valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 17:35:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
8,020 Commits 20 Branches 25 Tags 21 MiB
416b0556b1
Commit Graph

5956 Commits

Author SHA1 Message Date
Cyb3rEng
8dc1b03fef
Completed Changes Based on Comments 
Removed :
unnecessary event ID
 2021-09-07 21:19:43 -06:00
Cyb3rEng
bd4d21c41c
Completed changes based on comments 
Removed :
unnecessary event ID
 2021-09-07 21:17:12 -06:00
Cyb3rEng
75a6e5c95b
Completed Changes as per comments 
Removed :
unnecessary event ID
 2021-09-07 21:14:06 -06:00
Cyb3rEng
3b2ebe1580
Completed changes 
Removed :
unnecessary event ID
 2021-09-07 21:12:02 -06:00
Cyb3rEng
8467d5a65a
Modified Rule 
Removed :
unnecessary event ID
 2021-09-07 21:09:07 -06:00
Cyb3rEng
f0f3ecfe2f
Converted to LF 
Removed :
unnecessary event ID
 2021-09-07 21:00:35 -06:00
Cyb3rEng
932b7cf2ba
Merge branch 'SigmaHQ:master' into master 2021-09-07 19:58:09 -06:00
Thomas Patzke
d9edc9f0e3 Merge branch 'fix' 2021-09-08 00:19:09 +02:00
Thomas Patzke
143744bc12 Various fixes 
* Backslashes in regular expressions
* Casing of condition operators
* Further small errors
 2021-09-07 23:38:07 +02:00
frack113
4c3f8821c4 add missing tags 2021-09-07 18:16:46 +02:00
frack113
4e394d83a1 add missing tags 2021-09-07 17:45:41 +02:00
Rachel Rice
be5351947c
Unset date update 
Signed-off-by: Rachel Rice <rachel.rice@lacework.net>
 2021-09-07 16:36:59 +01:00
Florian Roth
1a55f4a294
filter: empty thumbprint, PetitPotam rule 2021-09-07 14:37:03 +02:00
Rachel Rice
eef6e71e2e
Update AWS Update Login Profile Rule fields 
Missed updating field from `responseElements.accessKey.userName` to `requestParameters.userName` on last update.
 2021-09-07 12:39:56 +01:00
frack113
0e5e4fa19d Split global rules 2021-09-07 13:30:32 +02:00
Florian Roth
cfbde22d2d
rule: PRIVATELOG image load 2021-09-07 10:10:14 +02:00
Florian Roth
3a305e82b9
fix: remove renamed files 2021-09-07 09:28:20 +02:00
Florian Roth
a8d8d878a0
remove uppercase files 2021-09-07 09:27:11 +02:00
Florian Roth
8b4fce3473
removed unneeded upper ticks 2021-09-07 09:21:44 +02:00
Florian Roth
c082ce0fe0
Merge branch 'master' into rule-devel 2021-09-07 09:20:47 +02:00
Florian Roth
57bfdc7a02
fix: more upper case chars 2021-09-07 09:19:23 +02:00
Florian Roth
0cce1c0245
fix: missing lowercase chars 2021-09-07 09:17:25 +02:00
Florian Roth
33be089ea2
fix: filename to lowercase 2021-09-07 09:16:35 +02:00
frack113
4f6b87fed5
Merge pull request #1997 from zakibro/master 
New Rule - Linux Hidden Files and Directories
 2021-09-07 09:12:04 +02:00
zakibro
bba66ca762
Update lnx_auditd_hidden_files_directories.yml 
Updating arguments section
 2021-09-07 07:57:50 +02:00
frack113
be442182fe convert to LF 2021-09-06 21:10:08 +02:00
frack113
9ef299c4f4 Change to LF 2021-09-06 21:07:49 +02:00
frack113
3b95b0c913
Remove useless Eventid 
Use tools/config/generic/windows-audit.yml to convert for security 4688
 2021-09-06 20:56:41 +02:00
zakibro
e9fa5bde2b
Update lnx_auditd_hidden_files_directories.yml 
Correction of tag
 2021-09-06 18:55:58 +02:00
Pawel Mazur
