Sarkis Nanyan
60bc5253cf
win_disable_event_logging.yml: typo in audit policy name;
2019-05-29 15:43:44 +03:00
Florian Roth
323a7313fd
FP adjustments
...
We have checked the False Positive rate in different environments and noticed these event IDs in cases in which systems had bad network connections / we accessed via VPN. Therefore we reduced the level to "high" and added that note to the "False Positives" list.
2019-05-27 08:54:18 +02:00
Lionel PRAT
f65f693a88
Add rule for CVE-2019-0708
2019-05-24 10:01:19 +02:00
Thomas Patzke
2d0c08cc8b
Added wildcards to rule values
...
These values appear somewhere in a log message, therefore wildcards are
required.
2019-05-21 01:03:20 +02:00
Thomas Patzke
765fe9dcd9
Further improved Windows user creation rule
...
* Decreased level
* Fixed field names
* Added false positive possibility
2019-04-21 23:54:18 +02:00
Thomas Patzke
80f45349ed
Modified rule
...
* Adjusted ATT&CK tagging
* Set status
2019-04-21 00:14:57 +02:00
patrick
8609fc7ece
New Sigma rule detecting local user creation
2019-04-18 19:59:43 +02:00
sbousseaden
c4b8f75940
Update win_lm_namedpipe.yml
2019-04-04 18:22:50 +02:00
sbousseaden
22958c45a3
Update win_GPO_scheduledtasks.yml
2019-04-03 21:50:55 +02:00
sbousseaden
b4ac9a432f
Update win_susp_psexec.yml
2019-04-03 21:50:25 +02:00
sbousseaden
353e457104
Update win_lm_namedpipe.yml
2019-04-03 21:49:58 +02:00
sbousseaden
d5818a417b
Update win_impacket_secretdump.yml
2019-04-03 21:49:30 +02:00
sbousseaden
9c5575d003
Update win_atsvc_task.yml
2019-04-03 21:48:38 +02:00
sbousseaden
edb98f2781
Update win_account_discovery.yml
2019-04-03 21:40:59 +02:00
sbousseaden
eda5298457
Create win_account_backdoor_dcsync_rights.yml
2019-04-03 16:16:05 +02:00
sbousseaden
0756b00cdf
Create win_susp_psexec.yml
2019-04-03 15:59:46 +02:00
sbousseaden
9c1a5a5264
Create win_lm_namedpipe.yml
2019-04-03 15:48:42 +02:00
sbousseaden
56b68a0266
Create win_GPO_scheduledtasks.yml
2019-04-03 15:36:24 +02:00
sbousseaden
b941f6411f
Create win_impacket_secretdump.yml
2019-04-03 15:18:42 +02:00
sbousseaden
516c8f3ea1
Create win_account_discovery.yml
2019-04-03 14:41:11 +02:00
sbousseaden
d62bc41bfb
Create win_svcctl_remote_service.yml
2019-04-03 13:58:20 +02:00
sbousseaden
548145ce10
Create win_susp_raccess_sensitive_fext.yml
2019-04-03 13:22:42 +02:00
sbousseaden
e3f99c323b
Create win_atsvc_task.yml
2019-04-03 13:08:12 +02:00
Thomas Patzke
8e854b06f6
Specified source to prevent EventID collisions
...
Issue #263
2019-04-01 23:45:55 +02:00
Thomas Patzke
be25aa2c37
Added CAR tags
2019-03-16 00:37:09 +01:00
yugoslavskiy
33db032a16
added missed service
2019-03-14 00:44:26 +01:00
Florian Roth
95b47972f0
fix: transformed rule to new proc_creation format
2019-03-12 09:03:30 +01:00
Florian Roth
c4003ff410
Merge pull request #264 from darkquasar/master
...
adding rule win-susp-mshta-execution.yml
2019-03-11 23:50:56 +01:00
Yugoslavskiy Daniil
c22265c655
updated detection logic
2019-03-11 16:58:57 +01:00
Florian Roth
83c0c71bc7
Reworked for process_creation rules
2019-03-06 17:09:43 +01:00
Yugoslavskiy Daniil
05cc7e455d
atc review
2019-03-06 05:25:12 +01:00
yugoslavskiy
725ab99e90
Merge pull request #1 from AverageS/master
...
