4350 Commits

Author	SHA1	Message	Date
frack113	77c6b74c72	Merge pull request #1985 from mvelazc0/master ... Adding Petitpotam/ADCS attack vector detections	2021-09-03 19:06:03 +02:00
mvelazco	a7a002cb7f	updating fields as per frack113 feedback	2021-09-03 10:01:54 -04:00
phantinuss	aa2e86963c	fix: rename filter	2021-09-03 13:26:34 +02:00
phantinuss	f3bdb0e43d	fix: remove unneeded selection	2021-09-03 13:26:23 +02:00
phantinuss	2de2de8433	Addition to UAC Bypasses	2021-09-03 13:26:11 +02:00
ncrqnt	adc3c9e608	fixed date: switched day/month	2021-09-03 12:03:38 +02:00
frack113	1fc2a39720	Merge pull request #1975 from frack113/red_T1564.004_2 ... Redcanary t1564.004 test 2	2021-09-03 08:12:08 +02:00
mvelazco	ba41e922d2	adding Petitpotam host detections	2021-09-03 00:12:49 -04:00
frack113	b731c20594	Merge pull request #1971 from phantinuss/master ... fix: prevent possible FPs	2021-09-02 15:34:46 +02:00
frack113	a048403089	Merge pull request #1973 from klingerko/cs_namedpipe_updates ... Remove duplicate and regex improvements	2021-09-02 15:25:01 +02:00
phantinuss	ab721c736c	chore: move level/falsepositives to bottom	2021-09-02 14:55:17 +02:00
klingerko	15e25f9635	update modifed date	2021-09-02 14:50:14 +02:00
phantinuss	0b373ff1e9	fix: remove 2nd selection due to FPs	2021-09-02 14:47:47 +02:00
phantinuss	5cb6eed52e	fix: remove single value lists	2021-09-02 14:09:03 +02:00
phantinuss	f4a5df67ae	further narrowing down of the selection, therefore removing the filter	2021-09-02 10:28:01 +02:00
frack113	90e673e5ac	fix invalid tags	2021-09-02 10:17:50 +02:00
Florian Roth	0603581111	Merge pull request #1969 from SigmaHQ/rule-devel ... More Named Pipe Rules and WMI rule refactoring	2021-09-02 10:15:00 +02:00
frack113	25c6f69ea3	update references	2021-09-02 09:51:44 +02:00
frack113	5e87970c77	add powershell_store_file_in_alternate_data_stream.yml	2021-09-02 09:47:54 +02:00
frack113	5212b388c6	Merge pull request #1967 from d4rk-d4nph3/master ... Added rule for detection of Atera RMM Agent installation	2021-09-02 09:19:49 +02:00
Konstantin Klinger	457da818a4	regex optimisations	2021-09-01 17:06:55 +02:00
Konstantin Klinger	e83ee55573	remove duplicate	2021-09-01 17:05:36 +02:00
Florian Roth	b0c2d7b75a	fix: tags for WMI / execution / persistence	2021-09-01 16:34:50 +02:00
Florian Roth	2f7f050ad8	fix: removed tags	2021-09-01 16:32:27 +02:00
phantinuss	0b38237dbf	fix: add relation to now obsolete rule	2021-09-01 15:38:29 +02:00
phantinuss	ae9966bdcc	fix: unifying two overlapping rules	2021-09-01 14:48:32 +02:00
phantinuss	deefcaa8ac	fix: prevent possible FPs with the respective command only used as the last parameter	2021-09-01 14:33:46 +02:00
frack113	434c3891ff	Merge pull request #1965 from frack113/add_tags ... Add tags when missing	2021-09-01 14:07:31 +02:00
Florian Roth	1aac21ba79	fix: single list item issue	2021-09-01 14:03:42 +02:00
Florian Roth	1c4f642227	Merge pull request #1699 from matsto/patch-1 ... Fixed transformation modifier for keywords	2021-09-01 14:02:10 +02:00
Florian Roth	505140d273	rule: extended WMI suspicious scripts rule	2021-09-01 13:57:48 +02:00
Florian Roth	e787420be1	rule: WMI filter content encoded executable	2021-09-01 13:57:36 +02:00
Florian Roth	8761927e8c	rule: susp scrcons.exe creating named pipe	2021-09-01 13:57:17 +02:00
Florian Roth	affc929c3b	LiquidSnake named pipe	2021-09-01 13:54:47 +02:00
Florian Roth	c8b3036949	Merge pull request #1968 from SigmaHQ/rule-devel ... docs: note to improved sysmon config	2021-09-01 13:21:28 +02:00
Florian Roth	f102b2d9a1	docs: note to improved sysmon config	2021-09-01 13:07:18 +02:00
Florian Roth	8bba246205	refactor: better way to write it	2021-09-01 12:57:34 +02:00
frack113	2cb5f5e4c6	add missing tags	2021-09-01 12:54:21 +02:00
Florian Roth	c146bc44c7	Merge branch 'master' into patch-1	2021-09-01 12:48:51 +02:00
Bhabesh Rai	6859b6c38f	Added rule for detection of Atera RMM Agent installation	2021-09-01 15:24:47 +05:45
frack113	af599e4877	Merge pull request #1958 from phantinuss/master ... Bulk of new rules, mainly UAC Bypasses	2021-09-01 10:53:02 +02:00
frack113	892c58270a	Update tags	2021-09-01 10:33:57 +02:00
frack113	4b8ffbc183	Update tags	2021-09-01 10:30:43 +02:00
phantinuss	9ffdced740	fix: implement suggestions from PR discussion	2021-09-01 10:21:37 +02:00
frack113	240c5584ff	update tags	2021-09-01 09:56:46 +02:00
frack113	6f3fc7036e	Update tags	2021-09-01 09:45:31 +02:00
frack113	3ed7d6e330	Merge pull request #1959 from frack113/update_ps ... Update PowerShell rules	2021-09-01 08:06:31 +02:00
frack113	cff572b752	Update sysmon_dns_over_https_enabled.yml	2021-08-31 17:11:04 +02:00
phantinuss	add1ad40f8	additional UAC bypass rule	2021-08-31 16:23:32 +02:00
phantinuss	59d8e0b866	add System IntegrityLevel to uac bypass rules, the level is not used most of the time, but might	2021-08-31 16:18:05 +02:00