Florian Roth
43033ab874
Update win_susp_emotet_rudll32_execution.yml
2020-12-25 09:05:55 +01:00
Tran Trung Hieu
d551b88d5c
Edit title convention
2020-12-25 14:21:26 +07:00
Tran Trung Hieu
4297e68704
Detect Emotet DLL loading by looking rundll32.exe
2020-12-25 14:09:40 +07:00
Daniel Masse
fedda17231
Update the azure image_load rule to be a generic sysmon rule
2020-12-23 16:29:49 -05:00
Daniel Masse
bf539fd1fe
Revert "Fix bug changing the logsource service to category"
...
This reverts commit 0f51e53d0e
2020-12-23 15:50:49 -05:00
Daniel Masse
71ea5c7437
Add missing product in logsource
2020-12-23 15:45:00 -05:00
Daniel Masse
0f51e53d0e
Fix bug changing the logsource service to category
2020-12-23 15:12:31 -05:00
Daniel Masse
e4c052154d
Remove unneeded file
2020-12-23 14:30:24 -05:00
Daniel Masse
d2edf715f2
Split up cmstp rule into 3 separate rules and remove duplicates
2020-12-23 12:17:39 -05:00
Florian Roth
dedc34e91a
fix: typos and description
2020-12-23 14:46:08 +01:00
Florian Roth
cdc29dfbe8
rule: Lazarus activity
2020-12-23 14:43:32 +01:00
Florian Roth
821af35557
Merge pull request #1313 from Neo23x0/rule-devel
...
Rule devel
2020-12-23 13:57:11 +01:00
Florian Roth
7286d01f78
fix: typo in rule
2020-12-23 13:26:44 +01:00
Florian Roth
80aa398392
rule: Lazarus group loaders
2020-12-23 13:25:16 +01:00
Florian Roth
e67d17a967
rule: improved solarwinds webshell rule
2020-12-22 10:36:34 +01:00
Florian Roth
f20f346a6a
Merge pull request #1264 from omkar72/sdev-1
...
Adding 2 rules - Conhost & office test registry persistence
2020-12-21 18:28:59 +01:00
Florian Roth
e78d7e6aee
Merge pull request #1296 from mat-gas/fix-references
...
fix "references" field + add test for references in plural form
2020-12-21 18:25:35 +01:00
Florian Roth
377454cb31
Merge pull request #1299 from tjgeorgen/patch-1
...
ATT&CK subtechnique tag updates
2020-12-21 18:24:00 +01:00
Florian Roth
35ab80b39e
Merge pull request #1306 from d4rk-d4nph3/master
...
Added rule for Impacket's PsExec execution
2020-12-21 18:23:41 +01:00
Florian Roth
9c8e1387a9
rule: Solarwinds SUPERNOVA web shell access
2020-12-17 09:05:08 +01:00
Bhabesh Rai
0a7e95954e
Fix for fail build
2020-12-14 12:55:08 +05:45
Bhabesh Rai
63fb31882e
Added rule for Impacket's PsExec execution
2020-12-14 12:48:26 +05:45
Florian Roth
80e1a5e7eb
Merge pull request #1292 from toffeebr33k/master
...
Create 2 new rules on AWS Privilege Escalation and AWS Enumeration
2020-12-13 19:06:44 +01:00
Florian Roth
1b0aaf62c3
Merge pull request #1266 from omkar72/ryuk
...
modifying couple of rules
2020-12-13 19:05:54 +01:00
Florian Roth
e2ade077ed
Merge pull request #1275 from bczyz1/patch-3
...
update win_apt_slingshot.yml
2020-12-13 19:04:47 +01:00
Florian Roth
5197f21ed1
fix: duplicate ID
2020-12-13 18:59:04 +01:00
Florian Roth
612008a4d8
fix identation
2020-12-11 18:40:17 +01:00
Tran Trung Hieu
edc79a8bb6
Detects suspicious shell spawn from MSSQL process, this might be sight of RCE or SQL Injection
2020-12-11 15:17:23 +07:00
Florian Roth
cfe60d180b
Merge pull request #1301 from d4rk-d4nph3/master
...
Added rule for Fortinet CVE-2018-13379 preauth file read exploitation.
