Florian Roth
49877a6ed0
Moved and renamed rule
2018-04-18 16:53:11 +02:00
Florian Roth
3c1c9d2b31
Merge pull request #81 from yt0ng/sigma-yt0ng
...
added SquiblyTwo Detection
2018-04-18 16:39:37 +02:00
Florian Roth
8420d3174a
Reordered
2018-04-18 16:34:16 +02:00
yt0ng
c637c2e590
Adding Detections for renamed wmic and format
...
https://subt0x11.blogspot.ch/2018/04/wmicexe-whitelisting-bypass-hacking.html
https://twitter.com/mattifestation/status/986280382042595328
2018-04-18 15:02:52 +02:00
Florian Roth
9b8df865b1
Extended rule
2018-04-18 12:13:45 +02:00
yt0ng
a4fb39a336
also for http
2018-04-18 08:19:47 +02:00
yt0ng
169a4404c2
added SquiblyTwo Detection
2018-04-17 21:33:26 +02:00
Markus Härnvi
cf237cf658
"author" should be a string and not a list, according to the specification
2018-04-16 23:42:51 +02:00
Florian Roth
d8bbf26f2c
Added msiexec to rule in order to cover new threats
...
https://twitter.com/DissectMalware/status/984252467474026497
2018-04-12 09:12:50 +02:00
Florian Roth
58517907ad
Improved rule to provide support for for old sysmon \REGISTRY syntax
2018-04-11 20:15:17 +02:00
Florian Roth
0ffd226293
Moved new rule to sysmon folder
2018-04-11 20:11:54 +02:00
Florian Roth
52d405bb1b
Improved shell spawning rule
2018-04-11 20:09:42 +02:00
Florian Roth
b065c2c35c
Simplified rule
2018-04-11 19:03:35 +02:00
Karneades
fa6677a41d
Remove @ in author
...
Be nice to Travis: "error syntax error: found character '@' that cannot start any token"
2018-04-11 15:21:42 +02:00
Karneades
be3c27981f
Add rule for Windows registry persistence mechanisms
2018-04-11 15:13:00 +02:00
Florian Roth
a9c7fe202e
Rule: Windows shell spawning suspicious program
2018-04-09 08:37:30 +02:00
Florian Roth
e53826e167
Extended Sysmon Office Shell rule
2018-04-09 08:37:30 +02:00
Thomas Patzke
f113832c04
Merge pull request #69 from jmallette/rules
...
Create cmdkey recon rule
2018-04-08 23:23:30 +02:00
Thomas Patzke
a3e02ea70f
Various rule fixes
...
* Field name: LogonProcess -> LogonProcessName
* Field name: Message -> AuditPolicyChanges
* Field name: ProcessCommandLine -> CommandLine
* Removed Type match in Kerberos RC4 encryption rule
Problematic because text representation not unified and audit failures are possibly interesting events
* Removed field 'Severity' from rules (Redundant)
* Rule decomposition of win_susp_failed_logons_single_source) because of different field names
* Field name: SubjectAccountName -> SubjectUserName
* Field name: TargetProcess -> TargetImage
* Field name: TicketEncryption -> TicketEncryptionType
* Field name: TargetFileName -> TargetFilename
2018-03-27 14:35:49 +02:00
Thomas Patzke
b1bfa64231
Removed redundant 'EventLog' conditions
2018-03-26 00:36:40 +02:00
Thomas Patzke
f68af2a5da
Added reference to Kerberos RC4 rule
2018-03-25 23:19:01 +02:00
Thomas Patzke
dacc6ae3d3
Fieldname case: Commandline -> CommandLine
2018-03-25 23:08:28 +02:00
Florian Roth
e141a834ff
Rule: Ping hex IP address
...
https://github.com/vysec/Aggressor-VYSEC/blob/master/ping.cna
2018-03-23 17:00:00 +01:00
Florian Roth
f220e61adc
Fixed second selection in rule
2018-03-21 10:47:14 +01:00
Florian Roth
70c2f973a3
Rule: Smbexec.py Service Installation
2018-03-21 10:44:37 +01:00
Florian Roth
3c968d4ec6
Fixed rule for any ControlSets
2018-03-21 10:44:37 +01:00
Florian Roth
97204d8dc0
Renamed rule
2018-03-20 15:04:11 +01:00
Florian Roth
e9fcfcba7f
Improved NetNTLM downgrade rule
2018-03-20 15:03:55 +01:00
Florian Roth
a7eb4d3e34
Renamed rule
2018-03-20 11:12:35 +01:00
Florian Roth
b84bbd327b
Rule: NetNTLM Downgrade Attack
...
