Florian Roth
3dd76a9c5e
Converted to generic process creation rule
...
Previous rule was prone to FPs; more generic form
2019-05-09 23:48:42 +02:00
Vasiliy Burov
792095734d
Update win_proc_wrong_parent.yml
...
changes accordingly this documents:
https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/
https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf
2019-05-09 23:48:36 +02:00
Florian Roth
378ba5b38f
Transformed rule
...
I would try it like this - the 4th selection for uncommon parents of explorer.exe looks prone to FPs
Fixed Typo
Changes to title and description
2019-05-09 23:48:36 +02:00
Vasiliy Burov
8e6295e402
Windows processes with wrong parent
...
Detect scenarios when malicious program is disguised as legitimate process
2019-05-09 23:48:36 +02:00
Florian Roth
afa18245bf
Merge pull request #254 from darkquasar/master
...
adding MPreter as McAfee classifies it
2019-02-23 07:34:04 +01:00
Thomas Patzke
c17f9d172f
Merge pull request #248 from megan201296/patch-17
...
Create win_mal_ursnif.yml
2019-02-22 21:30:49 +01:00
Thomas Patzke
02239fa288
Changed registry root key
...
According to [this](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-12-registryevent-object-create-and-delete ) it is abbreviated to HKU.
2019-02-22 21:30:30 +01:00
Thomas Patzke
5c63ef17d2
Added further NirSoft tool parameters
2019-02-22 21:15:03 +01:00
vburov
bdf44be077
Update win_susp_process_creations.yml
2019-02-22 22:46:57 +03:00
darkquasar
87994ca46b
adding MPreter as McAfee classifies it
...
McAfee classifies some Meterpreter events with the "Mpreter" keyword
2019-02-22 15:22:10 +11:00
Florian Roth
d3b623e92a
Rule: suspicious pipes extended
...
https://github.com/Neo23x0/sigma/issues/253
2019-02-21 13:26:48 +01:00
Florian Roth
343a40ced7
Rule: extended exec location rule to support 4688 events
2019-02-21 13:26:48 +01:00
Keep Watcher
07dec06222
Fixing yara condition
2019-02-20 10:57:24 -05:00
Florian Roth
eeae74e245
Merge pull request #249 from TareqAlKhatib/duplicate_filters
...
Duplicate Detections
2019-02-18 21:58:39 +01:00
Tareq AlKhatib
2e3a2b9ba6
Merged 'Eventlog Cleared' and 'Eventlog Cleared Experimental'
2019-02-18 21:03:53 +03:00
Florian Roth
f0a4aede24
Rule: RDP over Reverse SSH Tunnel
2019-02-16 19:36:13 +01:00
megan201296
34f9d17b26
Create win_mal_ursnif.yml
2019-02-13 15:22:57 -06:00
Tareq AlKhatib
cd3cdc9451
Removed unnecessary '1 of them' in condition
2019-02-13 21:26:02 +03:00
Florian Roth
8d819cfeea
Rule: fixed bug in Renamed PowerShell rule
2019-02-13 13:23:02 +01:00
Florian Roth
be26ada875
Rule: Suspicious csc.exe parents
2019-02-11 13:50:51 +01:00
Florian Roth
74e3c79f40
Rule: Suspicious PowerShell keywords
2019-02-11 13:02:38 +01:00
Thomas Patzke
01570f88db
YAML fixes
2019-02-10 00:16:27 +01:00
Thomas Patzke
6dd4b4775a
Merge branch 'patch-2' of https://github.com/neu5ron/sigma into neu5ron-patch-2
2019-02-10 00:15:25 +01:00
Thomas Patzke
ff5081f186
Merge branch 'yt0ng-development'
2019-02-10 00:09:29 +01:00
Thomas Patzke
14769938e9
Fixed condition keyword
2019-02-10 00:07:30 +01:00
Thomas Patzke
d43e67a882
Merge branch 'development' of https://github.com/yt0ng/sigma into yt0ng-development
2019-02-10 00:00:45 +01:00
Thomas Patzke
3cd6de2864
Merge pull request #240 from neu5ron/master
...
new rule and updated false positive note
2019-02-09 23:57:39 +01:00
Thomas Patzke
d9aceeb7eb
Merge pull request #228 from keepwatch/ssp-regkey-detection
...
SSP added to LSA configuration
2019-02-09 23:44:55 +01:00
Florian Roth
aab703a4b4
Suspicious calc.exe usage
2019-02-09 14:03:23 +01:00
Florian Roth
efb223b147
Merge pull request #245 from kpolley/master
...
2nd method to call downloadString or downloadFile in Powershell
2019-02-09 09:35:19 +01:00
Florian Roth
7e732a2a89
Merge pull request #232 from TareqAlKhatib/duplicate_filters
...
Duplicate filters
2019-02-09 09:23:57 +01:00
Florian Roth
d2743351e7
Minor fix: indentation
2019-02-09 09:19:40 +01:00
Kyle Polley
c8c06763b4
added keywords & source to sysmon_powershell_download.yml
2019-02-07 18:25:04 -08:00
Nate Guagenti
d151deaa29
Rename win_susp_bcdedit to win_susp_bcdedit.yml
2019-02-07 00:21:57 -05:00
Nate Guagenti
91862f284b
Create win_susp_bcdedit
...
This is a more general rule for possible boot/mbr value edits using bcdedit that I have seen in the wild.
It is different than 3288f6425b/rules/windows/malware/win_mal_wannacry.yml
2019-02-07 00:19:38 -05:00
Florian Roth
adb6690c80
Rule: Suspicious GUP.exe usage
2019-02-06 19:21:16 +01:00
Florian Roth
f0f0bdae40
Rule: fixed date - wrong year
2019-02-06 19:21:16 +01:00
keepwatch
e6217928f3
Added '/' prefix, -encode switch, better renamed certutil coverage
2019-02-06 10:45:32 -05:00
Unknown
2f66ba25f0
adjusted MITRE ATTCK tag
2019-02-06 11:27:51 +01:00
Unknown
4d048c71bb
adjusted spaces
2019-02-06 11:10:42 +01:00
Unknown
54ec01bcdd
adjusted space
2019-02-06 11:10:00 +01:00
Unknown
a0bac993ed
adjusted spaces
2019-02-06 11:07:09 +01:00
t0x1c-1
04f1edd171
added reverted base64 with dosfuscation
2019-02-06 10:59:09 +01:00
t0x1c-1
150499d151
Detects Executables without FileVersion,Description,Product,Company likely created with py2exe
2019-02-06 10:58:37 +01:00
Unknown
c78ac9333c
adjusted formatting
2019-02-06 10:54:12 +01:00
t0x1c-1
21f34ab8ba
suspicious behaviour
2019-02-06 10:52:41 +01:00
neu5ron
35ebcff543
add new rule
2019-02-05 18:56:24 -05:00
neu5ron
65e4ba5aba
added false positive possibility
2019-02-05 18:45:53 -05:00
keepwatch
bad80ffa78
Update sysmon_ssp_added_lsa_config.yml
...
Syntax fix
2019-02-05 16:28:06 -05:00
Florian Roth
8f684ddd06
Rule: FP in WMI persistence with SCCM
2019-02-05 15:57:54 +01:00
