yugoslavskiy
e38116fce2
Update and rename win_data_compressed.yml to win_data_compressed_with_rar.yml
2019-11-04 22:55:32 +03:00
yugoslavskiy
cb167e73b1
fix filenames
2019-11-04 22:49:28 +03:00
yugoslavskiy
f880fa82b5
Rename process_creation_change_default_file_association.yml to win_change_default_file_association.yml
2019-11-04 22:48:13 +03:00
yugoslavskiy
cbf01aa51e
Update and rename win_change_default_file_association.yml to process_creation_change_default_file_association.yml
2019-11-04 22:46:55 +03:00
yugoslavskiy
ce849a1184
Merge branch 'master' into oscd
2019-11-04 20:48:19 +03:00
yugoslavskiy
1f1fd68331
Merge pull request #472 from feedb/oscd
...
add 11 new rules:
- rules/linux/auditd/lnx_auditd_web_rce.yml
- rules/windows/process_creation/process_creation_susp_bginfo.yml
- rules/windows/process_creation/process_creation_susp_cdb.yml
- rules/windows/process_creation/process_creation_susp_devtoolslauncher.yml
- rules/windows/process_creation/process_creation_susp_dnx.yml
- rules/windows/process_creation/process_creation_susp_dxcap.yml
- rules/windows/process_creation/process_creation_susp_msoffice.yml
- rules/windows/process_creation/process_creation_susp_odbcconf.yml
- rules/windows/process_creation/process_creation_susp_openwith.yml
- rules/windows/process_creation/process_creation_susp_psr_capture_screenshots.yml
- rules/windows/sysmon/sysmon_webshell_creation_detect.yml
2019-11-04 20:40:58 +03:00
yugoslavskiy
3f1c94837b
Rename process_creation_susp_openwith_execution.yml to process_creation_susp_openwith.yml
2019-11-04 20:38:44 +03:00
yugoslavskiy
54e9be9cd0
Rename process_creation_susp_devtoolslauncher_execution.yml to process_creation_susp_devtoolslauncher.yml
2019-11-04 20:38:24 +03:00
yugoslavskiy
999126446b
Rename win_susp_psr_capture_screenshots.yml to process_creation_susp_psr_capture_screenshots.yml
2019-11-04 20:37:16 +03:00
yugoslavskiy
85cd989b6f
Rename win_susp_openwith_execution.yml to process_creation_susp_openwith_execution.yml
2019-11-04 20:36:58 +03:00
yugoslavskiy
8d0923de2d
Rename win_susp_odbcconf.yml to process_creation_susp_odbcconf.yml
2019-11-04 20:36:46 +03:00
yugoslavskiy
de098ff5b7
Rename win_susp_msoffice.yml to process_creation_susp_msoffice.yml
2019-11-04 20:36:21 +03:00
yugoslavskiy
9c19d1b58c
Rename win_susp_dxcap.yml to process_creation_susp_dxcap.yml
2019-11-04 20:36:07 +03:00
yugoslavskiy
66eba43a8d
Rename win_susp_dnx.yml to process_creation_susp_dnx.yml
2019-11-04 20:35:53 +03:00
yugoslavskiy
d18314b6b2
Rename win_susp_devtoolslauncher_execution.yml to process_creation_susp_devtoolslauncher_execution.yml
2019-11-04 20:35:43 +03:00
yugoslavskiy
49bc6ada25
Rename win_susp_cdb.yml to process_creation_susp_cdb.yml
2019-11-04 20:35:28 +03:00
yugoslavskiy
95412e5f30
Rename win_susp_bginfo.yml to process_creation_susp_bginfo.yml
2019-11-04 20:35:11 +03:00
yugoslavskiy
9371e533c3
Update win_susp_openwith_execution.yml
2019-11-04 19:05:23 +03:00
yugoslavskiy
e6a39f1061
Update win_susp_odbcconf.yml
2019-11-04 19:01:30 +03:00
yugoslavskiy
c18fa0940d
Update win_susp_msoffice.yml
2019-11-04 18:44:07 +03:00
yugoslavskiy
bd0ebf0604
Update win_susp_dxcap.yml
2019-11-04 18:43:42 +03:00
yugoslavskiy
df07291e53
Update win_susp_cdb.yml
2019-11-04 18:43:03 +03:00
yugoslavskiy
a66539c771
Update win_susp_msoffice.yml
2019-11-04 18:42:26 +03:00
yugoslavskiy
56b7402e62
Update win_susp_dxcap.yml
2019-11-04 18:38:37 +03:00
yugoslavskiy
a9fdfee5c2
Update win_susp_dnx.yml
2019-11-04 18:34:25 +03:00
yugoslavskiy
dc23e566a0
Update win_susp_devtoolslauncher_execution.yml
2019-11-04 18:30:04 +03:00
yugoslavskiy
989d75033a
Update win_susp_cdb.yml
2019-11-04 18:25:30 +03:00
yugoslavskiy
43c20d203d
Update and rename win_susp_capture_screenshots.yml to win_susp_psr_capture_screenshots.yml
2019-11-04 18:16:39 +03:00
yugoslavskiy
a800093aaf
Update win_susp_bginfo.yml
2019-11-04 18:14:44 +03:00
Florian Roth
5786688f97
rule: Firewall disabled via Netsh
2019-11-04 16:10:10 +01:00
yugoslavskiy
2697b829b0
fix logic
2019-11-04 14:57:58 +03:00
yugoslavskiy
701e7f7cc6
oscd task #2 completed
...
