Florian Roth
|
cc8899ea62
|
Merge pull request #1717 from frack113/netcat
[OSCD] sysmon_netcat_execution.yml T1095
|
2021-07-23 09:51:23 +02:00 |
|
Florian Roth
|
d00ca03cb6
|
increased level to high
|
2021-07-23 09:51:00 +02:00 |
|
Florian Roth
|
cbc7a746d4
|
feat: some often used ncat command line strings
|
2021-07-22 15:00:50 +02:00 |
|
frack113
|
1b537cac5d
|
add sysmon_netcat_execution.yml
|
2021-07-21 10:55:54 +02:00 |
|
frack113
|
cf8904b560
|
fix files_with_incorrect_mitre_tags
|
2021-07-20 12:22:31 +02:00 |
|
frack113
|
da6135ccb3
|
add process_creation_discover_private_keys.yml
|
2021-07-20 11:20:30 +02:00 |
|
Florian Roth
|
6fbce11094
|
Merge pull request #1712 from SigmaHQ/rule-devel
fix: bug in regsvr anomaly rule
|
2021-07-18 13:00:19 +02:00 |
|
Florian Roth
|
b7b4c4555f
|
fix: bug in regsvr anomaly rule
|
2021-07-18 12:59:31 +02:00 |
|
Florian Roth
|
7eb873e48b
|
Merge pull request #1710 from SigmaHQ/rule-devel
added more legitimate extensions to regsvr32 rule
|
2021-07-17 13:46:21 +02:00 |
|
Florian Roth
|
53c25969ab
|
added more legitimate extensions to regsvr32 rule
|
2021-07-17 11:20:05 +02:00 |
|
Florian Roth
|
715bca0fd2
|
Merge pull request #1704 from frack113/redcanary_t1216
Redcanary t1216
|
2021-07-17 09:48:43 +02:00 |
|
Florian Roth
|
b1a00152bc
|
Merge pull request #1698 from SigmaHQ/rule-devel
several new rules and fixes
|
2021-07-17 09:39:47 +02:00 |
|
Florian Roth
|
b911175f28
|
Suspicious mshta patterns
|
2021-07-17 09:04:41 +02:00 |
|
Florian Roth
|
6c79115ce0
|
Regsvr32 Anomalies extended
|
2021-07-17 09:04:31 +02:00 |
|
frack113
|
9a7f3036e4
|
update ref in win_manage-bde_lolbas.yml
|
2021-07-16 08:34:30 +02:00 |
|
frack113
|
d6dc217c6d
|
Add process_creation_syncappvpublishingserver_vbs_execute_powershell.yml
|
2021-07-16 08:28:25 +02:00 |
|
Florian Roth
|
021f211c14
|
fix: FP with WCE and Windows Cluster Service
|
2021-07-15 12:09:28 +02:00 |
|
frack113
|
c6cb7f1247
|
fix missing references and duplicate UUID
|
2021-07-15 11:06:54 +02:00 |
|
Florian Roth
|
e40b859254
|
Merge pull request #1695 from frack113/fix_re
escape / in regex
|
2021-07-15 09:25:58 +02:00 |
|
Florian Roth
|
f3d24e27c2
|
Merge pull request #1694 from leegengyu/patch-13
Update win_remote_powershell_session_process.yml
|
2021-07-15 08:36:12 +02:00 |
|
Florian Roth
|
2055da991f
|
Merge pull request #1691 from SigmaHQ/rule-devel
Rules: scripts from Temp folders, reg disable sec services
|
2021-07-15 08:35:54 +02:00 |
|
frack113
|
0ef3dc2082
|
escape / in regex
|
2021-07-15 08:13:49 +02:00 |
|
G Y
|
8bbea58786
|
Update win_remote_powershell_session_process.yml
Updated TTP and formatting.
