Remco Verhoef
40539a0c0e
fix incorrect use of action global
2020-05-06 22:53:02 +02:00
Florian Roth
4f469c0e39
Adjusted level
2020-04-14 13:37:10 +02:00
teddy-ROxPin
1501331f77
Create powershell_create_local_user.yml
...
Adds coverage for creating a local account via PowerShell from https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1136/T1136.md#atomic-test-4---create-a-new-user-in-powershell
2020-04-11 02:51:05 -06:00
Florian Roth
0ea2db8b9e
Merge pull request #484 from hieuttmmo/master
...
New sigma rules to detect new MITRE technique in last update (T1502)
2020-04-03 09:59:36 +02:00
Florian Roth
f4928e95bc
Update powershell_suspicious_profile_create.yml
2020-04-03 09:36:17 +02:00
Florian Roth
c0ab9c5745
Merge pull request #671 from HarishHary/powershell_downgrade_attack
...
Powershell downgrade attack (small improvements)
2020-04-03 09:31:33 +02:00
Florian Roth
6cf0edc076
Merge pull request #685 from teddy-ROxPin/patch-1
...
Typo fix for powershell_suspicious_invocation_generic.yml
2020-04-03 09:30:32 +02:00
Remco Hofman
b791d599ee
Disabled keywords that could cause FPs
2020-03-30 08:53:52 +02:00
teddy-ROxPin
1a3731f7ae
Typo fix for powershell_suspicious_invocation_generic.yml
...
' - windowstyle hidden ' changed to ' -windowstyle hidden '
2020-03-29 04:16:15 -06:00
Remco Hofman
f52ed4150d
WMImplant parameter detection
2020-03-27 15:08:35 +01:00
Florian Roth
35e43db7a7
fix: converted CRLF line break to LF
2020-03-25 14:36:34 +01:00
Harish SEGAR
67694e4ba7
Restructure new improvement to process_creation folder.
2020-03-20 23:29:32 +01:00
Harish SEGAR
b9a916ceb4
Removed useless condition.
2020-03-20 22:50:26 +01:00
Harish SEGAR
30fac9545a
Fixed author field.
2020-03-20 22:49:07 +01:00
Harish SEGAR
1f251cec07
Added missing action field
2020-03-20 22:46:19 +01:00
Harish SEGAR
293018a9e7
Added conditions...
2020-03-20 22:33:14 +01:00
Harish SEGAR
74b81120e4
Usage of value modifiers...
2020-03-20 22:03:48 +01:00
Harish SEGAR
b129f09fee
Improvement detection on downgrade of powershell
2020-03-20 21:48:19 +01:00
Florian Roth
dd1a0e764c
docs: more false positive conditions
2020-02-25 11:13:58 +01:00
Florian Roth
5d96f81a84
fix: lowered level due to false positives
2020-02-25 11:12:11 +01:00
Thomas Patzke
48d95f027c
Merge branch 'oscd'
2020-02-20 23:11:57 +01:00
Thomas Patzke
373424f145
Rule fixes
...
Made tests pass the new CI tests. Added further allowed lower case words
in rule test.
2020-02-20 23:00:16 +01:00
Florian Roth
a4c210ed16
rule: remove keywords in powershell rule prone to FPs
2020-02-11 16:26:17 +01:00
Thomas Patzke
d7bd90cb24
Merge branch 'master' into oscd
2020-02-03 23:13:16 +01:00
Thomas Patzke
815c562a17
Merge branch 'master' into oscd
2020-02-02 13:40:08 +01:00
Thomas Patzke
f59b36d891
Fixed rule
2020-02-02 12:54:56 +01:00
Thomas Patzke
593abb1cce
OSCD QA wave 3
2020-02-02 12:41:12 +01:00
Florian Roth
7a222920df
added 'date'
2020-01-31 15:27:30 +01:00
Florian Roth
913c839780
added 'id'
2020-01-31 15:26:43 +01:00
Florian Roth
848e0c90e4
Merge branch 'master' into master
2020-01-31 14:45:29 +01:00
Florian Roth
d42e87edd7
fix: fixed casing and long rule titles
2020-01-30 17:26:09 +01:00
Florian Roth
e79e99c4aa
fix: fixed missing date fields in remaining files
2020-01-30 16:07:37 +01:00
Thomas Patzke
9bb50f3d60
OSCD QA wave 2
...
