5768 Commits

Author	SHA1	Message	Date
Florian Roth	6b2bacd2cc	Merge pull request #1979 from frack113/test_global ... Change ID in global action rule	2021-09-06 08:44:14 +02:00
frack113	013eb2e11f	Merge pull request #1993 from zakibro/master ... New Rule - Linux-Audio-Capture	2021-09-05 18:30:45 +02:00
frack113	44a5792be3	Revert win_apt_apt29_tor.yml	2021-09-05 12:34:24 +02:00
frack113	ca4c156fa4	Update win_apt_apt29_tor.yml	2021-09-05 11:20:57 +02:00
frack113	acf2bfbd27	Update sigma_uuid verify ... Make a better verify code	2021-09-05 10:43:42 +02:00
zakibro	5042ba65ac	Update lnx_auditd_audio_capture.yml ... Added more references about arecord.	2021-09-05 09:28:53 +02:00
Austin Songer	fa5554660c	Update sysmon_mal_cobaltstrike_re.yml	2021-09-04 17:33:05 -05:00
Pawel Mazur	caf78b5ea1	New Rule - Linux-Audio-Capture	2021-09-04 22:10:34 +02:00
Austin Songer	e7c5827776	Update azure_service_principal_removed.yml	2021-09-03 22:43:11 -05:00
Austin Songer	0612ea7f6e	Update azure_device_no_longer_managed_or_compliant.yml	2021-09-03 22:42:26 -05:00
Austin Songer	c420a17e05	Update azure_service_principal_removed.yml	2021-09-03 22:29:21 -05:00
Austin Songer	fda1e3362e	Update azure_owner_removed_from_application_or_service_principal.yml	2021-09-03 22:29:12 -05:00
Austin Songer	9d26116d27	Update azure_device_no_longer_managed_or_compliant.yml	2021-09-03 22:29:02 -05:00
Austin Songer	8fe7bfc452	Update azure_application_deleted.yml	2021-09-03 22:28:53 -05:00
Austin Songer	c021ae9e7c	Update and rename azure_device_or_configuration_deleted.yml to azure_device_or_configuration_modified_or_deleted.yml	2021-09-03 22:28:35 -05:00
Austin Songer	6744fb7f2e	Create azure_application_deleted.yml	2021-09-03 22:25:34 -05:00
Austin Songer	70ac0104cf	Create azure_service_principal_removed.yml	2021-09-03 22:25:01 -05:00
Austin Songer	6e15618c75	Create azure_device_or_configuration_deleted.yml	2021-09-03 22:24:32 -05:00
Austin Songer	b478132769	Create azure_owner_removed_from_application_or_service_principal.yml	2021-09-03 22:23:59 -05:00
Austin Songer	c0bdc3fb1b	Create azure_device_no_longer_managed_or_compliant.yml	2021-09-03 22:23:21 -05:00
frack113	6780182c37	Merge pull request #1974 from frack113/tags_pack2 ... Add missing Tags	2021-09-03 19:13:32 +02:00
frack113	2e474628fa	Merge pull request #1987 from zakibro/master ... New Rule - Linux-Auditd-System Information Discovery	2021-09-03 19:10:28 +02:00
frack113	688df3405a	Merge pull request #1970 from frack113/red_T1564.004_1 ... Redcanary t1564.004 ADS test 1	2021-09-03 19:06:51 +02:00
frack113	77c6b74c72	Merge pull request #1985 from mvelazc0/master ... Adding Petitpotam/ADCS attack vector detections	2021-09-03 19:06:03 +02:00
mvelazco	a7a002cb7f	updating fields as per frack113 feedback	2021-09-03 10:01:54 -04:00
frack113	769451dc03	Add missing id	2021-09-03 13:42:15 +02:00
frack113	815134df7f	Cleanup	2021-09-03 13:30:10 +02:00
phantinuss	aa2e86963c	fix: rename filter	2021-09-03 13:26:34 +02:00
phantinuss	f3bdb0e43d	fix: remove unneeded selection	2021-09-03 13:26:23 +02:00
phantinuss	2de2de8433	Addition to UAC Bypasses	2021-09-03 13:26:11 +02:00
zakibro	8bd859f550	Update lnx_auditd_system_info_discovery.yml	2021-09-03 13:07:42 +02:00
ncrqnt	adc3c9e608	fixed date: switched day/month	2021-09-03 12:03:38 +02:00
