458 Commits

Author	SHA1	Message	Date
Yugoslavskiy Daniil	34591f9f64	add lnx_system_network_connections_discovery.yml, oscd initiative issue #1011, task number 8	2020-10-20 01:17:06 +02:00
Yugoslavskiy Daniil	941fbebcdc	add macos_system_network_connections_discovery.yml, oscd initiative issue #1012, task number 14	2020-10-20 01:14:56 +02:00
Yugoslavskiy Daniil	272fbcc378	fix title	2020-10-20 00:47:02 +02:00
Yugoslavskiy Daniil	f0060dec67	fix title	2020-10-20 00:44:23 +02:00
Yugoslavskiy Daniil	1ecb2c1932	add lnx_base64_decode.yml, oscd initiative issue #1011, task number 4	2020-10-20 00:39:06 +02:00
Yugoslavskiy Daniil	8b01062d17	add lnx_base64_decode.yml, oscd initiative issue #1011, task number 4	2020-10-20 00:37:53 +02:00
Yugoslavskiy Daniil	cc3ef973c0	add macos_base64_decode.yml, oscd initiative issue #1012, task number 3	2020-10-20 00:36:21 +02:00
Tim I	0323e50011	Detect credential access for macOS via Keychain	2020-10-19 23:37:46 +03:00
Mikhail Larin	f75654a3f5	fix indentation	2020-10-19 18:19:38 +03:00
Mikhail Larin	fe6459d07e	commit to restart checker	2020-10-19 17:20:43 +03:00
Mikhail Larin	ddc2d2635d	fix wrong tactic	2020-10-19 17:16:22 +03:00
Mikhail Larin	42cc1dc552	fix non-present binary	2020-10-19 17:01:23 +03:00
Mikhail Larin	e0e81b5c25	fix newlines	2020-10-19 16:45:42 +03:00
Mikhail Larin	a64a70f7ed	fix nelwines	2020-10-19 16:44:18 +03:00
Mikhail Larin	85adbc3137	fix newlines	2020-10-19 16:42:43 +03:00
Mikhail Larin	008260b0e4	fix newlines	2020-10-19 16:41:24 +03:00
Mikhail Larin	058c77f6a6	fix newlines	2020-10-19 16:39:41 +03:00
Mikhail Larin	dc320e5be2	t1552.001 for lin/macOS	2020-10-19 16:34:13 +03:00
Mikhail Larin	c460dcf5de	t1552.001 for lin/macos	2020-10-19 16:32:01 +03:00
Mikhail Larin	d7e8a802bd	t1552.001 for Lin/macOS	2020-10-19 16:28:43 +03:00
Mikhail Larin	d9fba92adf	t1030 for lin/macos	2020-10-19 16:25:31 +03:00
Mikhail Larin	c9ca0a79b6	t1070.006 for lin/macos	2020-10-19 16:17:04 +03:00
Alejandro Ortuno	41f5d7e876	Adding Ömer as leading author	2020-10-18 20:30:32 +02:00
Alejandro Ortuno	8a43dec5a3	Adding Ömer as the leading author	2020-10-18 20:28:55 +02:00
yugoslavskiy	cb8cbf5a17	Update lnx_schedule_task_job_cron.yml ... to trigger a test once again)	2020-10-17 22:25:52 +02:00
yugoslavskiy	d6b64f2caf	Update lnx_schedule_task_job_cron.yml ... to trigger a test	2020-10-17 22:22:20 +02:00
remotephone	48cabeafe5	Updated author section	2020-10-16 22:02:58 -05:00
remotephone	8f6ce25bab	Merge changes from pull 1084 with this one ... https://github.com/Neo23x0/sigma/pull/1084 includes some commands I missed. This merges both and creates an OR selection condition to match both possible conditions.	2020-10-16 22:01:44 -05:00
remotephone	ffde8b0208	Update to handle different file locations	2020-10-16 21:54:41 -05:00
Mikhail Larin	29f2f1acfe	added fish to macos rule	2020-10-17 02:37:21 +03:00
Mikhail Larin	65854752a9	additional shells for both rules fix	2020-10-17 02:33:32 +03:00
Mikhail Larin	fb3bee0cad	title fix	2020-10-17 02:17:40 +03:00
Mikhail Larin	9b568df527	Lin/Mac T1552.003	2020-10-17 02:06:01 +03:00
