4275 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Florian Roth	9c8e1387a9	rule: Solarwinds SUPERNOVA web shell access	2020-12-17 09:05:08 +01:00
k-vdv	7e6f01f611	elasticsearch backend: new parameter and fields support	2020-12-14 16:07:09 +01:00
Bhabesh Rai	0a7e95954e	Fix for fail build	2020-12-14 12:55:08 +05:45
Bhabesh Rai	63fb31882e	Added rule for Impacket's PsExec execution	2020-12-14 12:48:26 +05:45
Florian Roth	80e1a5e7eb	Merge pull request #1292 from toffeebr33k/master ... Create 2 new rules on AWS Privilege Escalation and AWS Enumeration	2020-12-13 19:06:44 +01:00
Florian Roth	1b0aaf62c3	Merge pull request #1266 from omkar72/ryuk ... modifying couple of rules	2020-12-13 19:05:54 +01:00
Florian Roth	e2ade077ed	Merge pull request #1275 from bczyz1/patch-3 ... update win_apt_slingshot.yml	2020-12-13 19:04:47 +01:00
Florian Roth	d1f7a206b9	Merge pull request #1289 from weslambert/master ... Fix typo	2020-12-13 19:04:07 +01:00
Florian Roth	9f70bcab23	Merge pull request #1300 from shilch/master ... Add sigmac flag to delimit results by NUL instead of \n	2020-12-13 19:03:27 +01:00
Florian Roth	5197f21ed1	fix: duplicate ID	2020-12-13 18:59:04 +01:00
Florian Roth	c6eadea9d9	Merge pull request #1304 from hieuttmmo/master ... Detects suspicious shell spawn from MSSQL process, this might be sigh…	2020-12-11 18:40:27 +01:00
Florian Roth	612008a4d8	fix identation	2020-12-11 18:40:17 +01:00
Tran Trung Hieu	edc79a8bb6	Detects suspicious shell spawn from MSSQL process, this might be sight of RCE or SQL Injection	2020-12-11 15:17:23 +07:00
Florian Roth	cfe60d180b	Merge pull request #1301 from d4rk-d4nph3/master ... Added rule for Fortinet CVE-2018-13379 preauth file read exploitation.	2020-12-08 11:09:51 +01:00
Florian Roth	b6d62b7a21	Merge pull request #1302 from Neo23x0/rule-devel ... TA505 Dropper, minor fix in PowerShell Rule	2020-12-08 10:40:07 +01:00
Florian Roth	2c642c64d2	Removed a value	2020-12-08 10:38:32 +01:00
Florian Roth	a87a81d8cc	Update web_fortinet_cve_2018_13379_preauth_read_exploit.yml	2020-12-08 10:33:52 +01:00
Florian Roth	640470cefd	TA505 Loader Rule	2020-12-08 10:15:30 +01:00
Bhabesh Rai	3ddf940812	Added rule for Fortinet CVE-2018-13379 preauth file read exploitation.	2020-12-08 14:46:47 +05:45
Simon	97fcae56fd	Update sigmac.py	2020-12-06 20:08:00 +01:00
Florian Roth	540039cbc3	fix: Malicious Nishang PowerShell Commandlets FP with MDATP	2020-12-05 09:33:42 +01:00
Simon	4a4d3e1d35	Update sigmac.py	2020-12-04 18:22:24 +01:00
Simon Hilchenbach	a40ef7360d	Add sigmac flag to delimit results by NUL instead of \n	2020-12-04 18:05:23 +01:00
tjgeorgen	1c6c3a36fe	include updated RDP att&ck tag	2020-12-04 11:59:23 -05:00
tjgeorgen	0eda1ab462	also update tag for folder variant	2020-12-04 11:42:05 -05:00
tjgeorgen	5208bdd65a	add new version of ATT&CK T1500 tag	2020-12-04 11:19:16 -05:00
Thomas Patzke	578d2f0585	Merge pull request #1283 from 404d/mdatp-fixes ... mdatp: Mapping and generic event changes, case insensitive search	2020-11-29 21:56:17 +01:00
OG	70fb078a56	Update sysmon_office_test_regadd.yml	2020-11-29 18:02:37 +05:30
OG	8e801ede32	Update win_susp_psexec_eula.yml	2020-11-29 17:45:29 +05:30
mat	b3e36281b5	fix reference field + add test for references in plural form	2020-11-27 10:17:45 +01:00
Florian Roth	3d39d49d65	Merge pull request #1295 from findthebad/fix-winlogbeat-config ... Updated winlogbeat.yml config to include OriginalFileName	2020-11-26 23:17:45 +01:00
findthebad	ad899899ab	Updated winlogbeat.yml config to include OriginalFileName	2020-11-26 14:48:14 -05:00
Florian Roth	084cd39505	Merge pull request #1294 from Neo23x0/devel ... Trickbot rules improved	2020-11-26 10:13:35 +01:00
Florian Roth	c6fc9de144	New Trickbot wermgr rule	2020-11-26 09:54:27 +01:00
Florian Roth	c111ab3141	Improved Trickbot recon rule	2020-11-26 09:54:13 +01:00
Florian Roth	b31ed47ccf	Merge branch 'master' into devel	2020-11-26 09:44:56 +01:00
Florian Roth	13354dd7a2	Merge pull request #1293 from hegga/cb-fix-domain-fieldmapping ... Fix field mapping for DestinationHostname	2020-11-26 09:40:28 +01:00
Helge Aksdal	3a7c114ca3	Fix field mapping for DestinationHostname	2020-11-26 04:17:28 +01:00
bczyz1	05398ae95e	change field newprocessname -> image	2020-11-23 13:43:19 +01:00
toffeebr33k	c8c4183678	Update aws_enum_listing.yml	2020-11-22 01:53:58 +08:00
toffeebr33k	3d0e1988c6	Update aws_enum_listing.yml	2020-11-22 01:41:20 +08:00
toffeebr33k	273590b151	Update aws_enum_listing.yml	2020-11-22 01:17:42 +08:00
toffeebr33k	52fca0fe3a	Update aws_enum_listing.yml	2020-11-22 01:05:56 +08:00
toffeebr33k	e764ca687a	Update aws_enum_listing.yml	2020-11-22 00:50:34 +08:00
toffeebr33k	00504ee186	Update aws_update_login_profile.yml	2020-11-22 00:42:25 +08:00
toffeebr33k	3dd1525b98	Update aws_update_login_profile.yml	2020-11-22 00:38:41 +08:00
toffeebr33k	6b65180464	Add files via upload	2020-11-22 00:33:47 +08:00
toffeebr33k	cff82ff79a	Delete aws_update_login_profile.yml	2020-11-22 00:33:17 +08:00
toffeebr33k	7e1c918b4d	Delete aws_enum_listing.yml	2020-11-22 00:32:59 +08:00
toffeebr33k	551764b630	Add files via upload	2020-11-22 00:26:17 +08:00