Fix rules
2019-03-06 04:31:01 +01:00
Wydra Mateusz
534f250c35
Merge branch 'master' of https://github.com/krakow2600/sigma
2019-03-06 00:45:16 +01:00
Wydra Mateusz
bb95347745
rules update
2019-03-06 00:43:42 +01:00
mikhail
be108d95cc
Merge branch 'master' of https://github.com/AverageS/sigma
2019-03-06 01:57:38 +03:00
mikhail
40241c1fdf
Fix 4 rules
2019-03-06 01:56:05 +03:00
mrblacyk
99595a7f89
Added missing tags and some minor improvements
2019-03-05 23:25:49 +01:00
Florian Roth
bd4e61acd8
Merge pull request #271 from vburov/patch-4
...
Update win_susp_failed_logon_reasons.yml
2019-03-02 07:21:28 +01:00
Florian Roth
f80cf52982
Expired happens too often
...
Back then when we created this rule, we noticed that "logon attempt with expired account" happens pretty often, so we decided to not include it. All event codes in this rule did not appear in a 30 day time period and therefore the rule's "level" was set to "high".
2019-03-02 07:20:59 +01:00
Thomas Patzke
56a1ed1eac
Merge branch 'project-1'
2019-03-02 00:26:10 +01:00
Vasiliy Burov
7bebedbac1
Update win_susp_failed_logon_reasons.yml
...
Added descriptions for logon failure statuses and new logon failure status that may indicate suspicious logon.
2019-03-01 18:18:39 +03:00
Florian Roth
f560e83886
Added modified date
2019-03-01 12:07:31 +01:00
Florian Roth
fc683ac7ee
Added error code for denied logon type
2019-03-01 12:06:54 +01:00
Thomas Patzke
6bdb4ab78a
Merge cleanup
2019-02-27 22:05:27 +01:00
darkquasar
155e273a1c
adding rule win-susp-mshta-execution.yml
2019-02-27 15:55:39 +11:00
Florian Roth
8ce4b1530d
Rule: added SAM export
2019-02-26 09:00:47 +01:00
Thomas Patzke
c922f7d73f
Merge branch 'master' into project-1
2019-02-26 00:24:46 +01:00
Florian Roth
f278a00174
Rule: certutil encode
2019-02-24 14:10:40 +01:00
Thomas Patzke
5c63ef17d2
Added further NirSoft tool parameters
2019-02-22 21:15:03 +01:00
vburov
bdf44be077
Update win_susp_process_creations.yml
2019-02-22 22:46:57 +03:00
Keep Watcher
07dec06222
Fixing yara condition
2019-02-20 10:57:24 -05:00
Florian Roth
eeae74e245
Merge pull request #249 from TareqAlKhatib/duplicate_filters
...
Duplicate Detections
2019-02-18 21:58:39 +01:00
Tareq AlKhatib
2e3a2b9ba6
Merged 'Eventlog Cleared' and 'Eventlog Cleared Experimental'
2019-02-18 21:03:53 +03:00
Florian Roth
f0a4aede24
Rule: RDP over Reverse SSH Tunnel
2019-02-16 19:36:13 +01:00
Tareq AlKhatib
cd3cdc9451
Removed unnecessary '1 of them' in condition
2019-02-13 21:26:02 +03:00
Thomas Patzke
01570f88db
YAML fixes
2019-02-10 00:16:27 +01:00
Thomas Patzke
6dd4b4775a
Merge branch 'patch-2' of https://github.com/neu5ron/sigma into neu5ron-patch-2
2019-02-10 00:15:25 +01:00
Thomas Patzke
ff5081f186
Merge branch 'yt0ng-development'
2019-02-10 00:09:29 +01:00
Thomas Patzke
14769938e9
Fixed condition keyword
2019-02-10 00:07:30 +01:00
Thomas Patzke
d43e67a882
Merge branch 'development' of https://github.com/yt0ng/sigma into yt0ng-development
2019-02-10 00:00:45 +01:00
Thomas Patzke
3cd6de2864
Merge pull request #240 from neu5ron/master
...
new rule and updated false positive note
2019-02-09 23:57:39 +01:00
Florian Roth
aab703a4b4
Suspicious calc.exe usage
2019-02-09 14:03:23 +01:00
Florian Roth
d2743351e7
Minor fix: indentation
2019-02-09 09:19:40 +01:00
Nate Guagenti
d151deaa29
Rename win_susp_bcdedit to win_susp_bcdedit.yml
2019-02-07 00:21:57 -05:00
Nate Guagenti
91862f284b
Create win_susp_bcdedit
...
