Austin Songer
|
0de95e355a
|
Update azure_federation_modified.yml
|
2021-09-06 11:31:52 -05:00 |
|
Austin Songer
|
e6e3fc2eec
|
Update azure_federation_modified.yml
|
2021-09-06 11:16:35 -05:00 |
|
Austin Songer
|
6025df63ee
|
Create azure_federation_modified.yml
|
2021-09-06 11:06:58 -05:00 |
|
Florian Roth
|
6b2bacd2cc
|
Merge pull request #1979 from frack113/test_global
Change ID in global action rule
|
2021-09-06 08:44:14 +02:00 |
|
frack113
|
013eb2e11f
|
Merge pull request #1993 from zakibro/master
New Rule - Linux-Audio-Capture
|
2021-09-05 18:30:45 +02:00 |
|
frack113
|
4bfdbf5442
|
Merge branch 'test_global' of https://github.com/frack113/sigma into test_global
|
2021-09-05 17:51:11 +02:00 |
|
frack113
|
dc88ad7c73
|
fix sigma_uuid assign id
|
2021-09-05 17:50:54 +02:00 |
|
frack113
|
981d330d20
|
Merge branch 'test_global' of github.com:frack113/sigma into test_global
|
2021-09-05 12:37:52 +02:00 |
|
frack113
|
c82a652a34
|
Revert win_apt_apt29_tor.yml
|
2021-09-05 12:37:30 +02:00 |
|
frack113
|
44a5792be3
|
Revert win_apt_apt29_tor.yml
|
2021-09-05 12:34:24 +02:00 |
|
frack113
|
b0964250b1
|
Update win_apt_apt29_tor.yml
|
2021-09-05 12:23:45 +02:00 |
|
frack113
|
ca4c156fa4
|
Update win_apt_apt29_tor.yml
|
2021-09-05 11:20:57 +02:00 |
|
frack113
|
acf2bfbd27
|
Update sigma_uuid verify
Make a better verify code
|
2021-09-05 10:43:42 +02:00 |
|
zakibro
|
5042ba65ac
|
Update lnx_auditd_audio_capture.yml
Added more references about arecord.
|
2021-09-05 09:28:53 +02:00 |
|
frack113
|
254b43f17f
|
Merge pull request #1994 from austinsonger/sysmon_mal_cobaltstrike_re.yml
Update sysmon_mal_cobaltstrike_re.yml
|
2021-09-05 09:20:22 +02:00 |
|
Austin Songer
|
fa5554660c
|
Update sysmon_mal_cobaltstrike_re.yml
|
2021-09-04 17:33:05 -05:00 |
|
Pawel Mazur
|
caf78b5ea1
|
New Rule - Linux-Audio-Capture
|
2021-09-04 22:10:34 +02:00 |
|
frack113
|
2d9e09ecc3
|
Merge pull request #1991 from austinsonger/Azure-Rules
Azure rules
|
2021-09-04 08:43:00 +02:00 |
|
Austin Songer
|
e7c5827776
|
Update azure_service_principal_removed.yml
|
2021-09-03 22:43:11 -05:00 |
|
Austin Songer
|
0612ea7f6e
|
Update azure_device_no_longer_managed_or_compliant.yml
|
2021-09-03 22:42:26 -05:00 |
|
Austin Songer
|
c420a17e05
|
Update azure_service_principal_removed.yml
|
2021-09-03 22:29:21 -05:00 |
|
Austin Songer
|
fda1e3362e
|
Update azure_owner_removed_from_application_or_service_principal.yml
|
2021-09-03 22:29:12 -05:00 |
|
Austin Songer
|
9d26116d27
|
Update azure_device_no_longer_managed_or_compliant.yml
|
2021-09-03 22:29:02 -05:00 |
|
Austin Songer
|
8fe7bfc452
|
Update azure_application_deleted.yml
|
2021-09-03 22:28:53 -05:00 |
|
Austin Songer
|
c021ae9e7c
|
Update and rename azure_device_or_configuration_deleted.yml to azure_device_or_configuration_modified_or_deleted.yml
|
2021-09-03 22:28:35 -05:00 |
|
Austin Songer
|
6744fb7f2e
|
Create azure_application_deleted.yml
|
2021-09-03 22:25:34 -05:00 |
|
