Florian Roth
|
55e66b1843
|
rule: added status
|
2019-11-20 09:21:42 +01:00 |
|
Florian Roth
|
4022e3251b
|
rule: changed title
|
2019-11-20 09:16:00 +01:00 |
|
Florian Roth
|
158f6b3065
|
rule: exploitation of CVE-2019-1388
|
2019-11-20 09:12:02 +01:00 |
|
Florian Roth
|
98aa4d4ecb
|
fix: fixed typo in rule for renamed procdump
|
2019-11-19 15:59:07 +01:00 |
|
Florian Roth
|
2c855be9d3
|
fix: casing fix in renamed procdump rule
|
2019-11-18 15:57:14 +01:00 |
|
Florian Roth
|
93f890b31d
|
rule: renamed procdump
|
2019-11-18 15:27:04 +01:00 |
|
Florian Roth
|
da05c9bb82
|
fix: line break in description
|
2019-11-18 15:26:55 +01:00 |
|
Florian Roth
|
04288771a1
|
fix: bugfix in RottenPotato rule - wrong identifier
|
2019-11-15 11:50:03 +01:00 |
|
Florian Roth
|
7e6031705e
|
rule: RottenPotato attack pattern
|
2019-11-15 11:44:18 +01:00 |
|
Florian Roth
|
ff3ed04405
|
rule: Exploiting SetupComplete.cmd CVE-2019-1378
|
2019-11-15 00:26:18 +01:00 |
|
Florian Roth
|
2b7699cc15
|
fix: fixed broken condition
|
2019-11-14 10:15:18 +01:00 |
|
Florian Roth
|
95a8563606
|
Rule: suspicious msiexec directory
|
2019-11-14 09:51:55 +01:00 |
|
Thomas Patzke
|
0592cbb67a
|
Added UUIDs to rules
|
2019-11-12 23:12:27 +01:00 |
|
Thomas Patzke
|
5f6a4225ec
|
Unified line terminators of rules to Unix
|
2019-11-12 23:05:36 +01:00 |
|
Thomas Patzke
|
d42cc78509
|
Converted rules Sysmon/1 parts to generic process_creation
|
2019-11-12 21:06:24 +01:00 |
|
Thomas Patzke
|
0065e2420f
|
Merge branch 'oscd-qa'
|
2019-11-12 20:54:11 +01:00 |
|
Florian Roth
|
b7c3f8da91
|
refactor: cleanup, single element lists, renamed files, level adjustments
|
2019-11-12 12:55:05 +01:00 |
|
Florian Roth
|
8cc16d252a
|
fix: more FP reductions
|
2019-11-09 23:36:29 +01:00 |
|
Florian Roth
|
038f205f0f
|
fix: FPs with UserInitMprLogonScript rule
|
2019-11-09 23:32:53 +01:00 |
|
Florian Roth
|
fbe138ed90
|
rule: reduced level of rule to medium due to FPs
|
2019-11-09 23:24:31 +01:00 |
|
Florian Roth
|
9835950f04
|
rule: SID to AD object rule level adjusted
|
2019-11-09 12:49:54 +01:00 |
|
Florian Roth
|
be62fad5cc
|
fix: fixed false positive in suspicious shell spawn rule
|
2019-11-09 10:45:46 +01:00 |
|
Thomas Patzke
|
8ae824f09f
|
Improved rules
Reduced false positives
|
2019-11-08 23:56:14 +01:00 |
|
Thomas Patzke
|
6e2fe09d24
|
Removed invalid tags
|
2019-11-08 22:02:12 +01:00 |
|
yugoslavskiy
|
b176339da8
|
Merge pull request #479 from alexpetrov12/master
add rule
|
2019-11-08 02:16:22 +03:00 |
|
yugoslavskiy
|
00fc6c62b4
|
Delete renamed_binary_description.yml
agreed on improvements. will be added later
|
2019-11-08 02:16:01 +03:00 |
|
yugoslavskiy
|
98f32e9098
|
Delete sysmon_mimikatz_сreds_dump.yml
merged with rules/windows/sysmon/sysmon_cred_dump_lsass_access.yml
|
2019-11-08 02:06:31 +03:00 |
|
yugoslavskiy
|
6d61401b12
|
Delete sysmon_сreds_dump.yml
merged with rules/windows/sysmon/sysmon_cred_dump_lsass_access.yml
|
2019-11-08 02:06:20 +03:00 |
|
yugoslavskiy
|
562e07de38
|
Delete cobalt_execute_assembly.yml
merged with existing [sysmon_cobaltstrike_process_injection.yml](https://github.com/Neo23x0/sigma/blob/oscd/rules/windows/sysmon/sysmon_cobaltstrike_process_injection.yml)
|
2019-11-08 01:42:42 +03:00 |
|
yugoslavskiy
|
52d099a6e3
|
improve sysmon_cobaltstrike_process_injection.yml