This is a more general rule for possible boot/mbr value edits using bcdedit that I have seen in the wild.
It is different than 3288f6425b/rules/windows/malware/win_mal_wannacry.yml
2019-02-07 00:19:38 -05:00
Florian Roth
adb6690c80
Rule: Suspicious GUP.exe usage
2019-02-06 19:21:16 +01:00
Florian Roth
f0f0bdae40
Rule: fixed date - wrong year
2019-02-06 19:21:16 +01:00
Unknown
a0bac993ed
adjusted spaces
2019-02-06 11:07:09 +01:00
t0x1c-1
04f1edd171
added reverted base64 with dosfuscation
2019-02-06 10:59:09 +01:00
Unknown
c78ac9333c
adjusted formatting
2019-02-06 10:54:12 +01:00
neu5ron
35ebcff543
add new rule
2019-02-05 18:56:24 -05:00
neu5ron
65e4ba5aba
added false positive possibility
2019-02-05 18:45:53 -05:00
Florian Roth
dfd4ce878f
Rule: limiting rule to DHCP log
2019-02-05 14:35:23 +01:00
Thomas Patzke
3ef930b094
Escaped '\*' to '\\*' where required
2019-02-03 00:24:57 +01:00
Thomas Patzke
6436cb3ae1
Added missing conditions
2019-02-01 23:02:03 +01:00
Florian Roth
a8d1e7c62b
Rule: Fixed ntdsutil rule field in 4688 events
2019-01-29 15:59:39 +01:00
Florian Roth
6c8d08942e
Rule: Fixed field in RDP rule
2019-01-29 15:17:29 +01:00
Florian Roth
f61b44efa8
Rule: Netsh port forwarding
2019-01-29 14:04:48 +01:00
Florian Roth
086e62a495
Rule: Netsh RDP port forwarding rule
2019-01-29 14:04:28 +01:00
Florian Roth
a2eac623a6
Rule: Adjusted RDP login from localhost rule level
2019-01-29 14:04:10 +01:00
Thomas Patzke
516bfc88ff
Added rule: RDP login from localhost
2019-01-28 22:43:22 +01:00
Florian Roth
b1ea976f66
fix: fixed bug inntdsutil rule that included a white space
2019-01-22 16:18:43 +01:00
Thomas Patzke
96eb460944
Converted Sysmon/1 and Security/4688 to generic process creation rules
2019-01-16 23:36:31 +01:00
Thomas Patzke
ed1ee80f2d
Merge pull request #221 from adrienverge/fix/yamllint
...
Fix yamllint config
2019-01-13 23:55:14 +01:00
Florian Roth
9a6b3b5389
Rule: PowerShell script run in AppData folders
2019-01-12 12:03:36 +01:00
Adrien Vergé
44f18db80d
Fix YAML errors reported by yamllint
...
Especially the config for ArcSight, that was invalid:
tools/config/arcsight.yml
89:5 error duplication of key "product" in mapping (key-duplicates)
90:5 error duplication of key "conditions" in mapping (key-duplicates)
rules/windows/builtin/win_susp_commands_recon_activity.yml
10:9 error too many spaces after colon (colons)
2019-01-10 09:51:39 +01:00
Tareq AlKhatib
0a5e79b1e0
Fixed the RC section to use rc.exe instead of oleview.exe
2019-01-01 13:30:26 +03:00
Tareq AlKhatib
f318f328d6
Corrected reference to references as per Sigma's standard
2018-12-25 16:25:12 +03:00
Florian Roth
c8c419f205
Rule: Hacktool Rubeus
2018-12-19 09:31:22 +01:00
Thomas Patzke
75c7d65240
Merge pull request #211 from Cyb3rWard0g/master
...
Field-Index Mapping File & SIGMA Rules Field names fix
2018-12-19 00:38:06 +01:00
Florian Roth
172236e130
Rule: updated ATT&CK tags in MavInject rule
2018-12-12 09:17:58 +01:00
Florian Roth
188d3a83b8
Rule: docs: reference update in MavInject rule
2018-12-12 08:37:00 +01:00
Florian Roth
6206692bce
Merge pull request #212 from Neo23x0/commandline-issue
...