https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
2018-03-20 11:07:21 +01:00
Florian Roth
a6d293e31d
Improved tscon rule
2018-03-20 10:54:04 +01:00
Florian Roth
8fb6bc7a8a
Rule: Suspicious taskmgr as LOCAL_SYSTEM
2018-03-19 16:36:39 +01:00
Florian Roth
af8be8f064
Several rule updates
2018-03-19 16:36:15 +01:00
Florian Roth
648ac5a52e
Rules: tscon.exe anomalies
...
http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
2018-03-17 19:14:13 +01:00
Karneades
49c12f1df8
Add missing binaries
2018-03-16 10:52:43 +01:00
Florian Roth
a257b7d9d7
Rule: Stickykey improved
2018-03-16 09:10:07 +01:00
Florian Roth
8b31767d31
Rule: PsExec usage
2018-03-15 19:54:22 +01:00
Florian Roth
0460e7f18a
Rule: Suspicious process started from taskmgr
2018-03-15 19:54:03 +01:00
Florian Roth
f5494c6f5f
Rule: StickyKey-ike backdoor usage
2018-03-15 19:53:34 +01:00
Florian Roth
5ae5c9de19
Rule: Outlook spawning shells to detect Turla like C&C via Outlook
2018-03-10 09:04:11 +01:00
jmallette
aff46be8a3
Create cmdkey recon rule
2018-03-08 13:25:05 -05:00
Thomas Patzke
ada1ca94ea
JPCERT rules
...
* Addition of ntdsutil.exe rule
* Added new link to existing rules
2018-03-08 00:10:19 +01:00
Thomas Patzke
8ee24bf150
WMI persistence rules derived from blog article
...
https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/#so-to-summarize
2018-03-07 23:05:10 +01:00
Thomas Patzke
8041f77abd
Merged similar rules
2018-03-06 23:19:11 +01:00
Thomas Patzke
84645f4e59
Simplified rule conditions with new condition constructs
2018-03-06 23:14:43 +01:00
Florian Roth
1001afb038
Rule: CVE-2015-1641
2018-02-22 16:59:40 +01:00
Florian Roth
25dc3e78be
Lowered severity of rule - prone to false positives
2018-02-22 16:59:11 +01:00
Florian Roth
9020a9aa32
Fixed file names "vuln" > "exploit"
2018-02-22 13:29:19 +01:00
Florian Roth
5d763581fa
Adding status "experimental" to that rule
2018-02-22 13:28:01 +01:00
Florian Roth
0be687d245
Rule: Detect CVE-2017-0261 exploitation
2018-02-22 13:27:20 +01:00
Dominik Schaudel
cea48d9010
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module
2018-02-12 21:57:22 +01:00
Florian Roth
d6d031fc23
Rule update: Olympic destroyer detection
...
