ... Cybereason link was broken. Couldn't find anything with a super similar file path. The below link might be a valid replacement but went better safe than sorry and just removed it completely. https://www.cybereason.com/hubfs/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty-Part1.pdf	2019-03-07 14:22:29 -06:00
Yugoslavskiy Daniil	cb7243de5d	fixed wrong tags	2019-03-06 06:18:38 +01:00
Yugoslavskiy Daniil	8bec627ff1	fixed multiple tags issue	2019-03-06 06:09:37 +01:00
Yugoslavskiy Daniil	5154460726	changed service to product	2019-03-06 05:57:01 +01:00
Yugoslavskiy Daniil	05cc7e455d	atc review	2019-03-06 05:25:12 +01:00
yugoslavskiy	725ab99e90	Merge pull request #1 from AverageS/master ... Fix rules	2019-03-06 04:31:01 +01:00
Wydra Mateusz	534f250c35	Merge branch 'master' of https://github.com/krakow2600/sigma	2019-03-06 00:45:16 +01:00
Wydra Mateusz	bb95347745	rules update	2019-03-06 00:43:42 +01:00
mrblacyk	6232362f04	Missing tags	2019-03-06 00:16:40 +01:00
mrblacyk	07807837ee	Missing tags	2019-03-06 00:02:37 +01:00
mikhail	be108d95cc	Merge branch 'master' of https://github.com/AverageS/sigma	2019-03-06 01:57:38 +03:00
mikhail	40241c1fdf	Fix 4 rules	2019-03-06 01:56:05 +03:00
mrblacyk	99595a7f89	Added missing tags and some minor improvements	2019-03-05 23:25:49 +01:00
Florian Roth	7b3d67ae66	fix: bugfix in new proc creation rule	2019-03-02 11:28:13 +01:00
Florian Roth	1a583c158d	fixed typo as in pull request by @m0jtaba	2019-03-02 08:16:25 +01:00
Florian Roth	2188001f98	Extended filter list provided by @Ov3rflow	2019-03-02 08:13:29 +01:00
Thomas Patzke	56a1ed1eac	Merge branch 'project-1'	2019-03-02 00:26:10 +01:00
Thomas Patzke	7602309138	Increased indentation to 4 ... * Converted (to generic sigma) rules * Converter outputs by default with indentation 4	2019-03-02 00:14:20 +01:00
Thomas Patzke	6bdb4ab78a	Merge cleanup	2019-02-27 22:05:27 +01:00
Thomas Patzke	c922f7d73f	Merge branch 'master' into project-1	2019-02-26 00:24:46 +01:00
Thomas Patzke	96eb460944	Converted Sysmon/1 and Security/4688 to generic process creation rules	2019-01-16 23:36:31 +01:00
Thomas Patzke	7622b17415	Moved test rule to final location/naming scheme	2019-01-14 23:58:25 +01:00