7c2895c73f New Rule - Linux Hidden Files and Directories 2021-09-06 18:43:49 +02:00
Pawel Mazur
59eb7ce032 Merge branch 'master' of https://github.com/zakibro/sigma 2021-09-06 18:41:19 +02:00
Pawel Mazur
9f5f25e480 New Rule - Linux Hidden Files and Directories 2021-09-06 18:40:39 +02:00
zakibro
f52860d6ab
Merge branch 'SigmaHQ:master' into master 2021-09-06 18:40:02 +02:00
Pawel Mazur
3eb354e34c Merge branch 'master' of https://github.com/zakibro/sigma 2021-09-06 18:37:45 +02:00
Pawel Mazur
ef3efd8fd3 New Rule Linux - Hidden Files and Directories 2021-09-06 18:37:02 +02:00
Austin Songer
0de95e355a
Update azure_federation_modified.yml 2021-09-06 11:31:52 -05:00
Austin Songer
e6e3fc2eec
Update azure_federation_modified.yml 2021-09-06 11:16:35 -05:00
Austin Songer
6025df63ee
Create azure_federation_modified.yml 2021-09-06 11:06:58 -05:00
Florian Roth
6b2bacd2cc
Merge pull request #1979 from frack113/test_global 
Change ID in global action rule
 2021-09-06 08:44:14 +02:00
frack113
013eb2e11f
Merge pull request #1993 from zakibro/master 
New Rule - Linux-Audio-Capture
 2021-09-05 18:30:45 +02:00
frack113
44a5792be3 Revert win_apt_apt29_tor.yml 2021-09-05 12:34:24 +02:00
frack113
ca4c156fa4 Update win_apt_apt29_tor.yml 2021-09-05 11:20:57 +02:00
frack113
acf2bfbd27 Update sigma_uuid verify 
Make a better verify code
 2021-09-05 10:43:42 +02:00
zakibro
5042ba65ac
Update lnx_auditd_audio_capture.yml 
Added more references about arecord.
 2021-09-05 09:28:53 +02:00
Austin Songer
fa5554660c
Update sysmon_mal_cobaltstrike_re.yml 2021-09-04 17:33:05 -05:00
Pawel Mazur
caf78b5ea1 New Rule - Linux-Audio-Capture 2021-09-04 22:10:34 +02:00
Austin Songer
e7c5827776
Update azure_service_principal_removed.yml 2021-09-03 22:43:11 -05:00
Austin Songer
0612ea7f6e
Update azure_device_no_longer_managed_or_compliant.yml 2021-09-03 22:42:26 -05:00
Austin Songer
c420a17e05
Update azure_service_principal_removed.yml 2021-09-03 22:29:21 -05:00
Austin Songer
fda1e3362e
Update azure_owner_removed_from_application_or_service_principal.yml 2021-09-03 22:29:12 -05:00
Austin Songer
9d26116d27
Update azure_device_no_longer_managed_or_compliant.yml 2021-09-03 22:29:02 -05:00
Austin Songer
8fe7bfc452
Update azure_application_deleted.yml 2021-09-03 22:28:53 -05:00
Austin Songer
c021ae9e7c
Update and rename azure_device_or_configuration_deleted.yml to azure_device_or_configuration_modified_or_deleted.yml 2021-09-03 22:28:35 -05:00
Austin Songer
6744fb7f2e
Create azure_application_deleted.yml 2021-09-03 22:25:34 -05:00
Austin Songer
70ac0104cf
Create azure_service_principal_removed.yml 2021-09-03 22:25:01 -05:00
Austin Songer
6e15618c75
Create azure_device_or_configuration_deleted.yml 2021-09-03 22:24:32 -05:00
Austin Songer
b478132769
Create azure_owner_removed_from_application_or_service_principal.yml 2021-09-03 22:23:59 -05:00
Austin Songer
c0bdc3fb1b
Create azure_device_no_longer_managed_or_compliant.yml 2021-09-03 22:23:21 -05:00
frack113
6780182c37
Merge pull request #1974 from frack113/tags_pack2 
Add missing Tags
 2021-09-03 19:13:32 +02:00
frack113
2e474628fa
Merge pull request #1987 from zakibro/master 