- new rules:
+ rules/windows/builtin/win_susp_lsass_dump_generic.yml
+
rules/windows/builtin/win_transferring_files_with_credential_data_via_ne
twork_shares.yml
+
rules/windows/builtin/win_remote_registry_management_using_reg_utility.y
ml
+ rules/windows/sysmon/sysmon_unsigned_image_loaded_into_lsass.yml
+ rules/windows/sysmon/sysmon_lsass_memory_dump_file_creation.yml
+
rules/windows/sysmon/sysmon_raw_disk_access_using_illegitimate_tools.yml
+ rules/windows/sysmon/sysmon_cred_dump_tools_dropped_files.yml
+ rules/windows/sysmon/sysmon_cred_dump_tools_named_pipes.yml
+
rules/windows/process_creation/process_creation_shadow_copies_creation.y
ml
+
rules/windows/process_creation/process_creation_shadow_copies_deletion.y
ml
+
rules/windows/process_creation/process_creation_copying_sensitive_files_
with_credential_data.yml
+
rules/windows/process_creation/process_creation_shadow_copies_access_sym
link.yml
+
rules/windows/process_creation/process_creation_grabbing_sensitive_hives
_via_reg.yml
+
rules/windows/process_creation/process_creation_mimikatz_command_line.ym
l
+
rules/windows/unsupported_logic/builtin/dumping_ntds.dit_via_dcsync.yml
+
rules/windows/unsupported_logic/builtin/dumping_ntds.dit_via_netsync.yml
.yml
- updated rules:
+ rules/windows/builtin/win_susp_raccess_sensitive_fext.yml
+ rules/windows/builtin/win_mal_creddumper.yml
+ rules/windows/builtin/win_mal_service_installs.yml
+ rules/windows/process_creation/win_susp_process_creations.yml
+ rules/windows/sysmon/sysmon_powershell_exploit_scripts.yml
+ rules/windows/sysmon/sysmon_mimikatz_detection_lsass.yml
- deprecated rules:
+ rules/windows/process_creation/win_susp_vssadmin_ntds_activity.yml
2019-11-04 04:26:34 +03:00
Florian Roth
3107c0c268
rule: Formbook rule improved
2019-10-31 09:32:18 +01:00
zinint
60bf34e220
T1042
2019-10-30 23:30:56 +03:00
zinint
b3b203e5b1
t1040
2019-10-30 23:15:19 +03:00
Florian Roth
4741b6a4d6
rule: Mustang Panda dropper
2019-10-30 18:22:40 +01:00
Florian Roth
d661771608
rule: another DTRACK reference
2019-10-30 18:22:25 +01:00
Florian Roth
3ac28f3eed
rule: DTRACK process creation
2019-10-30 15:16:33 +01:00
Thomas Patzke
219f00e3fb
Added command line parameter
...
Implements #418
2019-10-29 23:04:28 +01:00
Thomas Patzke
b6403793c1
Fixed escaping in rule
2019-10-29 22:06:23 +01:00
zinint
c243c4e210
T1035
2019-10-29 20:58:52 +03:00
Florian Roth
1a3444d0ef
docs: comment on rule expression
2019-10-28 12:02:46 +01:00
RRRabbit
becfca6b41
Added Atomic Blue Detections Repo
2019-10-28 11:59:49 +01:00
Teimur Kheirkhabarov
32b0a3987e
Several mistakes were fixed
2019-10-28 08:43:58 +03:00
Teimur Kheirkhabarov
3125b39239
Change incorrect MITRE Tags for some rules
2019-10-28 07:56:15 +03:00
zinint
87c8326133
T1033
2019-10-27 23:49:07 +03:00
zinint
55eaae1cea
Rename win_app_windows_descovery.yml to win_app_windows_discovery.yml
2019-10-27 23:15:10 +03:00
zinint
93b867024c
T1012
2019-10-27 23:13:03 +03:00
Teimur Kheirkhabarov
fde949174d
OSCD Task 1 - Privilege Escalation
2019-10-27 20:54:07 +03:00
4A616D6573
ca819d8707
Update win_susp_net_execution.yml
...