Pawel Mazur	864286e206	New Rule - Linux-Auditd-System Information Discovery	2021-09-03 11:33:18 +02:00
frack113	89562273cc	Merge pull request #1984 from austinsonger/azure_app_credential_modification.yml ... azure_app_credential_modification.yml	2021-09-03 08:17:55 +02:00
frack113	88389f945d	Merge pull request #1983 from austinsonger/azure_service_principal_created.yml ... azure_service_principal_created.yml	2021-09-03 08:14:47 +02:00
frack113	d40cdec062	Merge pull request #1982 from austinsonger/azure_network_firewall_policy_modified_or_deleted.yml ... azure_network_firewall_policy_modified_or_deleted.yml	2021-09-03 08:13:30 +02:00
frack113	bd1b4c0d70	Merge pull request #1978 from rachelrice/update_aws_login ... Update AWS Update Login Profile rule	2021-09-03 08:12:28 +02:00
frack113	1fc2a39720	Merge pull request #1975 from frack113/red_T1564.004_2 ... Redcanary t1564.004 test 2	2021-09-03 08:12:08 +02:00
frack113	11e4b900e4	Update global id	2021-09-03 06:59:40 +02:00
frack113	135d0a2c61	Update global id	2021-09-03 06:50:00 +02:00
frack113	a6bb5574fb	Update global id	2021-09-03 06:35:35 +02:00
mvelazco	ba41e922d2	adding Petitpotam host detections	2021-09-03 00:12:49 -04:00
Austin Songer	775c0e8e7f	Update azure_app_credential_modification.yml	2021-09-02 21:00:21 -05:00
Austin Songer	643ec0abe3	Update azure_service_principal_created.yml	2021-09-02 21:00:02 -05:00
Austin Songer	10af7bbdb1	Create azure_app_credential_modification.yml	2021-09-02 20:53:32 -05:00
Austin Songer	d25fd420d6	Create azure_service_principal_created.yml	2021-09-02 20:48:35 -05:00
Austin Songer	1272c76ae7	Create azure_network_firewall_policy_modified_or_deleted.yml	2021-09-02 20:31:27 -05:00
frack113	d02ee1eddd	Update global ID	2021-09-02 21:16:55 +02:00
frack113	f90c7558a7	update global id	2021-09-02 21:03:25 +02:00
frack113	ac90ee0002	Update global ID	2021-09-02 20:23:23 +02:00
frack113	086a15fc45	Update global ID	2021-09-02 20:07:03 +02:00
Rachel Rice	78d3fa4795	Update AWS STS AssumeRole Misuse rule ... Update selection criteria for AWS STS AssumeRole Misuse rule for any event by an AssumedRole userIdentity. Closes SigmaHQ/sigma#1963.	2021-09-02 17:40:35 +01:00
Rachel Rice	7ccb773b20	Update AWS Update Login Profile rule ... Update selection criteria for AWS Update Login Profile rule to check for mismatch between userIdentity.arn and requestParameters.userName. Closes SigmaHQ/sigma#1966.	2021-09-02 17:37:41 +01:00
frack113	9bcefc6a93	move uuid from global	2021-09-02 16:05:05 +02:00
frack113	b731c20594	Merge pull request #1971 from phantinuss/master ... fix: prevent possible FPs	2021-09-02 15:34:46 +02:00
frack113	a048403089	Merge pull request #1973 from klingerko/cs_namedpipe_updates ... Remove duplicate and regex improvements	2021-09-02 15:25:01 +02:00
phantinuss	ab721c736c	chore: move level/falsepositives to bottom	2021-09-02 14:55:17 +02:00
klingerko	15e25f9635	update modifed date	2021-09-02 14:50:14 +02:00
phantinuss	0b373ff1e9	fix: remove 2nd selection due to FPs	2021-09-02 14:47:47 +02:00
frack113	6a1b95d947	Findstr covert by win_susp_findstr.yml	2021-09-02 14:22:59 +02:00
frack113	aaa568ff2d	print covert by win_susp_print.yml	2021-09-02 14:18:38 +02:00
phantinuss	5cb6eed52e	fix: remove single value lists	2021-09-02 14:09:03 +02:00
phantinuss	f4a5df67ae	further narrowing down of the selection, therefore removing the filter	2021-09-02 10:28:01 +02:00