New Rule - Linux-Auditd-System Information Discovery
 2021-09-03 19:10:28 +02:00
frack113
688df3405a
Merge pull request #1970 from frack113/red_T1564.004_1 
Redcanary  t1564.004  ADS test 1
 2021-09-03 19:06:51 +02:00
frack113
77c6b74c72
Merge pull request #1985 from mvelazc0/master 
Adding Petitpotam/ADCS attack vector detections
 2021-09-03 19:06:03 +02:00
mvelazco
a7a002cb7f updating fields as per frack113 feedback 2021-09-03 10:01:54 -04:00
frack113
769451dc03
Add missing id 2021-09-03 13:42:15 +02:00
frack113
815134df7f
Cleanup 2021-09-03 13:30:10 +02:00
phantinuss
aa2e86963c
fix: rename filter 2021-09-03 13:26:34 +02:00
phantinuss
f3bdb0e43d
fix: remove unneeded selection 2021-09-03 13:26:23 +02:00
phantinuss
2de2de8433
Addition to UAC Bypasses 2021-09-03 13:26:11 +02:00
zakibro
8bd859f550
Update lnx_auditd_system_info_discovery.yml 2021-09-03 13:07:42 +02:00
ncrqnt
adc3c9e608 fixed date: switched day/month 2021-09-03 12:03:38 +02:00
Pawel Mazur
864286e206 New Rule - Linux-Auditd-System Information Discovery 2021-09-03 11:33:18 +02:00
frack113
89562273cc
Merge pull request #1984 from austinsonger/azure_app_credential_modification.yml 
azure_app_credential_modification.yml
 2021-09-03 08:17:55 +02:00
frack113
88389f945d
Merge pull request #1983 from austinsonger/azure_service_principal_created.yml 
azure_service_principal_created.yml
 2021-09-03 08:14:47 +02:00
frack113
d40cdec062
Merge pull request #1982 from austinsonger/azure_network_firewall_policy_modified_or_deleted.yml 
azure_network_firewall_policy_modified_or_deleted.yml
 2021-09-03 08:13:30 +02:00
frack113
bd1b4c0d70
Merge pull request #1978 from rachelrice/update_aws_login 
Update AWS Update Login Profile rule
 2021-09-03 08:12:28 +02:00
frack113
1fc2a39720
Merge pull request #1975 from frack113/red_T1564.004_2 
Redcanary  t1564.004 test 2
 2021-09-03 08:12:08 +02:00
frack113
11e4b900e4 Update global id 2021-09-03 06:59:40 +02:00
frack113
135d0a2c61 Update global id 2021-09-03 06:50:00 +02:00
frack113
a6bb5574fb Update global id 2021-09-03 06:35:35 +02:00
mvelazco
ba41e922d2 adding Petitpotam host detections 2021-09-03 00:12:49 -04:00
Austin Songer
775c0e8e7f
Update azure_app_credential_modification.yml 2021-09-02 21:00:21 -05:00
Austin Songer
643ec0abe3
Update azure_service_principal_created.yml 2021-09-02 21:00:02 -05:00
Austin Songer
10af7bbdb1
Create azure_app_credential_modification.yml 2021-09-02 20:53:32 -05:00
Austin Songer
d25fd420d6
Create azure_service_principal_created.yml 2021-09-02 20:48:35 -05:00
Austin Songer
1272c76ae7
Create azure_network_firewall_policy_modified_or_deleted.yml 2021-09-02 20:31:27 -05:00
frack113
d02ee1eddd Update global ID 2021-09-02 21:16:55 +02:00
frack113
f90c7558a7 update global id 2021-09-02 21:03:25 +02:00
frack113
ac90ee0002 Update global ID 2021-09-02 20:23:23 +02:00
frack113
086a15fc45 Update global ID 2021-09-02 20:07:03 +02:00
Rachel Rice
78d3fa4795
Update AWS STS AssumeRole Misuse rule 
Update selection criteria for AWS STS AssumeRole Misuse rule for any event by an AssumedRole userIdentity.
Closes SigmaHQ/sigma#1963.