2020-12-08 11:09:51 +01:00
Florian Roth
b6d62b7a21
Merge pull request #1302 from Neo23x0/rule-devel
...
TA505 Dropper, minor fix in PowerShell Rule
2020-12-08 10:40:07 +01:00
Florian Roth
2c642c64d2
Removed a value
2020-12-08 10:38:32 +01:00
Florian Roth
a87a81d8cc
Update web_fortinet_cve_2018_13379_preauth_read_exploit.yml
2020-12-08 10:33:52 +01:00
Florian Roth
640470cefd
TA505 Loader Rule
2020-12-08 10:15:30 +01:00
Bhabesh Rai
3ddf940812
Added rule for Fortinet CVE-2018-13379 preauth file read exploitation.
2020-12-08 14:46:47 +05:45
Florian Roth
540039cbc3
fix: Malicious Nishang PowerShell Commandlets FP with MDATP
2020-12-05 09:33:42 +01:00
tjgeorgen
1c6c3a36fe
include updated RDP att&ck tag
2020-12-04 11:59:23 -05:00
tjgeorgen
0eda1ab462
also update tag for folder variant
2020-12-04 11:42:05 -05:00
tjgeorgen
5208bdd65a
add new version of ATT&CK T1500 tag
2020-12-04 11:19:16 -05:00
OG
70fb078a56
Update sysmon_office_test_regadd.yml
2020-11-29 18:02:37 +05:30
OG
8e801ede32
Update win_susp_psexec_eula.yml
2020-11-29 17:45:29 +05:30
mat
b3e36281b5
fix reference field + add test for references in plural form
2020-11-27 10:17:45 +01:00
Florian Roth
c6fc9de144
New Trickbot wermgr rule
2020-11-26 09:54:27 +01:00
Florian Roth
c111ab3141
Improved Trickbot recon rule
2020-11-26 09:54:13 +01:00
Florian Roth
b31ed47ccf
Merge branch 'master' into devel
2020-11-26 09:44:56 +01:00
bczyz1
05398ae95e
change field newprocessname -> image
2020-11-23 13:43:19 +01:00
toffeebr33k
c8c4183678
Update aws_enum_listing.yml
2020-11-22 01:53:58 +08:00
toffeebr33k
3d0e1988c6
Update aws_enum_listing.yml
2020-11-22 01:41:20 +08:00
toffeebr33k
273590b151
Update aws_enum_listing.yml
2020-11-22 01:17:42 +08:00
toffeebr33k
52fca0fe3a
Update aws_enum_listing.yml
2020-11-22 01:05:56 +08:00
toffeebr33k
e764ca687a
Update aws_enum_listing.yml
2020-11-22 00:50:34 +08:00
toffeebr33k
00504ee186
Update aws_update_login_profile.yml
2020-11-22 00:42:25 +08:00
toffeebr33k
3dd1525b98
Update aws_update_login_profile.yml
2020-11-22 00:38:41 +08:00
toffeebr33k
6b65180464
Add files via upload
2020-11-22 00:33:47 +08:00
toffeebr33k
cff82ff79a
Delete aws_update_login_profile.yml
2020-11-22 00:33:17 +08:00
toffeebr33k
7e1c918b4d
Delete aws_enum_listing.yml
2020-11-22 00:32:59 +08:00
toffeebr33k
551764b630
Add files via upload
2020-11-22 00:26:17 +08:00
toffeebr33k
3dd25ddea4
Delete aws_update_login_profile.yml
2020-11-22 00:25:54 +08:00
toffeebr33k
fba9c12bb2
Delete aws_enum_listing.yml
2020-11-22 00:25:29 +08:00
toffeebr33k
6c1f3f5969
Update aws_update_login_profile.yml
2020-11-21 23:45:10 +08:00
toffeebr33k
70e725e82e
Update aws_enum_listing.yml
2020-11-21 23:44:14 +08:00
toffeebr33k
596d1b6e4c
Update aws_update_login_profile.yml
2020-11-21 23:29:49 +08:00
toffeebr33k
a786ebd04b
Update aws_enum_listing.yml
2020-11-21 23:28:57 +08:00
toffeebr33k
1ca903b168
Update aws_enum_listing.yml
2020-11-21 23:22:07 +08:00
toffeebr33k
7f61591865
Add files via upload
2020-11-21 23:12:50 +08:00
bczyz1
193021eff8
Update win_apt_slingshot.yml
...
fix condition
2020-11-20 09:19:03 +01:00
Florian Roth
af4d546408
Merge pull request #1282 from Neo23x0/rule-devel
...
fix: FPs with notepad++ GUP rule
2020-11-10 13:39:28 +01:00
Florian Roth
2e9d7951a6
Merge pull request #1272 from bczyz1/patch-2
...