Ömer Günal	26bb43eaf6	Update lnx_system_info_discovery.yml	2020-10-16 23:00:44 +03:00
Ömer Günal	a01c04018c	Update lnx_password_policy_discovery.yml	2020-10-16 22:52:15 +03:00
Ömer Günal	bf12c73118	Update at_command.yml	2020-10-16 22:49:40 +03:00
Ömer Günal	723df2f15b	Update lnx_system_info_discovery.yml	2020-10-16 21:08:01 +03:00
Ömer Günal	f7fbfda794	Update lnx_system_info_discovery.yml	2020-10-16 20:53:00 +03:00
Ömer Günal	2fa7008363	change reference	2020-10-16 20:42:12 +03:00
Ömer Günal	bca3c80f43	Update lnx_clear_logs.yml	2020-10-16 20:39:26 +03:00
Ömer Günal	5c34e69fc9	Update lnx_process_discovery.yml	2020-10-16 10:58:51 +03:00
Ömer Günal	0b30835b7b	Update at_command.yml	2020-10-16 10:56:06 +03:00
Ömer Günal	373c637e66	Update lnx_install_root_certificate.yml	2020-10-16 10:55:31 +03:00
Ömer Günal	27dcad8ffe	Update lnx_process_discovery.yml	2020-10-16 10:52:54 +03:00
Ömer Günal	68e843f0d3	Update lnx_system_info_discovery.yml	2020-10-16 10:48:36 +03:00
Ömer Günal	38c7cb7406	Update lnx_password_policy_discovery.yml	2020-10-16 10:38:36 +03:00
Ömer Günal	f1a6e980e5	added category	2020-10-16 10:33:50 +03:00
Ömer Günal	46e887ef38	Update lnx_clear_logs.yml	2020-10-16 10:32:25 +03:00
Jonhnathan	3361b62cc2	Update lnx_auditd_susp_exe_folders.yml	2020-10-15 23:09:06 -03:00
Jonhnathan	d655ebf092	Update lnx_auditd_masquerading_crond.yml	2020-10-15 23:08:08 -03:00
Jonhnathan	e26e5a1e7e	Update lnx_auditd_create_account.yml	2020-10-15 23:07:39 -03:00
Jonhnathan	8fd768aa66	Update lnx_susp_ssh.yml	2020-10-15 23:05:53 -03:00
Jonhnathan	d4284e60f9	Update lnx_susp_named.yml	2020-10-15 23:04:16 -03:00
Jonhnathan	83bad3de98	Update lnx_sudo_cve_2019_14287.yml	2020-10-15 23:03:40 -03:00
Jonhnathan	0ca17e88f6	Update lnx_setgid_setuid.yml	2020-10-15 22:55:41 -03:00
Jonhnathan	68ad66f390	Update lnx_proxy_connection.yml	2020-10-15 22:54:27 -03:00
Jonhnathan	41396636f9	Update lnx_file_copy.yml	2020-10-15 22:53:20 -03:00
Jonhnathan	6185640442	Update lnx_clamav.yml	2020-10-15 22:49:42 -03:00
Yugoslavskiy Daniil	d8a6048492	update /macos_create_hidden_account.yml	2020-10-16 02:05:22 +02:00
Alejandro Ortuno	2ef52dbfd8	Initial Sigma Rule	2020-10-14 10:24:59 +02:00
Alejandro Ortuno	bf8426d71b	Initial commit of sigma rule	2020-10-14 10:14:00 +02:00
Alejandro Ortuno	75a05db446	Add slash to bypass testing	2020-10-14 08:50:15 +02:00
remotephone@gmail.com	8e7fbbd147	fixing UUID and description	2020-10-14 00:54:51 -05:00
remotephone@gmail.com	ed22c8e0fe	adding macos screencapture rule	2020-10-14 00:51:55 -05:00
remotephone@gmail.com	8bbde90328	adding line at end of file	2020-10-14 00:05:28 -05:00
remotephone@gmail.com	3cddb86b70	updating tags	2020-10-14 00:01:30 -05:00
remotephone@gmail.com	7343936653	adding gui input capture, first iteration	2020-10-13 23:59:53 -05:00
remotephone@gmail.com	df20d2a5d2	adding new line at end of file	2020-10-13 22:44:02 -05:00
remotephone@gmail.com	7e002fcb5f	updating selections to make query more efficient and less prone to evasion	2020-10-13 22:17:26 -05:00