* Improved rules
* Added filtering
* Adjusted severity
2020-01-17 15:46:28 +01:00
Thomas Patzke
ae6fcefbcd
Removed ATT&CK technique ids from titles and added tags
2020-01-11 00:33:50 +01:00
Thomas Patzke
8d6a507ec4
OSCD QA wave 1
...
* Checked all rules against Mordor and EVTX samples datasets
* Added field names
* Some severity adjustments
* Fixes
2020-01-11 00:11:27 +01:00
Alessio Dalla Piazza
f45587074b
Add the ability to detect PowerUp - Invoke-AllChecks
...
PowerUp allow attackers to check if is possible to have a local privilege escalation attacks against Windows systems. The main function is called "Invoke-AllChecks" and check possible path of escalation.
2019-12-23 11:50:57 +01:00
Thomas Patzke
924e1feb54
UUIDs + moved unsupported logic
...
* Added UUIDs to all contributed rules
* Moved unsupported logic directory out of rules/ because this breaks CI
testing.
2019-12-19 23:56:36 +01:00
Thomas Patzke
694d666539
Merge branch 'master' into oscd
2019-12-19 23:15:15 +01:00
Rob Rankin
e251568760
Data Compressed duplciate titles
2019-12-09 16:24:10 +00:00
yugoslavskiy
d5722979ea
add rules by Daniel Bohannon
2019-11-27 00:02:45 +01:00
yugoslavskiy
efc404fbae
resolve conflicts with rule IDs; restored and deprecated sysmon_mimikatz_detection_lsass.yml
2019-11-19 02:11:19 +01:00
yugoslavskiy
cd69111522
Merge branch 'oscd' into master
2019-11-14 00:36:34 +03:00
yugoslavskiy
c8ee6e9631
Merge pull request #504 from yugoslavskiy/oscd_ilyas_ochkov
...
[OSCD] Ilyas Ochkov contribution
2019-11-14 00:22:48 +03:00
Thomas Patzke
0592cbb67a
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
Thomas Patzke
5f6a4225ec
Unified line terminators of rules to Unix
2019-11-12 23:05:36 +01:00
Florian Roth
b7c3f8da91
refactor: cleanup, single element lists, renamed files, level adjustments
2019-11-12 12:55:05 +01:00
yugoslavskiy
0db5436778
add tieto dns exfil rules
2019-11-10 20:27:21 +03:00
yugoslavskiy
bdac415fea
Merge pull request #486 from yugoslavskiy/tieto_oscd
...
[OSCD] Tieto DNS exfiltration rules
2019-11-10 19:36:02 +03:00
yugoslavskiy
4fa928866f
oscd task #6 done.
...
add 25 new rules:
- win_ad_replication_non_machine_account.yml
- win_dpapi_domain_backupkey_extraction.yml
- win_protected_storage_service_access.yml
- win_dpapi_domain_masterkey_backup_attempt.yml
- win_sam_registry_hive_handle_request.yml
- win_sam_registry_hive_dump_via_reg_utility.yml
- win_lsass_access_non_system_account.yml
- win_ad_object_writedac_access.yml
- powershell_alternate_powershell_hosts.yml
- sysmon_remote_powershell_session_network.yml
- win_remote_powershell_session.yml
- win_scm_database_handle_failure.yml
- win_scm_database_privileged_operation.yml
- sysmon_wmi_module_load.yml
- sysmon_remote_powershell_session_process.yml
- sysmon_rdp_registry_modification.yml
- sysmon_powershell_execution_pipe.yml
- sysmon_alternate_powershell_hosts_pipe.yml
- sysmon_powershell_execution_moduleload.yml
- sysmon_createremotethread_loadlibrary.yml
- sysmon_alternate_powershell_hosts_moduleload.yml
- powershell_remote_powershell_session.yml
- win_non_interactive_powershell.yml
- win_syskey_registry_access.yml
- win_wmiprvse_spawning_process.yml
improve 1 rule:
- rules/windows/builtin/win_account_backdoor_dcsync_rights.yml
2019-11-10 18:43:41 +03:00
yugoslavskiy
127335a0ec
Merge pull request #482 from yugoslavskiy/master
...
[OSCD][The ThreatHunter-Playbook] Task 6: DONE
2019-11-10 17:27:54 +03:00