Bugfix: wrong field for 4688 process creation events
2018-12-12 08:24:07 +01:00
Florian Roth
49eb03cda8
Rule: MavInject process injection
2018-12-12 08:18:43 +01:00
Florian Roth
b0cb0abc01
Bugfix: wrong field for 4688 process creation events
2018-12-11 16:10:15 +01:00
Roberto Rodriguez
a0486edeea
Field-Index Mapping File & SIGMA Rules Field names fix
...
+ Updated HELK field-index mapping file
+ After going through all the fields with 'fieldlist' output, I found a few rules that fixed.
2018-12-11 09:27:26 +03:00
Roberto Rodriguez
a35f945c71
Update win_disable_event_logging.yml
...
Description value breaking SIGMA Elastalert Backend
2018-12-06 05:09:41 +03:00
Roberto Rodriguez
104ee6c33b
Update win_susp_commands_recon_activity.yml
...
Rule missing "by CommandLine" which marchs the query_key value of the elastalert format to NULL.
2018-12-05 05:55:36 +03:00
Roberto Rodriguez
6dc36c8749
Update win_eventlog_cleared.yml
...
Experimental Rule is a duplicate of bfc7012043/rules/windows/builtin/win_susp_eventlog_cleared.yml
2018-12-05 05:40:00 +03:00
Roberto Rodriguez
c8990962d2
Update win_rare_service_installs.yml
...
same count() by ServiceFileName < 5 aded to make sigmac work with elastalert integration
2018-12-05 05:33:56 +03:00
Roberto Rodriguez
f0b23af10d
Update win_rare_schtasks_creations.yml
...
Count(taskName) not being taken by elastalert integration with Sigmac
2018-12-05 05:10:08 +03:00
Thomas Patzke
900db72557
Merge branch 'master' of https://github.com/SherifEldeeb/sigma into SherifEldeeb-master
2018-12-04 23:35:23 +01:00
Thomas Patzke
f6ad36f530
Fixed rule
2018-11-29 00:00:18 +01:00
Florian Roth
a31acd6571
fix: fixed procdump rule
2018-11-17 09:10:26 +01:00
Florian Roth
fd06cde641
Rule: Detect base64 encoded PowerShell shellcode
...
https://twitter.com/cyb3rops/status/1063072865992523776
2018-11-17 09:10:09 +01:00
Sherif Eldeeb
23eddafb39
Replace "logsource: description" with "definition" to match the specs
2018-11-15 09:00:06 +03:00
Nate Guagenti
9bfdcba400
Update win_alert_ad_user_backdoors.yml
...
add another detection rule for delegation via the attack described in harmj0y's blog:
https://www.harmj0y.net/blog/redteaming/another-word-on-delegation/
2018-11-05 21:08:19 -05:00
Florian Roth
37294d023f
Suspicious svchost.exe executions
2018-10-30 09:37:40 +01:00
Florian Roth
580692aab4
Improved procdump on lsass rule
2018-10-30 09:37:40 +01:00
Florian Roth
85f0ddd188
Delete win_alert_LSASS_access.yml
2018-10-02 16:48:09 +02:00
Karneades
cc82207882
Add group by to win multiple suspicious cli rule
...
* For the detection it's important that these cli
tools are started on the same machine for alerting.
2018-09-23 19:38:23 +02:00
Thomas Patzke
81515b530c
ATT&CK tagging QA
2018-09-20 12:44:44 +02:00
Florian Roth
82916f0cff
Merge pull request #159 from t0x1c-1/t0x1c-devel
...
Suspicious SYSVOL Domain Group Policy Access
2018-09-08 15:56:54 +02:00
Florian Roth
6f5a73b2e2
style: renamed rule files to all lower case
2018-09-08 10:27:19 +02:00
John Lambert
7ce5b3515b
Create win_susp_powershell_hidden_b64_cmd.yml
...
Look in process creation events for powershell commands with base64 encoded content containing suspicious keywords. Require hidden flag to reduce FP.