remotephone@gmail.com	56952ecdd4	updating to select commandline arguments correctly for macos rule, and cleaning up description across both rules	2020-10-13 22:09:37 -05:00
Alejandro Ortuno	c03a696762	additional modifications on commands and process names	2020-10-13 11:00:06 +02:00
Alejandro Ortuno	50fde8c13f	minor changes on command line	2020-10-13 10:55:29 +02:00
Alejandro Ortuno	30bd626d76	Split command line and do contains all.	2020-10-13 10:51:00 +02:00
Alejandro Ortuno	7459bcd08c	Use process_creation for the detection	2020-10-13 10:41:50 +02:00
remotephone@gmail.com	a85c19db17	updating files to cover broader network discovery logic, renaming alert, adding recommended changes	2020-10-13 00:39:53 -05:00
remotephone@gmail.com	7d49db3988	updating falsepositives documentation to remove line that's not applicable	2020-10-12 23:19:02 -05:00
remotephone@gmail.com	89c8a589a5	updating search syntax, splitting process name and cmdline and adding category	2020-10-12 22:49:19 -05:00
remotephone@gmail.com	476a3c04d9	Adding t1070_002	2020-10-12 00:01:10 -05:00
remotephone@gmail.com	781c7ce6dc	Cleaning up falsepositives section of both rules	2020-10-11 23:52:47 -05:00
remotephone@gmail.com	48edc674bd	updating keywords to CommandLine|contains and splitting rule into two	2020-10-11 22:43:28 -05:00
Yugoslavskiy Daniil	e52baddda2	improve descriptin	2020-10-11 22:11:03 +02:00
Yugoslavskiy Daniil	7dec19afca	add macos_create_hidden_account.yml; part of the oscd initiative task number 63 of the issue #1012	2020-10-11 22:01:05 +02:00
Alejandro Ortuno	d17faf8234	Local groups discovery sigma rules	2020-10-11 18:15:53 +02:00
Alejandro Ortuno	3358dd47ea	macos local account creation	2020-10-11 17:56:29 +02:00
Alejandro Ortuno	418a9d5a02	Use endswith with processname	2020-10-11 09:37:08 +02:00
Alejandro Ortuno	748dccc289	additional changes to split processname and commandline	2020-10-10 13:11:17 +02:00
Alejandro Ortuno	04f415c80b	Added the sigma rules per OS	2020-10-08 13:23:11 +02:00
Alejandro Ortuno	c5605ae8b6	Scheduled Cron Task/Job sigma rule	2020-10-08 13:15:02 +02:00
remotephone@gmail.com	e967cce211	change new lines to LF instead of CLRF	2020-10-07 23:02:03 -05:00
remotephone@gmail.com	9802704a2b	not sure why i'm failing the tests on a line I didn't change. copying format from another file	2020-10-07 22:54:31 -05:00
remotephone@gmail.com	ff2ba5f876	double checking new line characters	2020-10-07 22:43:38 -05:00
remotephone@gmail.com	83ed39f95c	adding UID, renaming	2020-10-07 22:25:54 -05:00
remotephone@gmail.com	4486c3ffc9	adding new line at end of file	2020-10-07 22:11:05 -05:00
remotephone@gmail.com	cde0020d30	T1016 detection rules	2020-10-07 22:09:15 -05:00
Ömer Günal	eac5ac9fc1	removed duplicate filter	2020-10-08 00:18:38 +03:00
Ömer Günal	e6588c08f4	Create lnx_system_info_discovery.yml	2020-10-08 00:15:46 +03:00
Ömer Günal	2cea3800de	Create lnx_password_policy_discovery.yml	2020-10-08 00:14:40 +03:00
Ömer Günal	f00e79d123	Create lnx_file_deletion.yml	2020-10-07 22:28:37 +03:00
Ömer Günal	18821d2255	Create lnx_clear_logs.yml	2020-10-07 22:27:06 +03:00
