1365 Commits

Author	SHA1	Message	Date
yugoslavskiy	4fa928866f	oscd task #6 done. ... add 25 new rules: - win_ad_replication_non_machine_account.yml - win_dpapi_domain_backupkey_extraction.yml - win_protected_storage_service_access.yml - win_dpapi_domain_masterkey_backup_attempt.yml - win_sam_registry_hive_handle_request.yml - win_sam_registry_hive_dump_via_reg_utility.yml - win_lsass_access_non_system_account.yml - win_ad_object_writedac_access.yml - powershell_alternate_powershell_hosts.yml - sysmon_remote_powershell_session_network.yml - win_remote_powershell_session.yml - win_scm_database_handle_failure.yml - win_scm_database_privileged_operation.yml - sysmon_wmi_module_load.yml - sysmon_remote_powershell_session_process.yml - sysmon_rdp_registry_modification.yml - sysmon_powershell_execution_pipe.yml - sysmon_alternate_powershell_hosts_pipe.yml - sysmon_powershell_execution_moduleload.yml - sysmon_createremotethread_loadlibrary.yml - sysmon_alternate_powershell_hosts_moduleload.yml - powershell_remote_powershell_session.yml - win_non_interactive_powershell.yml - win_syskey_registry_access.yml - win_wmiprvse_spawning_process.yml improve 1 rule: - rules/windows/builtin/win_account_backdoor_dcsync_rights.yml	2019-11-10 18:43:41 +03:00
yugoslavskiy	c0ac9b8fb9	fix conflict	2019-11-10 17:31:33 +03:00
yugoslavskiy	127335a0ec	Merge pull request #482 from yugoslavskiy/master ... [OSCD][The ThreatHunter-Playbook] Task 6: DONE	2019-11-10 17:27:54 +03:00
yugoslavskiy	a59d4fdd33	Merge branch 'master' of https://github.com/Neo23x0/sigma into oscd	2019-11-10 14:47:27 +03:00
Florian Roth	8cc16d252a	fix: more FP reductions	2019-11-09 23:36:29 +01:00
Florian Roth	038f205f0f	fix: FPs with UserInitMprLogonScript rule	2019-11-09 23:32:53 +01:00
Florian Roth	fbe138ed90	rule: reduced level of rule to medium due to FPs	2019-11-09 23:24:31 +01:00
Florian Roth	9835950f04	rule: SID to AD object rule level adjusted	2019-11-09 12:49:54 +01:00
Florian Roth	be62fad5cc	fix: fixed false positive in suspicious shell spawn rule	2019-11-09 10:45:46 +01:00
Thomas Patzke	8ae824f09f	Improved rules ... Reduced false positives	2019-11-08 23:56:14 +01:00
Thomas Patzke	6e2fe09d24	Removed invalid tags	2019-11-08 22:02:12 +01:00
yugoslavskiy	b176339da8	Merge pull request #479 from alexpetrov12/master ... add rule	2019-11-08 02:16:22 +03:00
yugoslavskiy	00fc6c62b4	Delete renamed_binary_description.yml ... agreed on improvements. will be added later	2019-11-08 02:16:01 +03:00
yugoslavskiy	98f32e9098	Delete sysmon_mimikatz_сreds_dump.yml ... merged with rules/windows/sysmon/sysmon_cred_dump_lsass_access.yml	2019-11-08 02:06:31 +03:00
yugoslavskiy	6d61401b12	Delete sysmon_сreds_dump.yml ... merged with rules/windows/sysmon/sysmon_cred_dump_lsass_access.yml	2019-11-08 02:06:20 +03:00
yugoslavskiy	562e07de38	Delete cobalt_execute_assembly.yml ... merged with existing [sysmon_cobaltstrike_process_injection.yml](https://github.com/Neo23x0/sigma/blob/oscd/rules/windows/sysmon/sysmon_cobaltstrike_process_injection.yml)	2019-11-08 01:42:42 +03:00
yugoslavskiy	52d099a6e3	improve sysmon_cobaltstrike_process_injection.yml	2019-11-08 01:41:26 +03:00
yugoslavskiy	4443870577	Delete win_odbcconf_execution.yml ... merged with rules/windows/process_creation/win_odbcconf_execution.yml	2019-11-08 01:36:03 +03:00
yugoslavskiy	3b34ed6150	add modifiers	2019-11-08 01:34:30 +03:00
yugoslavskiy	6083d70975	Update sysmon_registry_persistence_key_linking.yml	2019-11-07 04:23:20 +03:00
yugoslavskiy	82b185db6a	Update win_sysmon_driver_unload.yml	2019-11-07 04:11:26 +03:00
yugoslavskiy	404a6d9915	Update win_netsh_packet_capture.yml	2019-11-07 03:37:41 +03:00