http://blog.talosintelligence.com/2018/02/olympic-destroyer.html
2018-02-12 15:35:47 +01:00
Florian Roth
fa4dbc0f2e
Rule: QuarksPwDump temp dump file
2018-02-10 15:25:36 +01:00
Florian Roth
0a1c600d7d
Rule: Changed msiexec web install rule
2018-02-10 15:25:08 +01:00
Florian Roth
a4e6b3003f
Rule: Msiexec web install
2018-02-09 10:13:39 +01:00
SherifEldeeb
348728bdd9
Cleaning up empty list items
2018-01-28 02:36:39 +03:00
SherifEldeeb
48441962cc
Change All "str" references to be "list"to mach schema update
2018-01-28 02:24:16 +03:00
SherifEldeeb
112a0939d7
Change "reference" to "references" to match new schema
2018-01-28 02:12:19 +03:00
Florian Roth
0f2e1c5934
Bugfix: Missing wildcard in IIS module install rule
2018-01-27 16:15:25 +01:00
Florian Roth
d93d7d8e7b
Rule: IIS nativ-code module command line installation
2018-01-27 11:13:13 +01:00
Florian Roth
aca70e57ec
Massive Title Cleanup
2018-01-27 10:57:30 +01:00
Florian Roth
379b2dd207
New recon activity rule
2017-12-11 09:31:54 +01:00
Florian Roth
8e2aef035c
Removed commands - false positive reduction
2017-12-11 09:31:54 +01:00
Florian Roth
1464ab4ab8
Renamed rule: recon activity > net recon activity - to be more specific
2017-12-11 09:31:54 +01:00
Florian Roth
285f5bab4f
Removed duplicate string
2017-12-11 09:31:54 +01:00
Florian Roth
78854b79c4
Rule: System File Execution Location Anomaly
2017-11-27 14:09:22 +01:00
Florian Roth
93fbc63691
Rule to detect droppers exploiting CVE-2017-11882
2017-11-23 00:58:31 +01:00
Thomas Patzke
2ec5919b9e
Fixed win_disable_event_logging by multiline description
2017-11-19 22:49:40 +01:00
Nate Guagenti
a796ff329e
Create win_disable_event_logging
2017-11-15 21:56:30 -05:00
Florian Roth
3a378f08ea
Bugfix in Adwind rule - typo in typo
2017-11-10 12:51:54 +01:00
Florian Roth
6e4e857456
Improved Adwind Sigma rule
2017-11-10 12:39:08 +01:00
Florian Roth
57d56dddb7
Improved Adwind RAT rule
2017-11-09 18:53:46 +01:00
Florian Roth
b558f5914e
Added reference to Tom Ueltschie's slides
2017-11-09 18:30:50 +01:00
Florian Roth
781db7404e
Updated Adwind RAT rule
2017-11-09 18:28:27 +01:00
Florian Roth
970f01f9f2
Renamed file for consistency
2017-11-09 15:43:32 +01:00
Florian Roth
a042105aa1
Rule: Adwind RAT / JRAT javaw.exe process starts in AppData folder
2017-11-09 15:43:32 +01:00
Florian Roth
a0ac61229c
Rule: Detect plugged USB devices
2017-11-09 08:40:46 +01:00
Florian Roth
59e5b3b999
Sysmon: Named Pipe detection for APT malware
2017-11-06 14:24:42 +01:00
Florian Roth
37cea85072
Rundll32.exe suspicious network connections
2017-11-04 14:44:30 +01:00
Thomas Patzke
5035c9c490
Converted Windows 4688-only rules into 4688 and Sysmon/1 collections
2017-11-01 22:12:14 +01:00
Thomas Patzke
f3a809eb00
Improved admin logon rules and removed duplicates
2017-11-01 21:33:01 +01:00
Thomas Patzke
0055eedb83
Merge pull request #54 from juju4/CAR-2016-04-005b
...
Admin user remote login
2017-11-01 21:22:09 +01:00
Thomas Patzke
613f922976
Merge pull request #43 from juju4/master
...
New rules
2017-11-01 21:21:30 +01:00
Thomas Patzke
118e8af738
Simplified rule collection
2017-11-01 10:00:35 +01:00
Thomas Patzke
732f01878f
Sigma rule collection YAML action documents
2017-11-01 00:17:55 +01:00
Thomas Patzke
d0b2bd9875
Multiple rules per file
...
* New wrapper class SigmaCollectionParser parses all YAML documents
contained in file and handles multiple SigmaParser instantiation.
* Exemplary extended one security/4688 rule to security/4688 + sysmon/1
2017-10-31 23:06:18 +01:00
Thomas Patzke
9d96a998d7
Merge pull request #56 from juju4/CAR-2013-05-002b
...
Detects Suspicious Run Locations - MITRE CAR-2013-05-002
2017-10-30 00:27:56 +01:00
Thomas Patzke
720c992573
Dropped within keyword
...
Covered by timeframe attribute.
Fixes issue #26 .
2017-10-30 00:25:56 +01:00
Thomas Patzke
c865b0e9a8
Removed within keyword in rule
2017-10-30 00:15:01 +01:00
Thomas Patzke
0df60fe004
Merge branch 'CAR-2013-04-002b' of https://github.com/juju4/sigma into juju4-CAR-2013-04-002b
2017-10-30 00:13:21 +01:00
Thomas Patzke
27227855b5
Merge branch 'devel-sigmac'
2017-10-29 23:59:49 +01:00
Thomas Patzke
012cb6227f
Added proper handling of null/not null values
...