Fix typo in win_apt_lazarus_session_hijack.yml
2020-11-10 13:35:08 +01:00
Florian Roth
f6c0fb2d33
fix: FPs with notepad++ GUP rule
2020-11-09 16:34:12 +01:00
Florian Roth
c3785d6dc7
rule: FPs with WmiPrvSE rule
2020-11-05 16:44:33 +01:00
bczyz1
c554aaea8f
update win_apt_slingshot.yml
...
- optimized rule
- added detection of task modification (flag /change + /disable as described here https://stackoverflow.com/questions/26169582/does-anyone-know-of-a-way-to-turn-off-windows-defragmenters-default-schedule-us )
2020-11-05 15:51:22 +01:00
Florian Roth
908023fa66
rule: added second expression
2020-11-04 16:43:35 +01:00
bczyz1
4a5b2d642e
Fix typo in win_apt_lazarus_session_hijack.yml
2020-11-03 14:46:29 +01:00
Florian Roth
f848bb912c
rule: reworked weblogic CVE-2020-14882 rule
2020-11-03 10:39:40 +01:00
Florian Roth
dd0d1d053c
rule: WebLogic exploit CVE-2020-14882
2020-11-02 11:11:37 +01:00
omkargudhate22
f1bb9726ca
updated mitre tag
2020-10-30 13:35:40 +05:30
omkar72
86a849728d
ryuk changes
2020-10-30 13:15:11 +05:30
omkargudhate22
df07d53fea
formatting values
2020-10-25 18:23:29 +05:30
omkargudhate22
06890ba28b
update title
2020-10-25 15:10:12 +05:30
omkar72
021842eaa3
office test reg
2020-10-25 12:36:08 +05:30
omkar72
42de51cadc
conhost executions
2020-10-25 12:33:59 +05:30
Florian Roth
75637324e0
feat: cover newest emotet campaigns
2020-10-23 23:44:48 +02:00
Florian Roth
ee789a309c
fix: FP with expression
2020-10-20 13:11:10 +02:00
Florian Roth
198b292c26
rule: emotet encoded commands
2020-10-20 12:51:58 +02:00
Florian Roth
48f1be04d4
fix: ping hex ip rule
2020-10-16 10:06:24 +02:00
Jonhnathan
8f6ad7df6b
Update win_etw_trace_evasion.yml
2020-10-15 09:22:13 -03:00
Jonhnathan
043033c1b7
Update win_etw_trace_evasion.yml
2020-10-13 22:59:06 -03:00
Jonhnathan
ac1a6927ad
Update win_etw_trace_evasion.yml
2020-10-13 22:55:13 -03:00
Jonhnathan
e3446b873a
Correct duplicated selection
2020-10-13 22:54:30 -03:00
Jonhnathan
b1c9871b74
Add Additional detections for other techniques
2020-10-13 22:51:48 -03:00
Jonhnathan
a01c08f617
Removed reference to deprecated rule and improve logic
2020-10-13 17:45:35 -03:00
Jonhnathan
4c75d22d93
Revert "Create win_susp_replace_lolbin.yml"
...
This reverts commit e6a6549676
2020-10-13 17:40:10 -03:00
Jonhnathan
1455d414bc
Revert "Changed the rule to download only and not the copy"
...
This reverts commit 1324bc1ad1
2020-10-13 17:40:07 -03:00
Florian Roth
3affdd12e0
fix: rule title casing
2020-10-12 09:51:35 +02:00
Florian Roth
0d0cda0f86
docs: improved false positive notes
2020-10-12 09:18:42 +02:00
Florian Roth
e7c6794ecd
rule: suspicious wmic process call create + rundll32
2020-10-12 09:18:30 +02:00
Florian Roth
2e732eb01f
Merge branch 'master' into rule-devel
2020-10-12 09:13:24 +02:00
Vasiliy Burov
e10771652b
Update win_disable_event_logging.yml
2020-10-09 18:27:04 +03:00
Vasiliy Burov
c77a190a6b
Update win_susp_eventlog_cleared.yml
...