Ömer Günal	d44ef84b55	Update lnx_process_discovery.yml	2020-10-07 22:26:02 +03:00
Ömer Günal	d328f92503	Update at_command.yml	2020-10-07 22:23:48 +03:00
Ömer Günal	bdabb14483	Update at_command.yml	2020-10-07 22:22:31 +03:00
Ömer Günal	7b29e3a35f	Update lnx_install_root_certificate.yml	2020-10-07 22:20:17 +03:00
Ömer Günal	8ea054ff0b	Update at_command.yml	2020-10-07 00:07:30 +03:00
Ömer Günal	b0b72de94d	Create lnx_process_discovery.yml	2020-10-06 23:52:06 +03:00
Ömer Günal	7b39e76192	Create at_command.yml	2020-10-06 23:48:25 +03:00
Ömer Günal	759268108f	rename filename	2020-10-06 09:04:36 +03:00
Ömer Günal	0e7eb32f62	update description	2020-10-05 20:22:43 +03:00
Ömer Günal	1e7a47440f	Install Root Certificate	2020-10-05 20:21:20 +03:00
Florian Roth	d3ee1aba66	docs: MITRE ATT&CK(R) trademark references removed or adjusted ... https://github.com/Neo23x0/sigma/issues/1028	2020-09-30 08:53:52 +02:00
Mike Wade	8ce73bd8df	Fixed issues with tags and missing files	2020-09-15 06:10:57 -06:00
Mike Wade	52ab677798	Fixed my git issue	2020-09-13 22:03:04 -06:00
Florian Roth	de5444a81e	Merge pull request #989 from oscd-initiative/master ... [OSCD Initiative][ATT&CK tags update]	2020-09-08 13:27:58 +02:00
Florian Roth	af3b93a522	Merge pull request #914 from omergunal/ogunal-2 ... New rules for Linux	2020-09-07 09:41:43 +02:00
Timur Zinniatullin	8dba6ceee6	2nd review	2020-08-25 09:31:38 +03:00
Timur Zinniatullin	1244cacfbf	Update lnx_auditd_create_account.yml	2020-08-25 09:20:27 +03:00
Timur Zinniatullin	72fdf0da45	Update lnx_auditd_susp_cmds.yml	2020-08-04 20:00:30 +03:00
Timur Zinniatullin	4e688233d7	ATT&CK mapping update suggestions for \linux\	2020-08-04 19:48:18 +03:00
Florian Roth	1c63a93643	fix: wrong casing in tag	2020-07-13 16:20:51 +02:00
viniciusvec	26f0d49772	Update lnx_shell_clear_cmd_history.yml ... Renamed tags to match production MITRE: https://attack.mitre.org/techniques/T1070/003/	2020-07-13 14:06:14 +01:00
Ömer Günal	bee467dbd6	Rename lnx_setgid_setuid to lnx_setgid_setuid.yml	2020-07-13 01:36:20 +03:00
Ömer Günal	bf8f0307b7	Rename lnx_space_after_filename_ to lnx_space_after_filename_.yml	2020-07-13 01:33:59 +03:00
Ömer Günal	4b74a0df76	Create lnx_space_after_filename_	2020-07-13 01:33:39 +03:00
Ömer Günal	c749aa2539	Create lnx_setgid_setuid	2020-07-13 01:33:09 +03:00
Ömer Günal	6b24a5df65	Create lnx_security_tools_disabling.yml	2020-07-13 01:32:24 +03:00
Ömer Günal	bdeca13825	Create lnx_proxy_connection.yml	2020-07-13 01:31:05 +03:00
Ömer Günal	708a28e307	Delete lnx_space_after_filename.yml	2020-07-13 01:26:37 +03:00
Ömer Günal	af6ad5a41b	Delete lnx_setuid_setgid.yml	2020-07-13 01:26:29 +03:00
Ömer Günal	64a9b6e098	Delete lnx_disabling_security_tools.yml	2020-07-13 01:26:11 +03:00
Ömer Günal	7466c8d425	Delete lnx_connection_proxy.yml	2020-07-13 01:26:03 +03:00
Ömer Günal	7ce16d1bbc	Update lnx_space_after_filename.yml	2020-07-13 01:07:32 +03:00
Ömer Günal	47a2f1bc94	Update lnx_space_after_filename.yml	2020-07-03 18:56:51 +03:00
Ömer Günal	51363d8a87	Update lnx_setuid_setgid.yml	2020-07-03 18:56:40 +03:00
