70 Commits

Author	SHA1	Message	Date
Mike Wade	1ddba05eb2	Second round	2020-09-15 07:02:30 -06:00
Alexey Lednyov	cf011e4a00	Removed duplicate key 'modified'	2020-09-03 17:12:37 +03:00
Alexey Lednyov	1eb675f693	att&ck tags review: web, network/zeek	2020-09-03 17:06:37 +03:00
Florian Roth	5625f471d7	Merge pull request #963 from diskurse/rule-devel ... win_webshell_regeorg.yml	2020-08-03 13:51:16 +02:00
Florian Roth	3abc3d0a76	docs: add FP condition	2020-08-03 13:50:47 +02:00
Florian Roth	6f7aecbe06	fix: preventive change to avoid FPs	2020-08-03 13:49:52 +02:00
Cian Heasley	de33b953ba	Add files via upload ... Webshell ReGeorg Detection Via Web Logs	2020-08-03 12:20:04 +01:00
Ryan Plas	3bb45f00af	Update web_citrix_cve_2019_19781_exploit.yml logsource to use the correct Sigma schema values	2020-07-11 00:00:21 -04:00
Florian Roth	129925ce0b	rule: improved Citrix rule	2020-07-10 18:15:35 +02:00
Florian Roth	383953c74e	rule: better rule name and descriptions, plus MITRE ATT&CK tags	2020-07-10 17:55:13 +02:00
Florian Roth	0d89208242	rule: updated Citrix rule	2020-07-10 17:49:18 +02:00
Florian Roth	eda08e3a89	rule: Citrix Netscaler Attack CVE-2020-8193 CVE-2020-8195	2020-07-10 17:45:11 +02:00
Florian Roth	acfe20aa34	rule: extended F5 BIG-IP exploitation detection rule	2020-07-07 21:45:08 +02:00
Florian Roth	13ab00f744	improved F5 BIG-IP rule based on private feedback	2020-07-05 16:21:48 +02:00
Florian Roth	fbe6c0e7d9	improved F5 BIG-IP rule	2020-07-05 13:29:30 +02:00
Florian Roth	f079d0f915	rule: CVE-2020-5902 F5 BIG-IP Exploitation Attempt ... https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/	2020-07-05 13:18:53 +02:00
Ivan Kirillov	0fbfcc6ba9	Initial round of subtechnique updates	2020-06-16 14:46:08 -06:00
Florian Roth	cdf1ade625	fix: typo in selection	2020-05-26 12:27:16 +02:00
Florian Roth	828484d7c6	rule: confluence exploit CVE-2019-3398	2020-05-26 12:09:41 +02:00
neu5ron	b575df8cd7	use the taxonomy for http response which is sc-status	2020-03-14 15:02:33 -04:00
neu5ron	4cd99e71bf	use the taxonomy which states to use c-uri instead of c-uri-path	2020-03-14 15:02:06 -04:00
neu5ron	d212d43acf	spelling	2020-03-14 14:58:25 -04:00
Florian Roth	15a400ac51	fix: fixing bug in rule	2020-02-29 15:51:00 +01:00
Florian Roth	fa6458b70f	rule: two rules to detect CVE-2020-0688 exploitation	2020-02-29 15:45:45 +01:00
Remco Hofman	4f45e14a56	Match on c-uri instead of c-uri-path	2020-02-27 13:23:25 +01:00
Remco Hofman	ff35eb0052	Title capitalization	2020-02-27 12:56:56 +01:00
Remco Hofman	72e34d2aa5	CVE 2020-0688 Exploit attempt rule	2020-02-27 12:51:10 +01:00
Florian Roth	d42e87edd7	fix: fixed casing and long rule titles	2020-01-30 17:26:09 +01:00
Florian Roth	efd3af0812	fix: fixed missing date fields in other files	2020-01-30 15:32:39 +01:00
2d4d	e35ebcc185	complete_cve_2019-19781	2020-01-15 21:59:33 +01:00
Florian Roth	5ef64e4e99	rule: changes at Shitrix rule	2020-01-13 20:15:08 +01:00
2d4d	364e859a6b	add newbm.pl	2020-01-12 00:29:10 +01:00
Florian Roth	a29c832b6a	rule: updated netscaler rule	2020-01-07 14:42:16 +01:00
Florian Roth	c9a75a8371	fix: shortened path in Citrix Netscaler rule	2020-01-07 13:00:28 +01:00
2d4d	35fbdd1248	add rule for Citrix Netscaler CVE-2019-19781	2020-01-03 01:48:29 +01:00
2d4d	b98e57603e	add rule for Citrix Netscaler CVE-2019-19781	2020-01-03 00:34:52 +01:00
Florian Roth	fdc32889a7	rule: PulseSecure CVE-2019-11510 attack	2019-11-18 15:33:58 +01:00
Thomas Patzke	0592cbb67a	Added UUIDs to rules	2019-11-12 23:12:27 +01:00
James Ahearn	eae7e3ab10	Web Source Code Enumeration via .git	2019-06-08 22:40:28 -04:00
Florian Roth	8c4b21f063	Rule: Apache threading errors	2019-01-22 08:49:10 +01:00
Thomas Patzke	81515b530c	ATT&CK tagging QA	2018-09-20 12:44:44 +02:00
megan201296	525326d15f	Fix typo	2018-09-06 20:20:11 -05:00
Florian Roth	1134051fba	Update web_cve_2018_2894_weblogic_exploit.yml ... Ah, we could do it this way *.js*	2018-07-23 06:19:25 -06:00
Florian Roth	03a64cca74	Update web_cve_2018_2894_weblogic_exploit.yml ... We try to avoid false positives	2018-07-23 06:18:38 -06:00
MATTHEW CARR	dfb77e936d	Update web_cve_2018_2894_weblogic_exploit.yml ... To detect all possible extensions .jspx, .jsw, .jsv, and .jspf	2018-07-23 07:41:47 +02:00
Florian Roth	0f1b440b91	Rule: widened the CVE-2018-2894 WebLogic rule ... https://twitter.com/lo_security/status/1021148314308358144	2018-07-22 20:36:10 -06:00
Florian Roth	ffb0cf5ed5	Rule: CVE-2018-2894 Oracle WebLogic exploit and webshell drop	2018-07-22 15:09:45 -06:00
SherifEldeeb	48441962cc	Change All "str" references to be "list"to mach schema update	2018-01-28 02:24:16 +03:00
SherifEldeeb	112a0939d7	Change "reference" to "references" to match new schema	2018-01-28 02:12:19 +03:00
Thomas Patzke	9adaf4c411	Cleanup	2017-12-07 16:21:02 +01:00