Updated tags to pass Travis CI checks.
2019-10-27 14:06:52 +11:00
root
717e40e8ed
modified win_susp_dxcap.yml
2019-10-26 20:27:32 +02:00
root
9bf0150100
modified win_susp_dnx.yml
2019-10-26 20:20:21 +02:00
root
3b70f2edd6
modified win_susp_dnx.yml
2019-10-26 20:16:40 +02:00
root
3528afeef7
modified win_susp_dnx.yml
2019-10-26 20:13:53 +02:00
root
1dca0456ee
modified win_susp_dxcap.yml
2019-10-26 20:09:25 +02:00
root
cbe0d73ce8
add win_susp_dxcap.yml
2019-10-26 20:06:02 +02:00
root
aaf63d2238
add win_susp_dxcap.yml
2019-10-26 20:02:25 +02:00
root
0616c2c39d
add win_susp_dnx.yml
2019-10-26 19:58:45 +02:00
root
ee21888e67
add win_susp_cdb.yml
2019-10-26 19:49:45 +02:00
Florian Roth
42808b7eb8
rule: webshell detection improved
2019-10-26 09:14:54 +02:00
root
844d55c781
add win_susp_bginfo.yml
2019-10-26 08:18:37 +02:00
root
5bb5938e86
add win_susp_bginfo.yml
2019-10-26 08:16:08 +02:00
root
01c4c7cdbd
modifed win_susp_msoffice.yml
2019-10-26 08:11:09 +02:00
root
bea2daac45
modifed win_susp_msoffice.yml
2019-10-26 07:55:44 +02:00
root
fc7f8ecea3
add win_susp_msoffice.yml
2019-10-26 07:48:38 +02:00
root
611c193826
modifed win_susp_odbcconf.yml
2019-10-26 07:45:53 +02:00
root
aa9a22e662
add win_susp_odbcconf.yml
2019-10-25 19:02:17 +02:00
alexpetrov12
8c2b7e9f85
fix
2019-10-25 18:30:40 +03:00
alexpetrov12
7aa804fe90
added new rules
...
Packet capture Windows command prompt, ODBCCONF execution dll, Windows Registry Persistence - COM key linking
2019-10-25 18:01:36 +03:00
zinint
6e94e798be
t1010
2019-10-25 16:12:51 +03:00
stvetro
dcaacd07bf
4 rules to cover ART
2019-10-25 15:38:47 +04:00
yugoslavskiy
5eb484a062
add tieto dns exfiltration rules
2019-10-25 04:30:55 +02:00
4A616D6573
5678357f4e
Update win_susp_net_execution.yml
...
Added tag for:
References:
https://attack.mitre.org/techniques/T1077/
https://eqllib.readthedocs.io/en/latest/analytics/9b3dd402-891c-4c4d-a662-28947168ce61.html
2019-10-25 12:20:47 +11:00
4A616D6573
a7a753862c
Update win_susp_net_execution.yml
...
Added:
1. Additional tags for techniques as defined by Atomic Blue.
2. Detection for OriginalFileName as net.exe can easily be renamed.
Part of oscd.community effort.
2019-10-25 12:06:32 +11:00
Florian Roth
a5ec6722a1
rule: the actual changes to hwp rule
2019-10-24 15:35:13 +02:00
zinint
7c5dc0ca01
Update win_data_compressed.yml
2019-10-24 15:34:13 +03:00
Florian Roth
86c1b4ae4b
rule: hwp exploits
2019-10-24 11:46:56 +02:00
alexpetrov12
cc998aa667
fix
2019-10-24 00:48:43 +03:00
mrblacyk
499627edf3
File permissions modification (T1222)
2019-10-23 11:24:13 -07:00
mrblacyk
4979b56296
Domain Trust Discovery rule (T1482)
2019-10-23 11:23:12 -07:00
mrblacyk
262514c782
Windows Service stop rule (T1489)
2019-10-23 11:22:09 -07:00
alexpetrov12
4c84412944
added new rule
...