Fixes issue #25
2017-10-29 23:57:39 +01:00
juju4
4b64fc1704
double quotes = escape
2017-10-29 14:42:40 -04:00
juju4
07185247cb
double quotes = escape
2017-10-29 14:32:52 -04:00
juju4
f5f20c3f75
Admin user remote login
2017-10-29 14:30:11 -04:00
juju4
19dd69140b
Detects Suspicious Run Locations - MITRE CAR-2013-05-002
2017-10-29 14:27:01 -04:00
juju4
ad27a0a117
Detects Quick execution of a series of suspicious commands - MITRE CAR-2013-04-002
2017-10-29 14:24:53 -04:00
juju4
9d968de337
Merge remote-tracking branch 'upstream/master'
2017-10-29 14:14:47 -04:00
Florian Roth
b7e8000ccb
Improved Office Shell rule > added 'schtasks.exe'
2017-10-25 23:53:45 +02:00
Florian Roth
d9f933fec9
Fixed the fixed PSAttack rule
2017-10-19 09:52:40 +02:00
Florian Roth
0b0435bf7a
Fixed PSAttack rule
2017-10-18 21:49:38 +02:00
Thomas Patzke
d7c659128c
Removed unneeded array
2017-10-18 15:12:29 +02:00
Florian Roth
deea224421
Rule: New RUN Key Pointing to Suspicious Folder
2017-10-17 16:19:56 +02:00
juju4
e6661059c2
Merge remote-tracking branch 'upstream/master'
2017-10-15 11:58:01 -04:00
Florian Roth
00baa4ed40
Executables Started in Suspicious Folder
2017-10-14 23:23:04 +02:00
Florian Roth
358d1ffba0
Executables Started in Suspicious Folder
2017-10-14 23:22:20 +02:00
juju4
cbde0ee5e5
Merge remote-tracking branch 'upstream/master'
2017-09-16 10:03:18 -04:00
Florian Roth
20f9dbb31c
CVE-2017-8759 - Winword.exe > csc.exe
2017-09-15 15:49:56 +02:00
Thomas Patzke
986c9ff9b7
Added field names to first rules
2017-09-12 23:54:04 +02:00
Thomas Patzke
68cb5e8921
Merge pull request #45 from secman-pl/patch-1
...
Update sysmon_susp_regsvr32_anomalies to detect wscript child process
2017-09-10 22:52:37 +02:00
juju4
e2213347ad
Merge remote-tracking branch 'upstream/master'
2017-09-09 11:33:18 -04:00
Florian Roth
bfe8378455
Rule: Suspicious svchost.exe process
2017-08-31 11:07:45 +02:00
secman-pl
9768f275d0
Update sysmon_susp_regsvr32_anomalies
...
Rule to detect COM scriptlet invocation when wscript.exe is spawned from regsvr32.exe.
example: https://www.hybrid-analysis.com/sample/f34da6d84a9663928606894fbc494cd9bf2f03c98cf0c775462802558d3a50ef?environmentId=100
SCT script code:
var objShell = new ActiveXObject("WScript.shell");
2017-08-29 12:21:47 +02:00
Florian Roth
f3f2c14b3a
Added reference to regsvr32 rule
2017-08-29 08:45:29 +02:00
Florian Roth
55f4c37e22
Rule: Microsoft Binary Github Communication
2017-08-24 18:27:40 +02:00
Florian Roth
f46e86fbb1
WMI persistence modified
2017-08-24 18:27:40 +02:00
Hans-Martin Münch
09e754a8f9
Small Typo fix
2017-08-22 10:56:25 +02:00
Florian Roth
59821d1bcb
Office Shell: Reference added to new entry
2017-08-22 10:04:22 +02:00
Florian Roth
332f7d27da
Win WMI Persistence
...