2018-09-07 20:23:11 -07:00
Florian Roth
3c240be8a8
fix: more duplicate 'tag' keys in rules
2018-09-04 16:15:02 +02:00
Florian Roth
9c878bef79
fix: duplicate 'tag' key in rule
2018-09-04 16:05:21 +02:00
t0x1c-1
afadda8c04
Suspicious SYSVOL Domain Group Policy Access
2018-09-04 15:52:25 +02:00
Florian Roth
d94c1d2046
fix: duplicate 'tag' key in rule
2018-09-04 14:56:55 +02:00
Florian Roth
9cb78558d3
Rule: excluded false positives in rule
2018-09-03 12:02:42 +02:00
Florian Roth
b57f3ded64
Rule: GRR false positives
2018-09-03 11:50:34 +02:00
Florian Roth
2a0fcf6bea
Rule: PowerShell encoded command JAB
2018-09-03 10:08:29 +02:00
Thomas Patzke
ee15b451b4
Fixed log source name
2018-08-27 23:45:30 +02:00
Unknown
2f256aa1ef
Adding LSASS Access Detected via Attack Surface Reduction
2018-08-27 10:38:45 +02:00
Florian Roth
5b3175d1d6
Rule: Suspicious procdump use on lsass process
2018-08-26 19:53:57 +02:00
Florian Roth
f47a5c2206
fix: Author list to string
2018-08-23 09:40:28 +02:00
Florian Roth
6ee31f6cd1
Update win_susp_commands_recon_activity.yml
...
Merged recon commands from @yt0ng's rule
2018-08-22 17:00:00 +02:00
Florian Roth
92dc08a304
rule: Added recon command
2018-08-15 12:33:03 +02:00
Florian Roth
acfdb591d0
fiox: Typo in description fixed
2018-07-29 16:22:39 +02:00
Florian Roth
1f845aa1d9
fix: Changed suspicious process creation rule to avoid FPs
2018-07-29 16:22:09 +02:00
Thomas Patzke
0d8bc922a3
Merge branch 'master' into master
2018-07-24 08:23:37 +02:00
David Spautz
e275d44462
Add tags to windows builtin rules
2018-07-24 07:50:32 +02:00
James Dickenson
c4edc26267
windows builtin mitre attack tags
2018-07-23 21:34:20 -07:00
megan201296
a169723005
fixed typo
2018-07-13 13:53:21 -05:00
Thomas Patzke
2dc5295abf
Removed redundant attribute from rule
2018-07-10 22:50:02 +02:00
Florian Roth
dea019f89d
fix: some threat levels adjusted
2018-07-07 13:00:23 -06:00
Florian Roth
c3bf968462
High FP Rule
2018-06-29 16:01:46 +02:00
Florian Roth
c26c3ee426
Trying to fix rule
2018-06-28 16:39:47 +02:00
Florian Roth
9e0abc5f0b
Adjusted rules to the new specs reg "not null" usage
2018-06-28 09:30:31 +02:00
scherma
19ba5df207
False positive circumstance
2018-06-27 21:14:38 +01:00
Florian Roth
86e6518764
Changed (any) statements to (not null) to comply with the newest specs
2018-06-27 20:57:58 +02:00
Florian Roth
a61052fc0a
Rule fixes
2018-06-27 18:47:52 +02:00
Florian Roth
9705366060
Adjusted some rules
2018-06-27 16:54:44 +02:00
Florian Roth
28a7e64212
Rule: Sysprep on AppData folder
2018-06-22 14:02:55 +02:00
Thomas Patzke
7d1b801858
Merge branch 'devel-sigmac-wdatp'
2018-06-22 00:43:23 +02:00
Thomas Patzke
df6ad82770
Removed redundant attribute from rule
...
EventID 4657 already implies the modification.
2018-06-21 23:59:55 +02:00
Florian Roth
946c946366
Rule: NTLM logon
2018-06-13 00:08:46 +02:00
Florian Roth
e23cdafb85
Rule: Fixed missing description
2018-06-13 00:08:46 +02:00
Florian Roth
9c817a493b
Rule: DCSync
2018-06-03 16:00:57 +02:00
Florian Roth
8e500d2caa
Bugfix in rule
2018-05-29 14:11:12 +02:00
Florian Roth
2db00b8559
Rule: whoami execution
2018-05-22 16:59:58 +02:00
Thomas Patzke
079c04f28d
Fixed rule scope
2018-05-18 14:23:52 +02:00
Thomas Patzke
6a3fcdc68c
Unified 0x values with other rules
2018-05-13 22:28:43 +02:00
Florian Roth
49877a6ed0
Moved and renamed rule
2018-04-18 16:53:11 +02:00
Florian Roth
8420d3174a
Reordered
2018-04-18 16:34:16 +02:00
yt0ng
c637c2e590
Adding Detections for renamed wmic and format
...
https://subt0x11.blogspot.ch/2018/04/wmicexe-whitelisting-bypass-hacking.html
https://twitter.com/mattifestation/status/986280382042595328
2018-04-18 15:02:52 +02:00
Florian Roth
9b8df865b1
Extended rule
2018-04-18 12:13:45 +02:00
yt0ng
a4fb39a336
also for http
2018-04-18 08:19:47 +02:00
yt0ng
169a4404c2
added SquiblyTwo Detection
2018-04-17 21:33:26 +02:00
Thomas Patzke
a3e02ea70f
Various rule fixes
...