Ömer Günal	87346d4b94	Update lnx_disabling_security_tools.yml	2020-07-03 18:56:30 +03:00
Ömer Günal	64afd6e7ee	Update lnx_connection_proxy.yml	2020-07-03 18:56:19 +03:00
Florian Roth	26d8810efb	Merge pull request #882 from Neo23x0/rule-devel ... Rule devel	2020-07-03 15:33:55 +02:00
Florian Roth	8a0262d1a2	fix: in linux keyword expression	2020-07-03 15:08:20 +02:00
Florian Roth	5dd5b87f43	rule: guacamole exploitation detection	2020-07-03 13:20:03 +02:00
Florian Roth	fa452bf3e5	Merge pull request #849 from omergunal/ogunal-1 ... Rules for detecting suspicious remote file copy	2020-07-03 11:59:45 +02:00
Florian Roth	b9966a173c	Update lnx_file_copy.yml	2020-07-03 11:32:49 +02:00
Ömer Günal	4eb97ec43d	Update lnx_file_copy.yml	2020-06-22 21:35:50 +03:00
Ömer Günal	d17e0ae6eb	typo	2020-06-20 23:04:52 +03:00
Ömer Günal	93719d8a01	Merge pull request #1 from omergunal/omergunal-patch-1 ... Remote file copy	2020-06-18 23:56:29 +03:00
Ömer Günal	40a07a2d4f	Delete lnx_sudo_enumeration.yml	2020-06-18 23:55:24 +03:00
Ömer Günal	d87b0c95a4	Delete lnx_trap.yml	2020-06-18 23:55:16 +03:00
Ömer Günal	8db7c3207a	Delete lnx_sudo_caching.yml	2020-06-18 23:54:43 +03:00
Ömer Günal	5bc72b6cba	Delete lnx_space_after_filename.yml	2020-06-18 23:54:28 +03:00
Ömer Günal	f10440b9fa	Delete lnx_setuid_setgid.yml	2020-06-18 23:54:20 +03:00
Ömer Günal	6c8d104e7d	Delete lnx_disabling_security_tools.yml	2020-06-18 23:54:06 +03:00
Ömer Günal	84c4683607	Delete lnx_connection_proxy.yml	2020-06-18 23:53:43 +03:00
Ömer Günal	c6c455a3ec	Remote file copy	2020-06-18 23:37:49 +03:00
Ömer Günal	9bfc3d6807	Delete lnx_file_copy.yml	2020-06-18 23:37:12 +03:00
Ömer Günal	a963630db8	Remote File Copy	2020-06-18 23:36:29 +03:00
Ömer Günal	3a607abe33	Update lnx_trap.yml	2020-06-17 19:51:53 +03:00
Ömer Günal	7b86f4aefb	Update lnx_trap.yml	2020-06-17 19:47:31 +03:00
Ömer Günal	ebbd32d2e1	file extension	2020-06-17 19:43:57 +03:00
Ömer Günal	f989f7e155	file extension	2020-06-17 19:43:49 +03:00
Ömer Günal	772c03c49a	Connection Proxy	2020-06-17 19:39:55 +03:00
Ömer Günal	9d285ecf74	Trap	2020-06-17 19:39:00 +03:00
Ömer Günal	d0b66ab828	Space After Filename	2020-06-17 19:38:38 +03:00
Ömer Günal	3b8fb9e3d8	Disabling Security Tools	2020-06-17 19:38:10 +03:00
Ivan Kirillov	0fbfcc6ba9	Initial round of subtechnique updates	2020-06-16 14:46:08 -06:00
Florian Roth	fd2429bd34	Update lnx_setuid_setgid.yml	2020-06-16 19:46:50 +02:00
Florian Roth	06fe720165	Update lnx_sudo_enumeration.yml	2020-06-16 19:33:39 +02:00
Florian Roth	545c05d4d3	Update lnx_setuid_setgid.yml	2020-06-16 19:31:34 +02:00
Ömer Günal	0027415fa2	Update lnx_setuid_setgid.yml	2020-06-16 20:26:50 +03:00
Ömer Günal	41b2309418	file type changed	2020-06-16 20:24:09 +03:00
Ömer Günal	0d0058da43	added id	2020-06-16 20:21:07 +03:00
Ömer Günal	bbcd506fb1	added id	2020-06-16 20:21:02 +03:00
Ömer Günal	ace575aaa6	added id	2020-06-16 20:20:42 +03:00
Ömer Günal	4b1557a587	Setuid and Setgid ... Detects suspicious change of file privileges with chown and chmod commands	2020-06-16 20:12:24 +03:00