 2021-09-02 17:40:35 +01:00
Rachel Rice
7ccb773b20
Update AWS Update Login Profile rule 
Update selection criteria for AWS Update Login Profile rule to check for mismatch between userIdentity.arn and requestParameters.userName.
Closes SigmaHQ/sigma#1966.
 2021-09-02 17:37:41 +01:00
frack113
9bcefc6a93 move uuid from global 2021-09-02 16:05:05 +02:00
frack113
b731c20594
Merge pull request #1971 from phantinuss/master 
fix: prevent possible FPs
 2021-09-02 15:34:46 +02:00
frack113
a048403089
Merge pull request #1973 from klingerko/cs_namedpipe_updates 
Remove duplicate and regex improvements
 2021-09-02 15:25:01 +02:00
phantinuss
ab721c736c
chore: move level/falsepositives to bottom 2021-09-02 14:55:17 +02:00
klingerko
15e25f9635 update modifed date 2021-09-02 14:50:14 +02:00
phantinuss
0b373ff1e9
fix: remove 2nd selection due to FPs 2021-09-02 14:47:47 +02:00
frack113
6a1b95d947
Findstr covert by win_susp_findstr.yml 2021-09-02 14:22:59 +02:00
frack113
aaa568ff2d
print covert by win_susp_print.yml 2021-09-02 14:18:38 +02:00
phantinuss
5cb6eed52e
fix: remove single value lists 2021-09-02 14:09:03 +02:00
phantinuss
f4a5df67ae
further narrowing down of the selection, therefore removing the filter 2021-09-02 10:28:01 +02:00
frack113
90e673e5ac fix invalid tags 2021-09-02 10:17:50 +02:00
Florian Roth
0603581111
Merge pull request #1969 from SigmaHQ/rule-devel 
More Named Pipe Rules and WMI rule refactoring
 2021-09-02 10:15:00 +02:00
frack113
6f1f70ca5e Add missing tags 2021-09-02 09:59:19 +02:00
frack113
25c6f69ea3 update references 2021-09-02 09:51:44 +02:00
frack113
5e87970c77 add powershell_store_file_in_alternate_data_stream.yml 2021-09-02 09:47:54 +02:00
frack113
5212b388c6
Merge pull request #1967 from d4rk-d4nph3/master 
Added rule for detection of Atera RMM Agent installation
 2021-09-02 09:19:49 +02:00
frack113
e0cd35261c add missing tags 2021-09-01 20:01:03 +02:00
frack113
1ba0a7c7a3 add missing tags 2021-09-01 19:38:35 +02:00
Konstantin Klinger
457da818a4 regex optimisations 2021-09-01 17:06:55 +02:00
Konstantin Klinger
e83ee55573 remove duplicate 2021-09-01 17:05:36 +02:00
Florian Roth
b0c2d7b75a
fix: tags for WMI / execution / persistence 2021-09-01 16:34:50 +02:00
Florian Roth
2f7f050ad8
fix: removed tags 2021-09-01 16:32:27 +02:00
phantinuss
0b38237dbf
fix: add relation to now obsolete rule 2021-09-01 15:38:29 +02:00
phantinuss
ae9966bdcc
fix: unifying two overlapping rules 2021-09-01 14:48:32 +02:00
phantinuss
deefcaa8ac
fix: prevent possible FPs with the respective command only used as the last parameter 2021-09-01 14:33:46 +02:00
frack113
434c3891ff
Merge pull request #1965 from frack113/add_tags 
Add tags when missing
 2021-09-01 14:07:31 +02:00
Florian Roth
1aac21ba79
fix: single list item issue 2021-09-01 14:03:42 +02:00
Florian Roth
1c4f642227
Merge pull request #1699 from matsto/patch-1 
Fixed transformation modifier for keywords
 2021-09-01 14:02:10 +02:00
frack113
2dbbaf0180 fix missing char in date 2021-09-01 14:00:55 +02:00
Florian Roth
505140d273
rule: extended WMI suspicious scripts rule 2021-09-01 13:57:48 +02:00
Florian Roth
e787420be1
rule: WMI filter content encoded executable 2021-09-01 13:57:36 +02:00
Florian Roth
8761927e8c