|
2021-07-15 11:20:25 +08:00 |
|
Florian Roth
|
e516aecc74
|
fix: error in selector
|
2021-07-14 15:58:55 +02:00 |
|
Florian Roth
|
530e04faec
|
rule: Script Execution from Temp Folder
|
2021-07-14 15:52:52 +02:00 |
|
Florian Roth
|
0d794357e8
|
rule: reg disable security services
|
2021-07-14 15:52:35 +02:00 |
|
Florian Roth
|
3ff4e99d44
|
Merge pull request #1688 from SigmaHQ/rule-devel
refactor: improved Raccine uninstall rule
|
2021-07-14 09:57:08 +02:00 |
|
Florian Roth
|
04370c7e91
|
refactor: improved Raccine uninstall rule
|
2021-07-14 09:56:35 +02:00 |
|
Florian Roth
|
1ec9473472
|
Merge pull request #1687 from SigmaHQ/rule-devel
Rule adjustments and new Serv-U exploitation rules
|
2021-07-14 08:59:33 +02:00 |
|
Florian Roth
|
e0f166aba2
|
rule: Serv-U exploitation
https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
|
2021-07-14 08:35:25 +02:00 |
|
Florian Roth
|
85d47aeabc
|
Merge pull request #1678 from frack113/redcanary_t1228
Some Redcanary T1228
|
2021-07-14 08:18:52 +02:00 |
|
frack113
|
6d1e8268ba
|
update win_workflow_compiler.yml
|
2021-07-13 13:55:27 +02:00 |
|
frack113
|
6b9466ec20
|
Add process_creation_protocolhandler_suspicious_file.yml
|
2021-07-13 12:19:07 +02:00 |
|
frack113
|
33832acf5b
|
fix Error: [colons] too many spaces before colon
|
2021-07-13 10:09:52 +02:00 |
|
frack113
|
c2d9b05191
|
Add process_creation_infdefaultinstall.yml
|
2021-07-13 09:56:34 +02:00 |
|
frack113
|
fd377fe163
|
update process_creation_syncappvpublishingserver_execute_arbitrary_powershell
|
2021-07-13 09:45:46 +02:00 |
|
frack113
|
82f666c5da
|
add process_creation_syncappvpublishingserver_execute_arbitrary_powershell.yml
|
2021-07-12 16:17:40 +02:00 |
|
frack113
|
d6a86a3fa0
|
add T1218 sysmon_creation_mavinject_dll.yml
|
2021-07-12 16:08:18 +02:00 |
|
Florian Roth
|
382d5b2adb
|
Merge pull request #1674 from frack113/fix_small_errors
Fix some typo error
|
2021-07-12 15:23:55 +02:00 |
|
Florian Roth
|
682e0458a3
|
Merge pull request #1675 from frack113/redcanary_attack.t1562.001
Atomic Red team T1562.001
|
2021-07-12 15:23:35 +02:00 |
|
frack113
|
a96678d725
|
test 21 to 24 from https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md
|
2021-07-12 10:54:44 +02:00 |
|
Florian Roth
|
7f071d7851
|
Merge pull request #1554 from mlp1515/master
Update win_multiple_suspicious_cli.yml
|
2021-07-12 10:43:26 +02:00 |
|
Thomas Patzke
|
0b83c12dd1
|
Merge branch 'devel-tp'
|
2021-07-12 10:21:19 +02:00 |
|
frack113
|
af140ebf84
|
fix some typo error
|
2021-07-12 09:40:18 +02:00 |
|
Thomas Patzke
|
176514bd7a
|
New rule: suspicious spoolsv child process
|
2021-07-12 08:48:59 +02:00 |
|
Florian Roth
|
58a634b0b6
|
Merge branch 'master' into master
|
2021-07-11 00:32:55 +02:00 |
|
frack113
|
17edaa0950
|
combines 2 rules
|
2021-07-09 16:41:03 +02:00 |
|
frack113
|
a53e21eb77
|
2 more rule with custom field
|
2021-07-09 10:07:41 +02:00 |
|
frack113
|
06a05cfad9
|
Move to rules-unsupported as use special enrichment field
|
2021-07-09 07:40:57 +02:00 |
|
Florian Roth
|
0518439de7
|
Merge pull request #1648 from frack113/fix_windows_fields
Fix more windows fields name
|
2021-07-08 14:53:14 +02:00 |
|