yugoslavskiy	ddf24819ed	Update silenttrinity_stage_use.yml	2019-11-07 03:33:12 +03:00
yugoslavskiy	0d8c64da86	duplicate rule deleted ... this rule already present in Sigma repo — [./rules/windows/process_creation/win_susp_comsvcs_procdump.yml](https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_susp_comsvcs_procdump.yml)	2019-11-07 03:21:09 +03:00
yugoslavskiy	5513687e63	Merge branch 'master' of https://github.com/Neo23x0/sigma into oscd	2019-11-07 03:03:35 +03:00
Florian Roth	c60563e546	rule: add modified rule date	2019-11-05 11:24:52 +01:00
yugoslavskiy	82f23c5f63	Merge pull request #477 from zinint/oscd ... add 13 new rules: - rules/linux/auditd/lnx_auditd_masquerading_crond.yml - rules/linux/auditd/lnx_auditd_user_discovery.yml - rules/linux/auditd/lnx_data_compressed.yml - rules/linux/auditd/lnx_network_sniffing.yml - rules/windows/powershell/powershell_data_compressed.yml - rules/windows/powershell/powershell_winlogon_helper_dll.yml - rules/windows/process_creation/win_change_default_file_association.yml - rules/windows/process_creation/win_data_compressed_with_rar.yml - rules/windows/process_creation/win_local_system_owner_account_discovery.yml - rules/windows/process_creation/win_network_sniffing.yml - rules/windows/process_creation/win_query_registry.yml - rules/windows/process_creation/win_service_execution.yml - rules/windows/process_creation/win_xsl_script_processing.yml modify 1 rule: - rules/windows/process_creation/win_possible_applocker_bypass.yml	2019-11-05 04:55:29 +03:00
yugoslavskiy	cc7aebe9b6	Update win_service_execution.yml	2019-11-05 04:42:53 +03:00
yugoslavskiy	534f5fc0e1	Update lnx_network_sniffing.yml	2019-11-05 04:40:40 +03:00
yugoslavskiy	70fdd9c7d7	Update lnx_data_compressed.yml	2019-11-05 04:38:27 +03:00
yugoslavskiy	ac95d840b4	Update powershell_winlogon_helper_dll.yml	2019-11-05 04:33:07 +03:00
yugoslavskiy	479aafe466	Update win_service_execution.yml	2019-11-05 04:26:19 +03:00
yugoslavskiy	37674b944f	Update win_query_registry.yml	2019-11-05 03:04:46 +03:00
yugoslavskiy	9d9de64387	Update win_query_registry.yml	2019-11-05 03:00:33 +03:00
yugoslavskiy	27e63abcc4	Update and rename win_custom_service_execution.yml to win_service_execution.yml	2019-11-05 02:57:15 +03:00
yugoslavskiy	3d5f5e2fe7	Update win_custom_service_execution.yml	2019-11-05 02:56:50 +03:00
yugoslavskiy	66bfbd0af9	Update and rename win_service_execution.yml to win_custom_service_execution.yml	2019-11-05 02:55:41 +03:00
yugoslavskiy	c147863eb3	Update powershell_data_compressed.yml	2019-11-05 02:38:36 +03:00
yugoslavskiy	b755d4fb68	Update and rename win_system_owner_user_discovery.yml to win_local_system_owner_account_discovery.yml	2019-11-05 02:31:20 +03:00
yugoslavskiy	9831897b6b	Update win_xsl_script_processing.yml	2019-11-05 01:32:29 +03:00
yugoslavskiy	ce55f80fb6	Update win_xsl_script_processing.yml	2019-11-05 01:31:55 +03:00
zinint	cd1cd48619	Delete win_app_windows_discovery.yml	2019-11-05 01:18:26 +03:00
zinint	a3ec56da07	Update win_xsl_script_processing.yml	2019-11-05 00:02:19 +03:00
zinint	fd6875485b	Add files via upload	2019-11-05 00:00:14 +03:00
zinint	cd43354c04	Delete sysmon_xsl_script_processing.yml	2019-11-04 23:47:23 +03:00
zinint	2679baddcd	Delete powershell_network_sniffing.yml	2019-11-04 23:46:43 +03:00
yugoslavskiy	e81f4f0ea6	Update sysmon_xsl_script_processing.yml	2019-11-04 23:42:47 +03:00
yugoslavskiy	b565398bc5	Update win_network_sniffing.yml	2019-11-04 23:02:03 +03:00
yugoslavskiy	e38116fce2	Update and rename win_data_compressed.yml to win_data_compressed_with_rar.yml	2019-11-04 22:55:32 +03:00
yugoslavskiy	cb167e73b1	fix filenames	2019-11-04 22:49:28 +03:00