7731 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
mlp1515	7ad927f28e	Update win_wmiprvse_spawning_process.yml ... French language settings	2021-08-26 12:42:47 +00:00
mlp1515	644397e65c	Update win_exploit_cve_2019_1388.yml ... French language settings	2021-08-26 12:41:36 +00:00
phantinuss	dc19268583	remove becasue of possible conflict ... with a legitimate tool (https://labs.nettitude.com/blog/cve-2017-16245-cve-2017-16246-avecto-defendpoint-multiple-vulnerabilities/)	2021-08-26 14:25:12 +02:00
Florian Roth	6c7d355ef5	Try to add more pipe names to this non-regex rule	2021-08-26 14:00:57 +02:00
Florian Roth	c86bcf3d25	Merge pull request #1927 from frack113/check_date_order ... check valid date order	2021-08-26 13:55:39 +02:00
Florian Roth	2d36d62e88	Merge pull request #1928 from frack113/fix_name_case ... fix file name case	2021-08-26 13:55:12 +02:00
Florian Roth	24d8701f15	fix: null cannot be used in a list with other values	2021-08-26 13:54:18 +02:00
Florian Roth	a231aa73b3	fix: FPs with whoami rule and 4688 event IDs without parent info	2021-08-26 13:33:25 +02:00
Florian Roth	54997553ba	Merge pull request #1929 from SigmaHQ/rule-devel ... refactor: Mimikatz keyword rule refactoring	2021-08-26 13:33:02 +02:00
phantinuss	217dbc768a	More malleable CobaltStrike C2 profiles from new source/reference	2021-08-26 12:53:43 +02:00
Florian Roth	8b318b9273	refactor: Mimikatz keyword rule refactoring	2021-08-26 12:51:45 +02:00
f.hubaut	e66007a43d	fix file name case	2021-08-26 11:15:33 +02:00
frack113	3eb3377a7b	check valid date order	2021-08-26 06:51:37 +02:00
frack113	f277ecbbeb	Merge pull request #1923 from frack113/fix_invalid_tags ... Check invalid tags	2021-08-25 10:26:43 +02:00
frack113	a6767255c0	Merge pull request #1922 from frack113/missing ... add gworkspace_user_granted_admin_privileges.yml	2021-08-25 09:16:44 +02:00
frack113	a4021842de	Fix invalid tags	2021-08-25 09:15:57 +02:00
frack113	1d725e8519	add gworkspace_user_granted_admin_privileges.yml	2021-08-25 08:15:18 +02:00
frack113	061c093f3f	Merge pull request #1918 from d4rk-d4nph3/master ... Added rule for Arcadyan Router Exploitations	2021-08-25 08:10:48 +02:00
Bhabesh Rai	df4180547e	Merged rules	2021-08-25 11:18:51 +05:45
Bhabesh Rai	a4d0e3453d	Fix for CVE tag	2021-08-25 10:24:15 +05:45
frack113	e849af9df0	Merge pull request #1915 from frack113/tags_cve ... fix tags	2021-08-25 06:29:48 +02:00
Joshua Roys	294bb432d0	Add Azure Sentinel backend ... The web interface expects ARM templates.	2021-08-24 16:01:23 -04:00
Joshua Roys	829117ca7f	Allow ints as values in ALA backend ... Without this, LogonType set as an int caused sigmac to abort the rule.	2021-08-24 16:00:08 -04:00
Joshua Roys	93be8471ec	Fix tactics/techniques in ALA backend	2021-08-24 15:58:21 -04:00
frack113	7028aba3bd	Merge pull request #1919 from austinsonger/gworkspace-rules ... Role-Based Rules	2021-08-24 21:46:15 +02:00
frack113	09a00232fb	update references	2021-08-24 21:14:59 +02:00
frack113	a5f858b63c	update references	2021-08-24 21:13:49 +02:00
frack113	962b6ac077	Merge pull request #1917 from austinsonger/spelling ... Spelling fix	2021-08-24 21:06:34 +02:00
Austin Songer	ab8cc52dc6	Role-Based Rules	2021-08-24 10:53:59 -05:00
Bhabesh Rai	ce6141e318	Added rule for Arcadyan Router Exploitations	2021-08-24 21:11:46 +05:45
Austin Songer	62f2affd03	Spelling fix	2021-08-24 14:15:50 +00:00
Florian Roth	9f69cead8a	Merge pull request #1916 from SigmaHQ/rule-devel ... refactor: changed level of rule, refactored RazerInstaller rule	2021-08-24 15:42:26 +02:00
Florian Roth	46e312ff0d	fix: error in modifier	2021-08-24 15:03:23 +02:00
Florian Roth	cc519552aa	refactor: RazorInstaller integrity level system	2021-08-24 14:54:07 +02:00
frack113	7753f8c22e	fix tags	2021-08-24 12:36:31 +02:00
Florian Roth	6ca30619ac	Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel	2021-08-24 12:30:42 +02:00
Florian Roth	3cdb88ad55	refactor: level of suspicious parent for powershell rule	2021-08-24 12:30:40 +02:00
frack113	5b869a3f42	Update cve tags	2021-08-24 10:50:01 +02:00
frack113	ace46c17be	Update cve tags	2021-08-24 10:27:27 +02:00
frack113	c2302a15da	fix cve tags	2021-08-24 10:10:45 +02:00
frack113	8f85ac0fde	tags update	2021-08-24 09:35:04 +02:00
Florian Roth	0c69fd9c41	Merge pull request #1898 from SigmaHQ/rule-devel ... rule: EfsPotato Named Pipe, splwow64, RazerInstaller	2021-08-24 09:20:54 +02:00
frack113	679651bdf9	Merge pull request #1913 from neu5ron/add_zeek_dce_rpc_printnightmare_print_driver_install ... Zeek DCE_RPC PrintNightmare	2021-08-24 08:37:02 +02:00
frack113	e76c11da7f	Merge pull request #1908 from neu5ron/patch-7 ... improve rule logic zeek_default_cobalt_strike_certificate.yml	2021-08-24 08:36:33 +02:00
frack113	293f422243	Merge pull request #1906 from neu5ron/patch-5 ... improve zeek_dce_rpc_smb_spoolss_named_pipe	2021-08-24 08:36:18 +02:00
frack113	81ec546e42	Merge pull request #1905 from neu5ron/patch-4 ... improve rule	2021-08-24 08:36:04 +02:00
Florian Roth	272625a005	Update win_susp_splwow64.yml	2021-08-24 08:34:08 +02:00
frack113	15aa0cb70e	add modified	2021-08-24 08:02:24 +02:00
frack113	ade7295cab	Merge pull request #1911 from austinsonger/gworkspace_granted_domain_api_access.yml ... gworkspace_granted_domain_api_access.yml	2021-08-24 08:01:34 +02:00
frack113	4ee4f12f30	add modified	2021-08-24 08:01:01 +02:00