http://blog.trendmicro.com/trendlabs-security-intelligence/cryptocurrency-miner-uses-wmi-eternalblue-spread-filelessly/
https://twitter.com/mattifestation/status/899646620148539397
2017-08-22 10:02:54 +02:00
Florian Roth
8f4a780c3b
Added regsvr32.exe to suspicious child processes
2017-08-20 23:14:41 +02:00
Florian Roth
e06cf6c43f
Service install - net user persistence
2017-08-16 15:16:57 +02:00
juju4
b109a1277e
Detects suspicious process related to rasdial.exe
2017-08-13 16:20:25 -04:00
juju4
012ed4cd7d
Detects execution of executables that can be used to bypass Applocker whitelisting
2017-08-13 16:20:01 -04:00
juju4
f861969e95
tentative rule to detect admin users remote login
2017-08-13 16:19:24 -04:00
juju4
d2ae98b0de
tentative rule to detect admin users interactive login
2017-08-13 16:18:58 -04:00
juju4
21b1c52d1e
forfiles, bash detection
2017-08-13 16:18:13 -04:00
Thomas Patzke
4578756cfd
Merge remote-tracking branch 'origin/master'
2017-08-05 00:35:24 +02:00
Thomas Patzke
03985288f6
Removed 'last' from timeframe
2017-08-05 00:32:24 +02:00
Florian Roth
edb52e098a
Extended hh.exe in Office Shell detection
...
https://www.hybrid-analysis.com/sample/6abc2b63f1865a847ff7f5a9d49bb944397b36f5503b9718d6f91f93d60f7cd7?environmentId=100
2017-08-04 09:18:55 +02:00
Thomas Patzke
d17604d007
Merge branch 'master' into travis-test
2017-08-03 00:11:08 +02:00
Thomas Patzke
5706361464
Parsing of "near ... within" aggregation operator
...
* Operator is only parsed. No processing or passing of parsed data to
backends.
* Changed rule sysmon_mimikatz_inmemory_detection.yml accordingly.
2017-08-03 00:05:48 +02:00
Thomas Patzke
167b1f0191
Merge branch 'master' into travis-test
2017-08-02 22:53:52 +02:00
Thomas Patzke
f768bf3d61
Fixed parse errors
2017-08-02 22:49:15 +02:00
Thomas Patzke
bfcc119a7f
Merge branch 'master' into travis-test
2017-08-02 00:37:07 +02:00
Thomas Patzke
b82a6fdc51
Added wildcards to windows/builtin/win_susp_rundll32_activity.yml
2017-08-02 00:09:34 +02:00
Thomas Patzke
84418d2045
Merged builtin/win_susp_certutil_activity.yml with Sysmon rule
2017-08-02 00:04:28 +02:00
Thomas Patzke
c350a90b21
Merge branch 'master' into rules-juju4
2017-08-01 23:55:53 +02:00
juju4
5b778c9833
yamllint: quote twitter-formatted nickname
2017-07-30 11:42:25 -04:00
juju4
5b42c64fcd
Merge remote-tracking branch 'upstream/master'
2017-07-30 11:12:03 -04:00
juju4
31b033d492
suspicious rundll32 activity rules
2017-07-30 11:11:45 -04:00
juju4
3a8946a3ac
suspicious phantom dll rules
2017-07-30 11:11:17 -04:00
juju4
fbbf29fd80
suspicious cli escape character rules
2017-07-30 11:10:43 -04:00
juju4
83fa83aa43
suspicious certutil activity rules
2017-07-30 11:09:51 -04:00
juju4
f487451c45
more suspicious cli process
2017-07-30 11:09:24 -04:00
Florian Roth
d1cdb3c480
Certutil duplicate entry and "-ping" command
2017-07-23 14:51:57 -06:00
Florian Roth
cdf0894e6a
Corrected error in certutil rules (-f means force overwrite, not file)
...
> the -urlcache is the relevant command
2017-07-20 12:54:55 -06:00
Florian Roth
3a55b31da2
certutil file download - more generic approach
2017-07-20 12:48:47 -06:00
Florian Roth
b85d96e458
certutil detections (renamed, extended)
...
see https://twitter.com/subTee/status/888102593838362624
2017-07-20 12:38:10 -06:00
Florian Roth
950a00f33e
Updated Petya rule
2017-06-28 12:52:58 +02:00
Florian Roth
ece1d7e3a8
Added perfc.dat keyword to NotPetya rule
2017-06-28 10:35:42 +02:00
Florian Roth
a3e0e37163
NotPetya Title Fixed
2017-06-28 09:12:39 +02:00
Florian Roth
8c437de970
NotPetya Sigma Rule for Sysmon Events
2017-06-28 09:09:12 +02:00
Florian Roth
8f525d2f01
Wannacry Rules Reorg and Renaming
2017-06-28 09:08:53 +02:00
Florian Roth
3f245d27f8
Eventlog cleared ID 104
2017-06-27 17:29:39 +02:00
Thomas Patzke
7fdc78c8bf
Merge pull request #36 from dim0x69/master
...