Added events about security log clearance. Also, I think that the rule "sigma/rules/windows/builtin/win_susp_security_eventlog_cleared.yml" can be deleted.
2020-10-09 16:51:18 +03:00
Jonhnathan
1324bc1ad1
Changed the rule to download only and not the copy
2020-10-07 16:18:21 -03:00
Jonhnathan
e6a6549676
Create win_susp_replace_lolbin.yml
...
Item 77 of #1014
2020-10-07 10:37:15 -03:00
Florian Roth
c56cd2dfff
Merge pull request #1024 from omkar72/master
...
Com hijack shell folder
2020-10-02 09:24:16 +02:00
omkargudhate22
4487d9cc7e
added event type & changed technique
2020-10-02 09:22:14 +05:30
Florian Roth
d3ee1aba66
docs: MITRE ATT&CK(R) trademark references removed or adjusted
...
https://github.com/Neo23x0/sigma/issues/1028
2020-09-30 08:53:52 +02:00
Florian Roth
c17ca6d5fe
Merge pull request #1018 from savvyspoon/wcry-dns
...
WannaCry Killswitch domain DNS query
2020-09-29 09:27:21 +02:00
omkargudhate22
68a992d903
updated name
2020-09-27 21:57:19 +05:30
omkargudhate22
e7c8197e34
Updated fields & renamed
2020-09-27 21:52:59 +05:30
omkargudhate22
ebe3dce1d7
Update sysmon_comhijack_uac_bypass.yml
2020-09-27 21:44:41 +05:30
omkar72
3f148e6c7c
COM hijack of shell folder to execute arbitrary application & UAC bypass using sdclt.
2020-09-27 21:19:04 +05:30
Florian Roth
d7d9c0e772
Merge pull request #1021 from hieuttmmo/master
...
Sigma rule to detect AdFind.exe execution
2020-09-27 09:50:41 +02:00
Florian Roth
8020fe3c40
false positive condition
2020-09-26 17:03:29 +02:00
Florian Roth
60795f7050
Update win_susp_adfind.yml
...
Fear that a simple adfind.exe causes too many false positives
2020-09-26 17:02:39 +02:00
Florian Roth
dbdd758365
Duplicate Rule
...
we already have a rule for that
2020-09-26 17:01:32 +02:00
Tran Trung Hieu
d4dd0600ad
Fix logsource service to process_creation
2020-09-26 21:45:23 +07:00
Tran Trung Hieu
c756fc8576
Detect Suspicious AdFind Execution
2020-09-26 21:34:06 +07:00
Mike Wade
f76f80db80
Killswitch domain
2020-09-16 20:32:31 -06:00
Mike Wade
7b1ef9ea64
fixing test runner issues
2020-09-15 15:45:33 -06:00
Mike Wade
6ed36b0e41
fixed issues with tabs and duplicate tags
2020-09-15 08:52:00 -06:00
Florian Roth
2cd9b794e6
Merge pull request #1007 from d4rk-d4nph3/master
...
Windows Defender AMSI Trigger Detected
2020-09-15 15:45:00 +02:00
Remco Hofman
6cadfa5b2b
Added win_vul_cve_2020_1472 rule
2020-09-15 15:13:53 +02:00
Mike Wade
1ddba05eb2
Second round
2020-09-15 07:02:30 -06:00
Mike Wade
da9b32bdd6
we
2020-09-15 06:24:44 -06:00
Mike Wade
8ce73bd8df
Fixed issues with tags and missing files
2020-09-15 06:10:57 -06:00
Thomas Patzke
378d9c94cf
Merge branch 'master' of https://github.com/socprime/sigma into pr-981
2020-09-15 12:14:49 +02:00
Florian Roth
50db6dcc69
Merge pull request #1002 from scottdermott/master
...