Ömer Günal	b7e1c6750c	sudo caching ... attack.t1206	2020-06-16 19:31:02 +03:00
Ömer Günal	e43f13ed67	Update lnx_sudo_enumeration.yml ... attack.t1169	2020-06-16 19:20:42 +03:00
Ömer Günal	52487159c5	Detect Sudo enumeration commands	2020-06-16 19:17:00 +03:00
Florian Roth	74e16fdccd	Merge pull request #803 from gamma37/clear_cmd_history ... Edit Clear Command History	2020-05-29 17:32:43 +02:00
gamma37	537bda4417	Update lnx_shell_clear_cmd_history.yml	2020-05-28 10:56:35 +02:00
gamma37	5a48934822	Edit Clear Command History ... I suggest a new point of view to detect that bash_history has been cleared : Instead of trying to detect all the commands that can do that, we could monitor the size of the file and log whenever it has less than 1 line.	2020-05-28 10:52:17 +02:00
Florian Roth	8321cc7ee1	Merge pull request #772 from gamma37/suspicious_activities ... Create a rule for "suspicious activities"	2020-05-23 18:11:32 +02:00
Florian Roth	e1a05dfc1c	Update lnx_auditd_susp_C2_commands.yml	2020-05-23 16:49:03 +02:00
gamma37	71c507d8a9	remove space bedore colon	2020-05-18 11:34:53 +02:00
gamma37	55eec46932	Create a rule for "suspicious activities"	2020-05-18 11:25:18 +02:00
gamma37	cbf06b1e43	lowercased tag	2020-05-18 10:11:32 +02:00
gamma37	904716771a	Create a new rule to detect "Create Account"	2020-05-18 10:03:34 +02:00
Florian Roth	7b713fbe7f	rule: OpenSSHd rule adjusted	2020-05-15 17:19:32 +02:00
Thomas Patzke	373424f145	Rule fixes ... Made tests pass the new CI tests. Added further allowed lower case words in rule test.	2020-02-20 23:00:16 +01:00
Thomas Patzke	d7bd90cb24	Merge branch 'master' into oscd	2020-02-03 23:13:16 +01:00
Thomas Patzke	593abb1cce	OSCD QA wave 3	2020-02-02 12:41:12 +01:00
Florian Roth	03ecb3b8dc	refactor: moved rues from 'apt' folder in respective folders	2020-02-01 17:59:26 +01:00
Florian Roth	d42e87edd7	fix: fixed casing and long rule titles	2020-01-30 17:26:09 +01:00
Florian Roth	e79e99c4aa	fix: fixed missing date fields in remaining files	2020-01-30 16:07:37 +01:00
Florian Roth	efd3af0812	fix: fixed missing date fields in other files	2020-01-30 15:32:39 +01:00
Thomas Patzke	924e1feb54	UUIDs + moved unsupported logic ... * Added UUIDs to all contributed rules * Moved unsupported logic directory out of rules/ because this breaks CI testing.	2019-12-19 23:56:36 +01:00
yugoslavskiy	edad1695f6	Merge branch 'oscd' of https://github.com/mrblacyk/sigma into mrblacyk-oscd	2019-12-02 02:56:53 +01:00
yugoslavskiy	48a94d1609	Update lnx_dd_delete_file.yml	2019-12-02 02:54:48 +01:00
yugoslavskiy	ca1c2f4436	Update lnx_chattr_immutable_removal.yml	2019-12-02 02:54:32 +01:00
yugoslavskiy	9e90335a5a	Update lnx_pers_systemd_reload.yml	2019-12-02 02:54:13 +01:00
yugoslavskiy	46ca68436e	Update lnx_file_or_folder_permissions.yml	2019-12-02 02:53:35 +01:00
mrblacyk	9d0889def4	Adding auditd compatibility	2019-11-29 09:34:08 +01:00
mrblacyk	cafbb25d2e	Update lnx_file_or_folder_permissions.yml	2019-11-29 09:33:04 +01:00
mrblacyk	bf5e6cc56b	Adding auditd compatibility	2019-11-29 09:32:05 +01:00