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm
2017-06-19 15:32:56 +02:00
Florian Roth
d1f1bd59da
Changed level of PsExec events to 'low'
2017-06-17 08:50:16 +02:00
Thomas Patzke
a4c9e24380
File renaming while deletion with SDelete
2017-06-14 16:55:32 +02:00
Thomas Patzke
8c06a5d83f
Access to wceaux.dll while WCE pass-the-hash login on source host
2017-06-14 15:59:45 +02:00
Thomas Patzke
4fcdcc3967
Added rule for PsExec
2017-06-12 23:57:06 +02:00
Florian Roth
576981820b
Moved PlugX rule & used builtin ID 4688 for another rule
2017-06-12 11:02:49 +02:00
Thomas Patzke
91b3c39c0d
Amended condition
...
Changed condition according to proposed syntax for related event matching (#4 )
2017-06-11 23:54:19 +02:00
dimi
ac95e372e5
clarification: if executed locally there is no connection to the samr pipe on IPC$. So this rule detects remote changes
2017-06-09 14:15:37 +02:00
dimi
a2a2366dfb
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm
2017-06-09 14:05:40 +02:00
Florian Roth
371b41acd9
Improved regsvr32.exe whitelisting bypass rule
...
thanks to Nick Carr https://twitter.com/ItsReallyNick/status/872409920938946560
2017-06-07 13:46:36 +02:00
Florian Roth
e5ad1b2f84
Improved regsvr32 whitelisting bypass rule
2017-06-07 12:02:55 +02:00
Florian Roth
1fd7a92e87
Regsvr32.exe anomalies (bugfix and new selection)
2017-06-07 11:43:25 +02:00
Florian Roth
5dd3d4dd57
Generic Hacktool Use Rule
2017-05-31 08:42:35 +02:00
Florian Roth
0c222134b9
Extended malware script dropper rule
2017-05-25 14:59:16 +02:00
Florian Roth
0685e297c8
Improved Suspicious Net.exe Execution Rule
2017-05-25 12:44:56 +02:00
Florian Roth
ae4cab6783
Corrected - no lists needed
2017-05-25 12:07:11 +02:00
Florian Roth
6ad5f82248
Corrected rule
2017-05-25 12:06:23 +02:00
dimi
0b8c82b75b
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading
...
2) correct typo in dns server rule
2017-05-15 20:58:31 +02:00
Florian Roth
01e1d3a3d7
WannaCry Service Install
2017-05-15 16:06:16 +02:00
Florian Roth
75e55d647b
Fixed and added strings
2017-05-13 18:33:51 +02:00
Florian Roth
46643324a8
Wannacrypt Update
2017-05-13 10:40:41 +02:00
Florian Roth
c40c592fb5
Changed rule as "m.vbs" isn't stable
2017-05-13 08:32:30 +02:00
Florian Roth
7c56992de5
Reference in WannaCrypt rule
2017-05-12 23:02:13 +02:00
Florian Roth
d35b6c0353
Backup catalog deletion rule
2017-05-12 23:00:56 +02:00
Florian Roth
b7837d4cdb
Fixed WannaCrypt rule
2017-05-12 22:32:40 +02:00
Florian Roth
1ab3c746c1
Merge branch 'master' of https://github.com/Neo23x0/sigma
2017-05-12 21:59:43 +02:00
Florian Roth
5cdb2b013b
WannaCrypt Ransomware
2017-05-12 21:57:53 +02:00
Florian Roth
0b541b2689
Suspicious Windows Process Creations Update
2017-05-12 21:55:30 +02:00
Thomas Patzke
300dbe8f3e
Fixed condition
...
AND has higher precedence than OR.