+ Adding exclusion for Azure AD Sync (MSOL_xxxxxxxx)
2020-09-15 08:17:02 +02:00
Bhabesh Rai
03c7d751c0
Windows Defender AMSI Trigger Detected
2020-09-14 18:10:38 +05:45
Mike Wade
57cae0ded1
Fixed reference typo
2020-09-13 22:07:43 -06:00
Mike Wade
52ab677798
Fixed my git issue
2020-09-13 22:03:04 -06:00
Mike Wade
249c255435
No Idea why these files are deleted
2020-09-13 22:00:30 -06:00
Yugoslavskiy Daniil
1fc202fe5d
fix typos, update tags
2020-09-13 15:46:45 +02:00
Dermott, Scott J
c72ac8f73e
Merge branch 'master' of https://github.com/scottdermott/sigma
2020-09-11 16:19:54 +01:00
Scott Dermott
1f50e0af35
+ Adding exclusion for Azure AD Sync (MSOL_xxxxxxxx)
...
AD Connect on premise AD accounts to Azure AD. The replication process is completed under the context of the 'MSOL_xxxxxxxx' user account. The AD Connect application is installed on a member server (i.e. not on a DC).
https://techcommunity.microsoft.com/t5/azure-advanced-threat-protection/ad-connect-msol-user-suspected-dcsync-attack/m-p/788028
2020-09-11 16:06:51 +01:00
Tran Trung Hieu
49ba107dce
Fixed Title
2020-09-10 17:36:37 +07:00
Tran Trung Hieu
f7d5240d40
Added UID, fixed rule description
2020-09-10 17:20:16 +07:00
Tran Trung Hieu
1b6c6ec5bf
Detects a suspicious activities of MpCmdRun.exe, which could be an action for downloading a file from the internet using Windows Defender
2020-09-10 17:16:06 +07:00
Florian Roth
7d6043bd0d
rule: reworked suspicious user agents
2020-09-10 10:33:11 +02:00
Bhabesh Rai
ed059a9831
Added Credential Dumping by LaZagne
2020-09-09 18:27:14 +05:45
Florian Roth
de5444a81e
Merge pull request #989 from oscd-initiative/master
...
[OSCD Initiative][ATT&CK tags update]
2020-09-08 13:27:58 +02:00
Florian Roth
af3b93a522
Merge pull request #914 from omergunal/ogunal-2
...
New rules for Linux
2020-09-07 09:41:43 +02:00
Florian Roth
39dfcd40ec
Merge pull request #921 from d4rk-d4nph3/master
...
Added support for Defender's PSExec and WMI ASR rules.
2020-09-07 09:40:46 +02:00
Florian Roth
6f96bbbe65
Merge pull request #977 from barvhaim/patch-1
...
Update win_new_service_creation.yml typo
2020-09-07 09:39:28 +02:00
Florian Roth
37751fc3a1
Merge pull request #978 from barvhaim/patch-2
...
Update sysmon_apt_muddywater_dnstunnel.yml typo
2020-09-07 09:39:11 +02:00
e6e6e
98c412044a
att&ck tags review: windows/process_creation part 5
...
added missing ATT&CK v6.3 IDs with comments and removed unnecessary "modified" attributes
2020-09-07 02:00:41 +04:00
e6e6e
7ae76b8d99
Revert "att&ck tags review: windows/process_creation part 5"
...
This reverts commit e94c47e74e
2020-09-07 01:28:08 +04:00
e6e6e
e94c47e74e
att&ck tags review: windows/process_creation part 5
...
added missing ATT&CK v6.3 IDs with comments and removed unnecessary "modified" attributes
2020-09-07 01:19:41 +04:00
Alexey Lednyov
7834fdd750
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
ecco
ebc1d38027
fix in memory powershell false positive
2020-09-06 09:25:56 -04:00
ecco
b9f7d58dbc
fix ADSI rule false positive
2020-09-06 09:17:53 -04:00
grikos
961e4eef4c
att&ck tags review: windows/process_creation part 6
2020-09-05 20:35:21 +03:00
Florian Roth
e1529b445e
docs: added MITRE ATT&CK tags
2020-09-05 09:17:23 +02:00
Florian Roth
12a6ad224c
Merge branch 'master' into rule-devel
2020-09-05 09:13:34 +02:00