* Field name: LogonProcess -> LogonProcessName
* Field name: Message -> AuditPolicyChanges
* Field name: ProcessCommandLine -> CommandLine
* Removed Type match in Kerberos RC4 encryption rule
Problematic because text representation not unified and audit failures are possibly interesting events
* Removed field 'Severity' from rules (Redundant)
* Rule decomposition of win_susp_failed_logons_single_source) because of different field names
* Field name: SubjectAccountName -> SubjectUserName
* Field name: TargetProcess -> TargetImage
* Field name: TicketEncryption -> TicketEncryptionType
* Field name: TargetFileName -> TargetFilename
2018-03-27 14:35:49 +02:00
Thomas Patzke
b1bfa64231
Removed redundant 'EventLog' conditions
2018-03-26 00:36:40 +02:00
Thomas Patzke
f68af2a5da
Added reference to Kerberos RC4 rule
2018-03-25 23:19:01 +02:00
Florian Roth
f220e61adc
Fixed second selection in rule
2018-03-21 10:47:14 +01:00
Florian Roth
70c2f973a3
Rule: Smbexec.py Service Installation
2018-03-21 10:44:37 +01:00
Florian Roth
3c968d4ec6
Fixed rule for any ControlSets
2018-03-21 10:44:37 +01:00
Florian Roth
e9fcfcba7f
Improved NetNTLM downgrade rule
2018-03-20 15:03:55 +01:00
Florian Roth
8b31767d31
Rule: PsExec usage
2018-03-15 19:54:22 +01:00
Thomas Patzke
ada1ca94ea
JPCERT rules
...
* Addition of ntdsutil.exe rule
* Added new link to existing rules
2018-03-08 00:10:19 +01:00
Thomas Patzke
8ee24bf150
WMI persistence rules derived from blog article
...
https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/#so-to-summarize
2018-03-07 23:05:10 +01:00
Thomas Patzke
84645f4e59
Simplified rule conditions with new condition constructs
2018-03-06 23:14:43 +01:00
Dominik Schaudel
cea48d9010
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module
2018-02-12 21:57:22 +01:00
Florian Roth
d6d031fc23
Rule update: Olympic destroyer detection
...
http://blog.talosintelligence.com/2018/02/olympic-destroyer.html
2018-02-12 15:35:47 +01:00
Florian Roth
0a1c600d7d
Rule: Changed msiexec web install rule
2018-02-10 15:25:08 +01:00
Florian Roth
a4e6b3003f
Rule: Msiexec web install
2018-02-09 10:13:39 +01:00
SherifEldeeb
348728bdd9
Cleaning up empty list items
2018-01-28 02:36:39 +03:00
SherifEldeeb
48441962cc
Change All "str" references to be "list"to mach schema update
2018-01-28 02:24:16 +03:00
SherifEldeeb
112a0939d7
Change "reference" to "references" to match new schema
2018-01-28 02:12:19 +03:00
Florian Roth
0f2e1c5934
Bugfix: Missing wildcard in IIS module install rule
2018-01-27 16:15:25 +01:00
Florian Roth
d93d7d8e7b
Rule: IIS nativ-code module command line installation
2018-01-27 11:13:13 +01:00
Florian Roth
aca70e57ec
Massive Title Cleanup
2018-01-27 10:57:30 +01:00
Florian Roth
379b2dd207
New recon activity rule
2017-12-11 09:31:54 +01:00
Florian Roth
8e2aef035c
Removed commands - false positive reduction
2017-12-11 09:31:54 +01:00
Florian Roth
1464ab4ab8
Renamed rule: recon activity > net recon activity - to be more specific
2017-12-11 09:31:54 +01:00
Thomas Patzke
2ec5919b9e
Fixed win_disable_event_logging by multiline description
2017-11-19 22:49:40 +01:00
Nate Guagenti
a796ff329e
Create win_disable_event_logging
2017-11-15 21:56:30 -05:00
Florian Roth
a0ac61229c
Rule: Detect plugged USB devices
2017-11-09 08:40:46 +01:00
Thomas Patzke
5035c9c490
Converted Windows 4688-only rules into 4688 and Sysmon/1 collections
2017-11-01 22:12:14 +01:00
Thomas Patzke
f3a809eb00
Improved admin logon rules and removed duplicates
2017-11-01 21:33:01 +01:00
Thomas Patzke
0055eedb83
Merge pull request #54 from juju4/CAR-2016-04-005b
...