2017-05-09 23:12:02 +02:00
Florian Roth
565c51e5be
Removed "1 of" expression (no bug, but cleaner)
2017-05-09 22:58:42 +02:00
Florian Roth
a6678e199b
Microsoft Malware Protection Engine Crash - ref CVE-2017-0290
2017-05-09 22:46:57 +02:00
Florian Roth
96deef7d34
Updated sigma signature
2017-05-08 21:25:07 +02:00
Florian Roth
16ac2337a4
Suspicious DNS Server Config Error - Sysmon Rule
2017-05-08 13:39:50 +02:00
Florian Roth
75e58b8142
Bugfix and date
2017-05-08 13:10:40 +02:00
Florian Roth
263c98a2c8
Suspicious DNS Server Config Error - ServerLevelPluginDLL issue
2017-05-08 13:09:50 +02:00
Florian Roth
c7cc2a00d3
WScript/CScript Dropper
2017-05-05 17:30:46 +02:00
Florian Roth
dc4ae35be1
Schtasks frequency - minute
2017-04-28 17:03:35 +02:00
Florian Roth
a5c3f424c1
regsvr32 Anomalies
2017-04-16 12:02:29 +02:00
Florian Roth
769156a83b
Minor fix > list to single value
2017-04-16 12:01:03 +02:00
Florian Roth
8363b25888
Suspicious Control Panel DLL Load
2017-04-15 23:32:26 +02:00
Florian Roth
89e43c1059
Improved MSHTA rule
2017-04-13 09:25:34 +02:00
Florian Roth
d66c97921f
Bugfix in rule
2017-04-13 01:22:03 +02:00
Florian Roth
059cfbf15a
Removed duplicate
2017-04-13 01:21:46 +02:00
Florian Roth
c2ed7bd9df
MSHTA Rule v1
2017-04-13 01:08:37 +02:00
Florian Roth
64caa8aedc
Merge pull request #31 from neu5ron/patch-4
...
Create win_alert_ad_user_backdoors.yml
2017-04-13 01:07:41 +02:00
Florian Roth
1e4d563a4d
Merge pull request #30 from yugoslavskiy/win_pass_the_hash_improving
...
improved win_pass_the_hash.yml rule
2017-04-13 01:05:09 +02:00
Nate Guagenti
53313d45be
Create win_alert_ad_user_backdoors.yml
2017-04-12 16:15:41 -04:00
Florian Roth
abb01cc264
Rule: PowerShell credential prompt
2017-04-09 10:22:04 +02:00
Florian Roth
92b4a7ad93
Added reference
2017-04-07 15:42:08 +02:00
yugoslavskiy
f83d0e36b8
improved win_pass_the_hash.yml rule
...
— deleted useless KeyLength: '0'
— added filter condition to exclude AccountName='ANONYMOUS LOGON',
because of false positives [1]
[1]
http://serverfault.com/questions/338644/what-are-anonymous-logons-in-win
dows-event-log
2017-04-04 02:57:58 +03:00
Nate Guagenti
2bb7d7e6eb
Create win_alert_active_directory_user_control.yml
2017-04-03 15:58:23 -04:00
Nate Guagenti
85b4efabed
Update win_alert_enable_weak_encryption.yml
2017-04-03 09:15:52 -04:00
Nate Guagenti
bd63d74776
Create win_alert_enable_weak_encryption.yml
...
kerberoast and enabling weak encryption for password/hash cracking
2017-04-03 09:12:58 -04:00
Florian Roth
0650aa3cbe
Rule: Suspicious cmd.exe combo with http and AppData
2017-04-03 10:41:10 +02:00
Florian Roth
fa90fb2fed
Improved WMIC process call create rule
2017-03-29 22:11:05 +02:00
Florian Roth
e6a81623a8
PowerShell Combo - False Positive with MOM
2017-03-29 22:10:28 +02:00
Florian Roth
f91f813b3f
Improved certutil.exe rules
2017-03-27 22:30:26 +02:00
Florian Roth
078eaa1180
Updated Windows suspicious activity
2017-03-27 17:27:04 +02:00
Florian Roth
707e5a948f
Rules: Password dumper activity and lateral movement
2017-03-27 15:20:50 +02:00
Florian Roth
125bf4f3f2
Rule adjustment
...
Added wilcards cause the field can contain a full path
2017-03-26 23:41:38 +02:00
Florian Roth
53cc80c8f4
Windows Supicious Process Creation
...
- Bugfix in selection name
- New keyword expressions
2017-03-26 23:25:47 +02:00
Florian Roth
b0c8ffb051
Combined vssadmin rule
2017-03-26 01:27:26 +01:00
Florian Roth
800262a738
Renamed and double removed
2017-03-26 01:27:08 +01:00
Florian Roth
c1a6a542db
Rule: Windows 4688 process creation rule
2017-03-26 01:26:34 +01:00
Michael Haag
5ea6fad999
net.exe and wmic.exe
...