silenttrinity_stage_ use, sysmon_mimikatz_сreds_dump, sysmon_registry_persistence_key_linking, sysmon_сreds_dump
2019-10-23 18:08:30 +03:00
alexpetrov12
bc943343df
update win_sysmon_driver_unload
2019-10-23 15:41:14 +03:00
alexpetrov12
215e500894
fix
2019-10-23 14:43:01 +03:00
alexpetrov12
193c95a11a
add new rule1
2019-10-23 14:27:52 +03:00
root
edcbc49ce8
add rule win_susp_open with_execution.yml win_susp_devt oolslauncher_execution.yml
2019-10-23 13:00:21 +02:00
alexpetrov12
043e3f7ca6
fix
2019-10-23 13:48:44 +03:00
alexpetrov12
e38540a37f
fix
2019-10-23 13:28:04 +03:00
alexpetrov12
c1cfbacd24
fix
2019-10-23 13:18:57 +03:00
alexpetrov12
ad9b98541c
fix
2019-10-23 13:05:38 +03:00
alexpetrov12
fa4a8c974d
fix
2019-10-23 12:45:06 +03:00
alexpetrov12
f4ea01217e
fix
2019-10-23 02:47:04 +03:00
alexpetrov12
ebe4fe0377
fix
2019-10-23 02:42:37 +03:00
alexpetrov12
29cd7fed3e
fix
2019-10-23 02:39:40 +03:00
alexpetrov12
5a260db459
fix
2019-10-23 02:27:14 +03:00
alexpetrov12
6c4f4ce309
fix
2019-10-23 02:25:04 +03:00
alexpetrov12
8d0c89b598
added new rules
...
add rule MiniDumpWriteDump via COM+, renamed_binary_description, cobalt_execute_assembly, win_sysmon_driver_onload
2019-10-23 01:55:03 +03:00
Florian Roth
3d4ce9d175
rule: another reference link for 'execution by ordinal'
2019-10-22 15:18:19 +02:00
zinint
a8bd2c8e78
Update win_data_compressed.yml
2019-10-22 14:57:53 +03:00
zinint
74d1fef8b8
Update win_data_compressed.yml
2019-10-22 14:53:43 +03:00
zinint
cc6d4b05ac
OSCD Task 7 : ART T1002 Exfiltration With Rar
...
OSCD Task 7 : ART T1002 Compress Data for Exfiltration With Rar
2019-10-22 14:00:52 +03:00
Florian Roth
b3654947bc
rule: suspicious call by ordinal (rundll32)
2019-10-22 12:40:26 +02:00
Florian Roth
0f02f2bdfc
rule: adjusted very noisy rule on AppLocker whitelist bypass
2019-10-22 12:32:37 +02:00
root
00a757959e
add rule win_susp_capture_screenshots.yml
2019-10-22 06:06:07 +02:00
zinint
daf1034621
Update win_possible_applocker_bypass.yml
2019-10-22 00:54:29 +03:00
Florian Roth
ab292a4029
rule: simplified Emotet rule
2019-10-16 15:29:42 +02:00
Florian Roth
5d143f4f22
rule: emotet rule references extended
2019-10-16 13:18:44 +02:00
Florian Roth
d46154da5c
rule: extending Emotet rule
2019-10-16 10:22:48 +02:00
Florian Roth
4ea469d138
rule: suspicious compression tool parameters
2019-10-15 16:38:53 +02:00
Florian Roth
52fef7ae10
Merge pull request #468 from 2d4d/lsass_without_exe
...
remove .exe from lsass
2019-10-14 18:03:13 +02:00
Florian Roth
8db1cac910
fix: made rule compatible with event id 4688
2019-10-14 18:01:24 +02:00
Florian Roth
0e2284a176
rule: modified the default
2019-10-14 17:50:48 +02:00
Florian Roth
312311494d
rule: suspicious code page switch using chcp
2019-10-14 17:45:25 +02:00
2d4d
cf5d7f11ad
remove .exe from lsass
2019-10-14 17:26:33 +02:00
Florian Roth
5583684efd
rule: extended suspicious procdump rule
2019-10-14 16:21:37 +02:00
Florian Roth
60af1f5a4b
rule: WMI Backdoor Exchange Transport Agent
2019-10-11 12:12:44 +02:00
Thomas Patzke
60ef593a6f
Fixed wrong backslash escaping of *
...