rule: susp scrcons.exe creating named pipe 2021-09-01 13:57:17 +02:00
frack113
e71fce6f11 fix errors 2021-09-01 13:55:14 +02:00
Florian Roth
affc929c3b
LiquidSnake named pipe 2021-09-01 13:54:47 +02:00
frack113
80dbfa7af5 add process_creation_alternate_data_streams.yml 2021-09-01 13:52:09 +02:00
Florian Roth
c8b3036949
Merge pull request #1968 from SigmaHQ/rule-devel 
docs: note to improved sysmon config
 2021-09-01 13:21:28 +02:00
Florian Roth
f102b2d9a1
docs: note to improved sysmon config 2021-09-01 13:07:18 +02:00
Florian Roth
8bba246205
refactor: better way to write it 2021-09-01 12:57:34 +02:00
frack113
2cb5f5e4c6 add missing tags 2021-09-01 12:54:21 +02:00
Florian Roth
c146bc44c7
Merge branch 'master' into patch-1 2021-09-01 12:48:51 +02:00
Bhabesh Rai
6859b6c38f Added rule for detection of Atera RMM Agent installation 2021-09-01 15:24:47 +05:45
frack113
af599e4877
Merge pull request #1958 from phantinuss/master 
Bulk of new rules, mainly UAC Bypasses
 2021-09-01 10:53:02 +02:00
frack113
892c58270a Update tags 2021-09-01 10:33:57 +02:00
frack113
4b8ffbc183 Update tags 2021-09-01 10:30:43 +02:00
phantinuss
9ffdced740
fix: implement suggestions from PR discussion 2021-09-01 10:21:37 +02:00
frack113
240c5584ff update tags 2021-09-01 09:56:46 +02:00
frack113
6f3fc7036e Update tags 2021-09-01 09:45:31 +02:00
frack113
3ed7d6e330
Merge pull request #1959 from frack113/update_ps 
Update PowerShell rules
 2021-09-01 08:06:31 +02:00
frack113
b8a1f4c63b
Merge pull request #1961 from SigmaHQ/rule-devel 
SideWalk User-Agent used by Sparkling Goblin
 2021-09-01 08:06:15 +02:00
Cyb3rEng
470d64e66c
Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:28:34 -06:00
Cyb3rEng
e0e1396dff
Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:26:44 -06:00
Cyb3rEng
e7c7e4c061
Updated Rule 
Detection changed to #useful_information
 2021-08-31 22:24:28 -06:00
Cyb3rEng
f2b8b83fe3
Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:23:45 -06:00
Cyb3rEng
0d2257fb19
Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:22:01 -06:00
Cyb3rEng
1b9a0c4a01
Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:20:17 -06:00
Cyb3rEng
c5507658c0
Updated Rule 
updated title
 2021-08-31 22:13:31 -06:00
Cyb3rEng
d309784e58
Updated Rule 
Modified Title
 2021-08-31 22:12:34 -06:00
Cyb3rEng
93334878f5
Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:09:57 -06:00
Cyb3rEng
785fc98ee3
Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 22:05:10 -06:00
Cyb3rEng
d5f73a8910
Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 22:03:31 -06:00
Cyb3rEng
fa3b882fdc
Updated Rule 
Removed " " from falsepositives section
 2021-08-31 21:58:50 -06:00
Cyb3rEng
c7c49c55d2
Updated Rule 
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 21:58:09 -06:00
Cyb3rEng
d5fa226180
Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 21:54:32 -06:00
Cyb3rEng
900f71e6b2
Rule Update Review 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 21:50:44 -06:00
Florian Roth
9b20060275
SideWalk UA 2021-08-31 17:14:19 +02:00
frack113
cff572b752
Update sysmon_dns_over_https_enabled.yml 2021-08-31 17:11:04 +02:00
phantinuss
add1ad40f8
additional UAC bypass rule 2021-08-31 16:23:32 +02:00
phantinuss
59d8e0b866