Suspicious execution of net and wmic
2017-03-25 06:48:23 -07:00
Florian Roth
699c638ee2
Bugfix: Wrong Event ID and extended description
2017-03-23 11:50:30 +01:00
Florian Roth
d377884972
Rule: Rare scheduled tasks creations
2017-03-23 11:45:10 +01:00
Florian Roth
10ee36f26c
Updated Eventvwr UAC evasion
2017-03-22 14:40:55 +01:00
Florian Roth
fa37f5afcf
Rules: PowerShell Downgrade Attacks
2017-03-22 11:17:46 +01:00
Florian Roth
3bfa9ed121
Bugfix: Minor fix cause Sysmon uses SID as Software key
2017-03-21 10:44:53 +01:00
Florian Roth
b1da8c5b32
Bugfix: Fixed UAC bypass rules
2017-03-21 10:42:22 +01:00
Florian Roth
7ce958a3ed
Bugfixes and improvements
2017-03-21 10:24:20 +01:00
Florian Roth
f9be5b99ad
Rule: Suspicious task creation description changed
2017-03-21 10:23:53 +01:00
Florian Roth
055992eb05
Bugfix: PowerShell rules log source inconstency
2017-03-21 10:22:13 +01:00
Florian Roth
6f38a44ec1
Broader definition certutil.exe rule
2017-03-20 22:07:04 +01:00
Florian Roth
2817ea2605
Bugfix in UAC Rule
2017-03-19 19:46:19 +01:00
Florian Roth
b2c15c2cf7
Rule: UAC bypass via eventvwr, minor changes
2017-03-19 19:34:06 +01:00
Florian Roth
c82da0dc5c
Rules: Suspicious locations and back connect ports
2017-03-19 15:22:27 +01:00
Thomas Patzke
889315c960
Changed values with placeholders to quoted strings
...
Values beginning with % cause YAML parse error
2017-03-18 23:05:16 +01:00
Thomas Patzke
56f415e42c
Fixed rule
2017-03-17 22:09:53 +01:00
Omer Yampel
d3bd73aefb
Create sysmon_sdclt_uac_bypass.yml
...
UAC Bypass from https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/ . Sorry in advance for not being 100% about the sysmon event ids / fields
2017-03-17 14:31:26 -04:00
Florian Roth
59499f926e
Bugfix: Taskscheduler log source definition
2017-03-17 16:09:31 +01:00
Florian Roth
dd81b18d6e
Rule: Suspicious interactive console logons to servers
2017-03-17 09:44:24 +01:00
Florian Roth
bcc250e1c7
Added missing description
2017-03-17 08:43:21 +01:00
Florian Roth
e46ecd2aff
Rule: Rare scheduled task installs
2017-03-17 08:41:27 +01:00
Florian Roth
3a7652fff9
Added references to rule
2017-03-17 00:25:54 +01:00
Florian Roth
c6843d41bc
Rule: Vssadmin / NTDS.dit activity
2017-03-17 00:23:55 +01:00
Florian Roth
d00bbd9fb5
Rule: Windows recon activity
2017-03-16 18:59:17 +01:00
Florian Roth
140141b7a2
Rule: Suspicious PowerShell parent image combination
2017-03-16 18:58:59 +01:00
Florian Roth
091bb8fab7
Renamed and removed double space
2017-03-16 18:58:32 +01:00
Florian Roth
dd558e941c
Rule: Access to ADMIN$ share
2017-03-14 14:53:03 +01:00
Florian Roth
3eae1f2710
Bug and typo fixes
2017-03-14 14:52:28 +01:00
Florian Roth
2e32e1bb43
Rule: User account added to local Administrators
2017-03-14 12:51:50 +01:00
Florian Roth
cb683a6b56
Rule: Suspicious executions in web folders / non-exe folders
2017-03-13 23:56:06 +01:00
Florian Roth
c571848e9b
Rule: Scheduled task creation
2017-03-13 20:45:28 +01:00
Florian Roth
de46c8c0a0
Reduced to user accounts
2017-03-13 19:09:29 +01:00