|
2019-11-08 01:41:26 +03:00 |
|
yugoslavskiy
|
4443870577
|
Delete win_odbcconf_execution.yml
merged with rules/windows/process_creation/win_odbcconf_execution.yml
|
2019-11-08 01:36:03 +03:00 |
|
yugoslavskiy
|
3b34ed6150
|
add modifiers
|
2019-11-08 01:34:30 +03:00 |
|
yugoslavskiy
|
6083d70975
|
Update sysmon_registry_persistence_key_linking.yml
|
2019-11-07 04:23:20 +03:00 |
|
yugoslavskiy
|
82b185db6a
|
Update win_sysmon_driver_unload.yml
|
2019-11-07 04:11:26 +03:00 |
|
yugoslavskiy
|
404a6d9915
|
Update win_netsh_packet_capture.yml
|
2019-11-07 03:37:41 +03:00 |
|
yugoslavskiy
|
ddf24819ed
|
Update silenttrinity_stage_use.yml
|
2019-11-07 03:33:12 +03:00 |
|
yugoslavskiy
|
0d8c64da86
|
duplicate rule deleted
this rule already present in Sigma repo — [./rules/windows/process_creation/win_susp_comsvcs_procdump.yml](https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_susp_comsvcs_procdump.yml)
|
2019-11-07 03:21:09 +03:00 |
|
yugoslavskiy
|
5513687e63
|
Merge branch 'master' of https://github.com/Neo23x0/sigma into oscd
|
2019-11-07 03:03:35 +03:00 |
|
Florian Roth
|
c60563e546
|
rule: add modified rule date
|
2019-11-05 11:24:52 +01:00 |
|
yugoslavskiy
|
82f23c5f63
|
Merge pull request #477 from zinint/oscd
add 13 new rules:
- rules/linux/auditd/lnx_auditd_masquerading_crond.yml
- rules/linux/auditd/lnx_auditd_user_discovery.yml
- rules/linux/auditd/lnx_data_compressed.yml
- rules/linux/auditd/lnx_network_sniffing.yml
- rules/windows/powershell/powershell_data_compressed.yml
- rules/windows/powershell/powershell_winlogon_helper_dll.yml
- rules/windows/process_creation/win_change_default_file_association.yml
- rules/windows/process_creation/win_data_compressed_with_rar.yml
- rules/windows/process_creation/win_local_system_owner_account_discovery.yml
- rules/windows/process_creation/win_network_sniffing.yml
- rules/windows/process_creation/win_query_registry.yml
- rules/windows/process_creation/win_service_execution.yml
- rules/windows/process_creation/win_xsl_script_processing.yml
modify 1 rule:
- rules/windows/process_creation/win_possible_applocker_bypass.yml
|
2019-11-05 04:55:29 +03:00 |
|
yugoslavskiy
|
cc7aebe9b6
|
Update win_service_execution.yml
|
2019-11-05 04:42:53 +03:00 |
|
yugoslavskiy
|
ac95d840b4
|
Update powershell_winlogon_helper_dll.yml
|
2019-11-05 04:33:07 +03:00 |
|
yugoslavskiy
|
479aafe466
|
Update win_service_execution.yml
|
2019-11-05 04:26:19 +03:00 |
|
yugoslavskiy
|
37674b944f
|
Update win_query_registry.yml
|
2019-11-05 03:04:46 +03:00 |
|
yugoslavskiy
|
9d9de64387
|
Update win_query_registry.yml
|
2019-11-05 03:00:33 +03:00 |
|
yugoslavskiy
|
27e63abcc4
|
Update and rename win_custom_service_execution.yml to win_service_execution.yml
|
2019-11-05 02:57:15 +03:00 |
|
yugoslavskiy
|
3d5f5e2fe7
|
Update win_custom_service_execution.yml
|
2019-11-05 02:56:50 +03:00 |
|
yugoslavskiy
|
66bfbd0af9
|
Update and rename win_service_execution.yml to win_custom_service_execution.yml
|
2019-11-05 02:55:41 +03:00 |
|
yugoslavskiy
|
c147863eb3
|
Update powershell_data_compressed.yml
|
2019-11-05 02:38:36 +03:00 |
|
yugoslavskiy
|
b755d4fb68
|
Update and rename win_system_owner_user_discovery.yml to win_local_system_owner_account_discovery.yml
|
2019-11-05 02:31:20 +03:00 |
|