Austin Songer
|
70ac0104cf
|
Create azure_service_principal_removed.yml
|
2021-09-03 22:25:01 -05:00 |
|
Austin Songer
|
6e15618c75
|
Create azure_device_or_configuration_deleted.yml
|
2021-09-03 22:24:32 -05:00 |
|
Austin Songer
|
b478132769
|
Create azure_owner_removed_from_application_or_service_principal.yml
|
2021-09-03 22:23:59 -05:00 |
|
Austin Songer
|
c0bdc3fb1b
|
Create azure_device_no_longer_managed_or_compliant.yml
|
2021-09-03 22:23:21 -05:00 |
|
frack113
|
6780182c37
|
Merge pull request #1974 from frack113/tags_pack2
Add missing Tags
|
2021-09-03 19:13:32 +02:00 |
|
frack113
|
2e474628fa
|
Merge pull request #1987 from zakibro/master
New Rule - Linux-Auditd-System Information Discovery
|
2021-09-03 19:10:28 +02:00 |
|
frack113
|
688df3405a
|
Merge pull request #1970 from frack113/red_T1564.004_1
Redcanary t1564.004 ADS test 1
|
2021-09-03 19:06:51 +02:00 |
|
frack113
|
77c6b74c72
|
Merge pull request #1985 from mvelazc0/master
Adding Petitpotam/ADCS attack vector detections
|
2021-09-03 19:06:03 +02:00 |
|
mvelazco
|
a7a002cb7f
|
updating fields as per frack113 feedback
|
2021-09-03 10:01:54 -04:00 |
|
frack113
|
6d1ab0a4c6
|
Merge pull request #1990 from phantinuss/pr2
Additional UAC Bypasses (2)
|
2021-09-03 14:00:51 +02:00 |
|
frack113
|
769451dc03
|
Add missing id
|
2021-09-03 13:42:15 +02:00 |
|
frack113
|
815134df7f
|
Cleanup
|
2021-09-03 13:30:10 +02:00 |
|
phantinuss
|
aa2e86963c
|
fix: rename filter
|
2021-09-03 13:26:34 +02:00 |
|
phantinuss
|
f3bdb0e43d
|
fix: remove unneeded selection
|
2021-09-03 13:26:23 +02:00 |
|
phantinuss
|
2de2de8433
|
Addition to UAC Bypasses
|
2021-09-03 13:26:11 +02:00 |
|
zakibro
|
8bd859f550
|
Update lnx_auditd_system_info_discovery.yml
|
2021-09-03 13:07:42 +02:00 |
|
frack113
|
8b170ff562
|
Merge pull request #1988 from ncrqnt/fix-rule-dates
fixed rule date to match specification
|
2021-09-03 13:03:19 +02:00 |
|
ncrqnt
|
adc3c9e608
|
fixed date: switched day/month
|
2021-09-03 12:03:38 +02:00 |
|
Pawel Mazur
|
864286e206
|
New Rule - Linux-Auditd-System Information Discovery
|
2021-09-03 11:33:18 +02:00 |
|
frack113
|
89562273cc
|
Merge pull request #1984 from austinsonger/azure_app_credential_modification.yml
azure_app_credential_modification.yml
|
2021-09-03 08:17:55 +02:00 |
|
frack113
|
88389f945d
|
Merge pull request #1983 from austinsonger/azure_service_principal_created.yml
azure_service_principal_created.yml
|
2021-09-03 08:14:47 +02:00 |
|
frack113
|
d40cdec062
|
Merge pull request #1982 from austinsonger/azure_network_firewall_policy_modified_or_deleted.yml
azure_network_firewall_policy_modified_or_deleted.yml
|
2021-09-03 08:13:30 +02:00 |
|
frack113
|
bd1b4c0d70
|
Merge pull request #1978 from rachelrice/update_aws_login
Update AWS Update Login Profile rule
|
2021-09-03 08:12:28 +02:00 |
|
frack113
|
1fc2a39720
|
Merge pull request #1975 from frack113/red_T1564.004_2
Redcanary t1564.004 test 2
|
2021-09-03 08:12:08 +02:00 |
|