add System IntegrityLevel to uac bypass rules, the level is not used most of the time, but might 2021-08-31 16:18:05 +02:00
Austin Songer
9dc8d38565
Create sysmon_dns_over_https_enabled.yml 2021-08-31 09:14:14 -05:00
phantinuss
6eb7245673
fix: remove user sid, match any sid instead 2021-08-31 15:58:57 +02:00
frack113
eb434732a7 move rule not only powershell 2021-08-31 13:48:07 +02:00
frack113
18cdc36d73 Fix EventID 4103 detection 2021-08-31 13:44:54 +02:00
phantinuss
3a9e10d081
bulk of new rules to match working UACMe UAC bypasses 2021-08-31 12:51:21 +02:00
phantinuss
ea77d9161e
add another possible sdclt uac bypass registry path 2021-08-31 12:51:21 +02:00
phantinuss
50b8ca5110
add more COM interfaces and sharpen rule logic 2021-08-31 12:51:21 +02:00
phantinuss
3155f7172d
detection for proxyshell MSF module 2021-08-31 12:51:16 +02:00
frack113
b25fbbea54
Merge pull request #1957 from d4rk-d4nph3/master 
Added new malwarebytes reference for Cab File Expansion rule
 2021-08-31 09:54:47 +02:00
Bhabesh Rai
911c45201a Added -F option support 2021-08-31 13:02:53 +05:45
frack113
89e21c69ef fix detection 2021-08-31 09:07:54 +02:00
Bhabesh Rai
e2bfaea10f Added new malwarebytes reference for Cab File Expansion rule 2021-08-31 11:35:54 +05:45
Cyb3rEng
e913032865
Add files via upload 2021-08-30 21:50:16 -06:00
Cyb3rEng
6c9b2a2f37
Add files via upload 2021-08-30 21:48:03 -06:00
Cyb3rEng
5508ff45b6
Add files via upload 2021-08-30 21:47:36 -06:00
frack113
acf59f9795 Fix some errors 2021-08-30 19:49:44 +02:00
Florian Roth
a5c6bbe04d
Merge pull request #1946 from SigmaHQ/rule-devel 
rule: ProxyToken CVE-2021-33766 Exchange
 2021-08-30 17:39:37 +02:00
Florian Roth
af9392ba0f
refactor: add 500 status code in selection2 
to avoid FPs with exploitation attempts
 2021-08-30 16:12:42 +02:00
Florian Roth
36a227796a
Merge pull request #1945 from SigmaHQ/rule-devel 
rules: cobalt strike rules refactored
 2021-08-30 15:48:01 +02:00
Florian Roth
4a4966af77
rule: ProxyToken CVE-2021-33766 Exchange 2021-08-30 15:47:53 +02:00
Florian Roth
98de92ceaf
refactor: global rule match on system and security 2021-08-30 15:17:53 +02:00
Florian Roth
1ded4eb913
rules: cobalt strike rules refactored 2021-08-30 15:10:30 +02:00
frack113
772fe06e10 fix Backend does not support map values of type <class 'bool'> (57) 2021-08-29 09:10:30 +02:00
frack113
5ad29cf0c2 fix Base backend doesn't support multiple conditions (29) 2021-08-29 09:03:50 +02:00
frack113
718b44c38a fix List values must be strings or numbers (46) 2021-08-29 08:57:25 +02:00
frack113
4c414b2e8b fix Base backend doesn't support multiple conditions (33) 2021-08-29 08:52:54 +02:00
frack113
970dfa2f92
Merge pull request #1938 from EvanYu0816/upstream-fixes 
Fix Pass the Hash and NotPetya Ransomware rule
 2021-08-28 21:02:04 +02:00
frack113
a7456d4d6c
Merge pull request #1940 from frack113/fix_ps_fp 
Powershell correction
 2021-08-28 20:48:07 +02:00
frack113
3e355c64db
Merge pull request #1939 from SigmaHQ/rule-devel 
rule: UAC bypass by mocking dirs
 2021-08-28 20:47:27 +02:00
frack113
68237dffc4 fix HostApplication 2021-08-28 08:18:47 +02:00
frack113
ef6e0c5a4c Fix error and FP 2021-08-28 08:02:16 +02:00
Florian Roth
f78225c394