Admin user remote login
2017-11-01 21:22:09 +01:00
Thomas Patzke
613f922976
Merge pull request #43 from juju4/master
...
New rules
2017-11-01 21:21:30 +01:00
Thomas Patzke
118e8af738
Simplified rule collection
2017-11-01 10:00:35 +01:00
Thomas Patzke
732f01878f
Sigma rule collection YAML action documents
2017-11-01 00:17:55 +01:00
Thomas Patzke
d0b2bd9875
Multiple rules per file
...
* New wrapper class SigmaCollectionParser parses all YAML documents
contained in file and handles multiple SigmaParser instantiation.
* Exemplary extended one security/4688 rule to security/4688 + sysmon/1
2017-10-31 23:06:18 +01:00
Thomas Patzke
9d96a998d7
Merge pull request #56 from juju4/CAR-2013-05-002b
...
Detects Suspicious Run Locations - MITRE CAR-2013-05-002
2017-10-30 00:27:56 +01:00
Thomas Patzke
720c992573
Dropped within keyword
...
Covered by timeframe attribute.
Fixes issue #26 .
2017-10-30 00:25:56 +01:00
Thomas Patzke
c865b0e9a8
Removed within keyword in rule
2017-10-30 00:15:01 +01:00
juju4
4b64fc1704
double quotes = escape
2017-10-29 14:42:40 -04:00
juju4
07185247cb
double quotes = escape
2017-10-29 14:32:52 -04:00
juju4
f5f20c3f75
Admin user remote login
2017-10-29 14:30:11 -04:00
juju4
19dd69140b
Detects Suspicious Run Locations - MITRE CAR-2013-05-002
2017-10-29 14:27:01 -04:00
juju4
ad27a0a117
Detects Quick execution of a series of suspicious commands - MITRE CAR-2013-04-002
2017-10-29 14:24:53 -04:00
juju4
e2213347ad
Merge remote-tracking branch 'upstream/master'
2017-09-09 11:33:18 -04:00
Florian Roth
e06cf6c43f
Service install - net user persistence
2017-08-16 15:16:57 +02:00
juju4
b109a1277e
Detects suspicious process related to rasdial.exe
2017-08-13 16:20:25 -04:00
juju4
012ed4cd7d
Detects execution of executables that can be used to bypass Applocker whitelisting
2017-08-13 16:20:01 -04:00
juju4
f861969e95
tentative rule to detect admin users remote login
2017-08-13 16:19:24 -04:00
juju4
d2ae98b0de
tentative rule to detect admin users interactive login
2017-08-13 16:18:58 -04:00
juju4
21b1c52d1e
forfiles, bash detection
2017-08-13 16:18:13 -04:00
Thomas Patzke
0217cd5b1d
Merge branch 'master' into travis-test-working
2017-08-02 23:03:03 +02:00
Thomas Patzke
f768bf3d61
Fixed parse errors
2017-08-02 22:49:15 +02:00
Thomas Patzke
6f5b9e183c
Merge branch 'master' into travis-test-working
2017-08-02 00:32:52 +02:00
Thomas Patzke
b82a6fdc51
Added wildcards to windows/builtin/win_susp_rundll32_activity.yml
2017-08-02 00:09:34 +02:00
Thomas Patzke
84418d2045
Merged builtin/win_susp_certutil_activity.yml with Sysmon rule
2017-08-02 00:04:28 +02:00
Thomas Patzke
c350a90b21
Merge branch 'master' into rules-juju4
2017-08-01 23:55:53 +02:00
juju4
5b778c9833
yamllint: quote twitter-formatted nickname
2017-07-30 11:42:25 -04:00
juju4
5b42c64fcd
Merge remote-tracking branch 'upstream/master'
2017-07-30 11:12:03 -04:00
juju4
31b033d492
suspicious rundll32 activity rules
2017-07-30 11:11:45 -04:00
juju4
3a8946a3ac
suspicious phantom dll rules
2017-07-30 11:11:17 -04:00
juju4
fbbf29fd80
suspicious cli escape character rules
2017-07-30 11:10:43 -04:00
juju4
83fa83aa43
suspicious certutil activity rules
2017-07-30 11:09:51 -04:00
juju4
f487451c45
more suspicious cli process
2017-07-30 11:09:24 -04:00
Florian Roth
d1cdb3c480
Certutil duplicate entry and "-ping" command
2017-07-23 14:51:57 -06:00
Florian Roth
cdf0894e6a
Corrected error in certutil rules (-f means force overwrite, not file)
...