frack113	90e673e5ac	fix invalid tags	2021-09-02 10:17:50 +02:00
Florian Roth	0603581111	Merge pull request #1969 from SigmaHQ/rule-devel ... More Named Pipe Rules and WMI rule refactoring	2021-09-02 10:15:00 +02:00
frack113	6f1f70ca5e	Add missing tags	2021-09-02 09:59:19 +02:00
frack113	25c6f69ea3	update references	2021-09-02 09:51:44 +02:00
frack113	5e87970c77	add powershell_store_file_in_alternate_data_stream.yml	2021-09-02 09:47:54 +02:00
frack113	5212b388c6	Merge pull request #1967 from d4rk-d4nph3/master ... Added rule for detection of Atera RMM Agent installation	2021-09-02 09:19:49 +02:00
frack113	e0cd35261c	add missing tags	2021-09-01 20:01:03 +02:00
frack113	1ba0a7c7a3	add missing tags	2021-09-01 19:38:35 +02:00
Konstantin Klinger	457da818a4	regex optimisations	2021-09-01 17:06:55 +02:00
Konstantin Klinger	e83ee55573	remove duplicate	2021-09-01 17:05:36 +02:00
Florian Roth	b0c2d7b75a	fix: tags for WMI / execution / persistence	2021-09-01 16:34:50 +02:00
Florian Roth	2f7f050ad8	fix: removed tags	2021-09-01 16:32:27 +02:00
phantinuss	0b38237dbf	fix: add relation to now obsolete rule	2021-09-01 15:38:29 +02:00
phantinuss	ae9966bdcc	fix: unifying two overlapping rules	2021-09-01 14:48:32 +02:00
phantinuss	deefcaa8ac	fix: prevent possible FPs with the respective command only used as the last parameter	2021-09-01 14:33:46 +02:00
frack113	434c3891ff	Merge pull request #1965 from frack113/add_tags ... Add tags when missing	2021-09-01 14:07:31 +02:00
Florian Roth	1aac21ba79	fix: single list item issue	2021-09-01 14:03:42 +02:00
Florian Roth	1c4f642227	Merge pull request #1699 from matsto/patch-1 ... Fixed transformation modifier for keywords	2021-09-01 14:02:10 +02:00
frack113	2dbbaf0180	fix missing char in date	2021-09-01 14:00:55 +02:00
Florian Roth	505140d273	rule: extended WMI suspicious scripts rule	2021-09-01 13:57:48 +02:00
Florian Roth	e787420be1	rule: WMI filter content encoded executable	2021-09-01 13:57:36 +02:00
Florian Roth	8761927e8c	rule: susp scrcons.exe creating named pipe	2021-09-01 13:57:17 +02:00
frack113	e71fce6f11	fix errors	2021-09-01 13:55:14 +02:00
Florian Roth	affc929c3b	LiquidSnake named pipe	2021-09-01 13:54:47 +02:00
frack113	80dbfa7af5	add process_creation_alternate_data_streams.yml	2021-09-01 13:52:09 +02:00
Florian Roth	c8b3036949	Merge pull request #1968 from SigmaHQ/rule-devel ... docs: note to improved sysmon config	2021-09-01 13:21:28 +02:00
Florian Roth	f102b2d9a1	docs: note to improved sysmon config	2021-09-01 13:07:18 +02:00
Florian Roth	8bba246205	refactor: better way to write it	2021-09-01 12:57:34 +02:00
frack113	2cb5f5e4c6	add missing tags	2021-09-01 12:54:21 +02:00
Florian Roth	c146bc44c7	Merge branch 'master' into patch-1	2021-09-01 12:48:51 +02:00
Bhabesh Rai	6859b6c38f	Added rule for detection of Atera RMM Agent installation	2021-09-01 15:24:47 +05:45
frack113	af599e4877	Merge pull request #1958 from phantinuss/master ... Bulk of new rules, mainly UAC Bypasses	2021-09-01 10:53:02 +02:00
frack113	892c58270a	Update tags	2021-09-01 10:33:57 +02:00
frack113	4b8ffbc183	Update tags	2021-09-01 10:30:43 +02:00
phantinuss	9ffdced740	fix: implement suggestions from PR discussion	2021-09-01 10:21:37 +02:00
frack113	240c5584ff	update tags	2021-09-01 09:56:46 +02:00
frack113	6f3fc7036e	Update tags	2021-09-01 09:45:31 +02:00