rule: UAC bypass by mocking dirs 2021-08-27 18:12:21 +02:00
Evan Yu
178d82e9cd Fix NotPetya Ransomware rule 2021-08-27 11:53:50 -04:00
Evan Yu
8bdd3e3987 Simplify Pass the Pash rule 2021-08-27 11:53:28 -04:00
frack113
ff37a49dc0
Merge pull request #1930 from SigmaHQ/rule-devel 
fix: FPs with whoami rule and 4688 event IDs without parent info
 2021-08-27 06:27:30 +02:00
frack113
0de795b0a2
Merge pull request #1936 from austinsonger/gworkspace_application_remove.yml 
add gworkspace_application_remove.yml
 2021-08-27 06:25:15 +02:00
frack113
00cceb7be8
Merge pull request #1935 from austinsonger/gworkspace_mfa_disabled.yml 
add gworkspace_mfa_disabled.yml
 2021-08-27 06:24:26 +02:00
Austin Songer
72485a5619
Update gworkspace_application_removed.yml 2021-08-26 21:16:21 -05:00
Austin Songer
62cefcc028
Rename gworkspace_application_remove.dyml to gworkspace_application_removed.yml 2021-08-26 21:15:56 -05:00
Austin Songer
bc246ff59d
Rename gworkspace_application_remove.yml to gworkspace_application_remove.dyml 2021-08-26 20:58:22 -05:00
Austin Songer
55f5ff3d89 Application Removed 2021-08-26 20:55:07 -05:00
Austin Songer
1fffb7a3f5 Gworkspace MFA disabled. 2021-08-26 20:28:35 -05:00
Roberto Rodriguez
f05cf20b12 Merge branch 'master' into feature/AADHealth-Agent-HybridADFSServices 2021-08-26 16:12:38 -04:00
Roberto Rodriguez
f98970ef06 adding basic rules to detect behavior around AAD health agents and AAD Hybrid Health AD FS services in Azure 2021-08-26 16:10:42 -04:00
frack113
a6149462d8
Merge pull request #1931 from phantinuss/master 
More malleable CobaltStrike C2 profiles from new source/reference
 2021-08-26 17:18:19 +02:00
frack113
59000b993d
Merge pull request #1932 from mlp1515/french_user 
Add French user
 2021-08-26 17:12:39 +02:00
phantinuss
e59b8e1e3e
add applicable pipe names from regex rule 2021-08-26 14:53:20 +02:00
mlp1515
cce7cfc79a
Update win_tool_psexec.yml 
French language settings
 2021-08-26 12:51:45 +00:00
mlp1515
e1aa82b412
Update win_susp_tscon_localsystem.yml 
French language settings
 2021-08-26 12:50:24 +00:00
mlp1515
e9ed5f592c
Update sysmon_always_install_elevated_windows_installer.yml 
French language settings
 2021-08-26 12:48:59 +00:00
mlp1515
4f49f03460
Update sysmon_abusing_debug_privilege.yml 
French language settings
 2021-08-26 12:46:15 +00:00
mlp1515
a31422db74
Update win_susp_schtask_creation.yml 
French language settings
 2021-08-26 12:45:24 +00:00
mlp1515
5f419d6f35
Update win_susp_taskmgr_localsystem.yml 
French language settings
 2021-08-26 12:44:35 +00:00
mlp1515
5545403a9b
Update win_whoami_as_system.yml 
French language settings
 2021-08-26 12:43:33 +00:00
mlp1515
7ad927f28e
Update win_wmiprvse_spawning_process.yml 
French language settings
 2021-08-26 12:42:47 +00:00
mlp1515
644397e65c
Update win_exploit_cve_2019_1388.yml 
French language settings
 2021-08-26 12:41:36 +00:00
phantinuss
dc19268583
remove becasue of possible conflict 
with a legitimate tool (https://labs.nettitude.com/blog/cve-2017-16245-cve-2017-16246-avecto-defendpoint-multiple-vulnerabilities/)
 2021-08-26 14:25:12 +02:00
Florian Roth
6c7d355ef5
Try to add more pipe names to this non-regex rule 2021-08-26 14:00:57 +02:00
Florian Roth
2d36d62e88