> the -urlcache is the relevant command
2017-07-20 12:54:55 -06:00
Florian Roth
3a55b31da2
certutil file download - more generic approach
2017-07-20 12:48:47 -06:00
Florian Roth
b85d96e458
certutil detections (renamed, extended)
...
see https://twitter.com/subTee/status/888102593838362624
2017-07-20 12:38:10 -06:00
Florian Roth
8f525d2f01
Wannacry Rules Reorg and Renaming
2017-06-28 09:08:53 +02:00
Florian Roth
3f245d27f8
Eventlog cleared ID 104
2017-06-27 17:29:39 +02:00
Thomas Patzke
7fdc78c8bf
Merge pull request #36 from dim0x69/master
...
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm
2017-06-19 15:32:56 +02:00
Thomas Patzke
a4c9e24380
File renaming while deletion with SDelete
2017-06-14 16:55:32 +02:00
Thomas Patzke
8c06a5d83f
Access to wceaux.dll while WCE pass-the-hash login on source host
2017-06-14 15:59:45 +02:00
Florian Roth
576981820b
Moved PlugX rule & used builtin ID 4688 for another rule
2017-06-12 11:02:49 +02:00
Thomas Patzke
91b3c39c0d
Amended condition
...
Changed condition according to proposed syntax for related event matching (#4 )
2017-06-11 23:54:19 +02:00
dimi
ac95e372e5
clarification: if executed locally there is no connection to the samr pipe on IPC$. So this rule detects remote changes
2017-06-09 14:15:37 +02:00
dimi
a2a2366dfb
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm
2017-06-09 14:05:40 +02:00
Florian Roth
5dd3d4dd57
Generic Hacktool Use Rule
2017-05-31 08:42:35 +02:00
Florian Roth
ae4cab6783
Corrected - no lists needed
2017-05-25 12:07:11 +02:00
dimi
0b8c82b75b
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading
...
2) correct typo in dns server rule
2017-05-15 20:58:31 +02:00
Florian Roth
01e1d3a3d7
WannaCry Service Install
2017-05-15 16:06:16 +02:00
Florian Roth
46643324a8
Wannacrypt Update
2017-05-13 10:40:41 +02:00
Florian Roth
d35b6c0353
Backup catalog deletion rule
2017-05-12 23:00:56 +02:00
Florian Roth
1ab3c746c1
Merge branch 'master' of https://github.com/Neo23x0/sigma
2017-05-12 21:59:43 +02:00
Florian Roth
0b541b2689
Suspicious Windows Process Creations Update
2017-05-12 21:55:30 +02:00
Thomas Patzke
300dbe8f3e
Fixed condition
...
AND has higher precedence than OR.
2017-05-09 23:12:02 +02:00
Florian Roth
565c51e5be
Removed "1 of" expression (no bug, but cleaner)
2017-05-09 22:58:42 +02:00
Florian Roth
a6678e199b
Microsoft Malware Protection Engine Crash - ref CVE-2017-0290
2017-05-09 22:46:57 +02:00
Florian Roth
96deef7d34
Updated sigma signature
2017-05-08 21:25:07 +02:00
Florian Roth
75e58b8142
Bugfix and date
2017-05-08 13:10:40 +02:00
Florian Roth
263c98a2c8
Suspicious DNS Server Config Error - ServerLevelPluginDLL issue
2017-05-08 13:09:50 +02:00
Florian Roth
dc4ae35be1
Schtasks frequency - minute
2017-04-28 17:03:35 +02:00
Florian Roth
d66c97921f
Bugfix in rule
2017-04-13 01:22:03 +02:00