Fixes issue #466
2019-10-07 22:14:44 +02:00
Florian Roth
3eaf4d6e94
fix: fixed typo in bluemashroom rule
2019-10-02 15:45:55 +02:00
Florian Roth
6d78a5fede
rule: extended the command line in bluemashroom rule
2019-10-02 14:03:34 +02:00
Florian Roth
7423fe2072
fix: fixed typo in APT group name
2019-10-02 14:02:07 +02:00
Florian Roth
e993ef46f0
rule: APT blue mushroom
2019-10-02 13:57:14 +02:00
Florian Roth
4bc7f6ea52
rule: QBot process creation
2019-10-01 17:25:04 +02:00
Florian Roth
52df9e9f44
rule: execution in Outlook temp folder
2019-10-01 16:07:43 +02:00
Florian Roth
9a7ef0e3c2
fix: fixed rule warning
2019-09-30 19:38:40 +02:00
Florian Roth
2fbd35053e
rule: improved formbook detection rule
2019-09-30 19:01:40 +02:00
Florian Roth
38831a05ae
rule: formbook malware process creation
2019-09-30 18:57:58 +02:00
Florian Roth
05ca684962
rule: improved emotet rule
2019-09-30 17:17:23 +02:00
Florian Roth
66cbdbfff5
rule: emotet process creation
2019-09-30 15:53:29 +02:00
Florian Roth
93227e1eec
Merge pull request #436 from EccoTheFlintstone/master
...
rule: impacket framework lateralization detection
2019-09-28 11:37:07 +02:00
Florian Roth
ad59c90b29
Capitalization in Title
2019-09-28 10:30:16 +02:00
Florian Roth
0eb5fd75e1
Merge pull request #446 from EccoTheFlintstone/eventclear
...
move wevtutil / fsutil events from ransomware to dedicated rules
2019-09-28 10:29:03 +02:00
Florian Roth
29c5a9dc8e
Merge pull request #458 from EccoTheFlintstone/psexec
...
fix: PsExec false positives
2019-09-28 10:15:23 +02:00
ecco
5a15687c6c
fix rule: task manager as parent: task manager can be run with higher privileges (show processes from all users --> UAC) and its parent is still the old taskmgr
2019-09-27 11:06:21 -04:00
ecco
7a1d48cccd
fix: PsExec false positives
2019-09-26 04:50:43 -04:00
Florian Roth
e77657db2f
Merge pull request #451 from EccoTheFlintstone/sysmon_clean
...
sysmon rules cleanup and move to process_creation
2019-09-25 17:28:23 +02:00
ecco
c2868f6e03
remove TAB from cli escape as it's currently unsupported in sigmac
2019-09-23 04:46:10 -04:00
ecco
0c96777f6a
sysmon rules cleanup and move to process_creation
2019-09-11 10:24:43 -04:00
ecco
b410710338
move wevtutil / fsutil events from ransomware to dedicated rules
2019-09-06 10:57:03 -04:00
Florian Roth
fcbae16cc8
rule: image debugger
2019-09-06 10:28:20 +02:00
Thomas Patzke
afe6668fbd
Merge pull request #438 from duzvik/master
...
Escaped '\*' to '\*' where required
2019-09-05 10:57:25 +02:00
Thomas Patzke
f9f5558ae1
Merge pull request #392 from TareqAlKhatib/shim
...
Fixed commandline to detect any shim install from any location
2019-09-05 10:28:50 +02:00
ecco
bdf8f99fdb
fix typo
2019-09-04 11:31:00 -04:00
Florian Roth
7bef822da7
rule: minor improvement to susp ps enc cmd
2019-09-04 16:31:49 +02:00
Denys Iuzvyk
774be4d008
Escaped '\*' to '\*' where required
2019-09-04 14:05:58 +03:00
ecco
fc89804f34
rule: impacket framework lateralization detection
2019-09-03 10:28:59 -04:00
ecco
8cad0c638e
add comcvcs.dll memdump method
2019-09-02 07:49:19 -04:00
Florian Roth
dca5a7a248
Merge pull request #432 from EccoTheFlintstone/master
...
add/modify powershell Empire rules
2019-09-02 11:40:36 +02:00
ecco
5f30e52739
add/modify powershell Empire rules
2019-09-02 05:04:44 -04:00
Florian Roth
ace0cc36c6
rule: improved csc rule
2019-08-31 08:44:09 +02:00
Florian Roth
70a26a6132
fix: fixed MITRE tags
2019-08-24 13:58:54 +02:00