Merge pull request #1928 from frack113/fix_name_case 
fix file name case
 2021-08-26 13:55:12 +02:00
Florian Roth
24d8701f15
fix: null cannot be used in a list with other values 2021-08-26 13:54:18 +02:00
Florian Roth
a231aa73b3
fix: FPs with whoami rule and 4688 event IDs without parent info 2021-08-26 13:33:25 +02:00
Florian Roth
54997553ba
Merge pull request #1929 from SigmaHQ/rule-devel 
refactor: Mimikatz keyword rule refactoring
 2021-08-26 13:33:02 +02:00
phantinuss
217dbc768a
More malleable CobaltStrike C2 profiles from new source/reference 2021-08-26 12:53:43 +02:00
Florian Roth
8b318b9273
refactor: Mimikatz keyword rule refactoring 2021-08-26 12:51:45 +02:00
f.hubaut
e66007a43d fix file name case 2021-08-26 11:15:33 +02:00
frack113
f277ecbbeb
Merge pull request #1923 from frack113/fix_invalid_tags 
Check invalid tags
 2021-08-25 10:26:43 +02:00
frack113
a4021842de Fix invalid tags 2021-08-25 09:15:57 +02:00
frack113
1d725e8519 add gworkspace_user_granted_admin_privileges.yml 2021-08-25 08:15:18 +02:00
frack113
061c093f3f
Merge pull request #1918 from d4rk-d4nph3/master 
Added rule for Arcadyan Router Exploitations
 2021-08-25 08:10:48 +02:00
Bhabesh Rai
df4180547e Merged rules 2021-08-25 11:18:51 +05:45
Bhabesh Rai
a4d0e3453d Fix for CVE tag 2021-08-25 10:24:15 +05:45
frack113
e849af9df0
Merge pull request #1915 from frack113/tags_cve 
fix tags
 2021-08-25 06:29:48 +02:00
frack113
7028aba3bd
Merge pull request #1919 from austinsonger/gworkspace-rules 
Role-Based Rules
 2021-08-24 21:46:15 +02:00
frack113
09a00232fb
update references 2021-08-24 21:14:59 +02:00
frack113
a5f858b63c
update references 2021-08-24 21:13:49 +02:00
Austin Songer
ab8cc52dc6 Role-Based Rules 2021-08-24 10:53:59 -05:00
Bhabesh Rai
ce6141e318 Added rule for Arcadyan Router Exploitations 2021-08-24 21:11:46 +05:45
Austin Songer
62f2affd03 Spelling fix 2021-08-24 14:15:50 +00:00
Florian Roth
9f69cead8a
Merge pull request #1916 from SigmaHQ/rule-devel 
refactor: changed level of rule, refactored RazerInstaller rule
 2021-08-24 15:42:26 +02:00
Florian Roth
46e312ff0d
fix: error in modifier 2021-08-24 15:03:23 +02:00
Florian Roth
cc519552aa
refactor: RazorInstaller integrity level system 2021-08-24 14:54:07 +02:00
frack113
7753f8c22e fix tags 2021-08-24 12:36:31 +02:00
Florian Roth
6ca30619ac
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel 2021-08-24 12:30:42 +02:00
Florian Roth
3cdb88ad55
refactor: level of suspicious parent for powershell rule 2021-08-24 12:30:40 +02:00
frack113
5b869a3f42 Update cve tags 2021-08-24 10:50:01 +02:00
frack113
ace46c17be Update cve tags 2021-08-24 10:27:27 +02:00
frack113
c2302a15da fix cve tags 2021-08-24 10:10:45 +02:00
frack113
8f85ac0fde tags update 2021-08-24 09:35:04 +02:00
Florian Roth
0c69fd9c41
Merge pull request #1898 from SigmaHQ/rule-devel 
rule: EfsPotato Named Pipe, splwow64, RazerInstaller
 2021-08-24 09:20:54 +02:00
frack113
679651bdf9
Merge pull request #1913 from neu5ron/add_zeek_dce_rpc_printnightmare_print_driver_install 
Zeek DCE_RPC PrintNightmare
 2021-08-24 08:37:02 +02:00
frack113
e76c11da7f
Merge pull request #1908 from neu5ron/patch-7 
improve rule logic zeek_default_cobalt_strike_certificate.yml
 2021-08-24 08:36:33 +02:00