mlp1515
|
7ad927f28e
|
Update win_wmiprvse_spawning_process.yml
French language settings
|
2021-08-26 12:42:47 +00:00 |
|
mlp1515
|
644397e65c
|
Update win_exploit_cve_2019_1388.yml
French language settings
|
2021-08-26 12:41:36 +00:00 |
|
frack113
|
a4021842de
|
Fix invalid tags
|
2021-08-25 09:15:57 +02:00 |
|
frack113
|
e849af9df0
|
Merge pull request #1915 from frack113/tags_cve
fix tags
|
2021-08-25 06:29:48 +02:00 |
|
Florian Roth
|
9f69cead8a
|
Merge pull request #1916 from SigmaHQ/rule-devel
refactor: changed level of rule, refactored RazerInstaller rule
|
2021-08-24 15:42:26 +02:00 |
|
Florian Roth
|
46e312ff0d
|
fix: error in modifier
|
2021-08-24 15:03:23 +02:00 |
|
Florian Roth
|
cc519552aa
|
refactor: RazorInstaller integrity level system
|
2021-08-24 14:54:07 +02:00 |
|
frack113
|
7753f8c22e
|
fix tags
|
2021-08-24 12:36:31 +02:00 |
|
Florian Roth
|
6ca30619ac
|
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
|
2021-08-24 12:30:42 +02:00 |
|
Florian Roth
|
3cdb88ad55
|
refactor: level of suspicious parent for powershell rule
|
2021-08-24 12:30:40 +02:00 |
|
frack113
|
5b869a3f42
|
Update cve tags
|
2021-08-24 10:50:01 +02:00 |
|
frack113
|
ace46c17be
|
Update cve tags
|
2021-08-24 10:27:27 +02:00 |
|
frack113
|
c2302a15da
|
fix cve tags
|
2021-08-24 10:10:45 +02:00 |
|
Florian Roth
|
0c69fd9c41
|
Merge pull request #1898 from SigmaHQ/rule-devel
rule: EfsPotato Named Pipe, splwow64, RazerInstaller
|
2021-08-24 09:20:54 +02:00 |
|
Florian Roth
|
272625a005
|
Update win_susp_splwow64.yml
|
2021-08-24 08:34:08 +02:00 |
|
frack113
|
a04fbe2a99
|
Merge pull request #1901 from frack113/redcanary
Redcanary Powershell Suspicious Win32_PnPEntity T1120
|
2021-08-23 19:44:16 +02:00 |
|
Florian Roth
|
998ebbe1f3
|
fix: typo in name
|
2021-08-23 18:46:05 +02:00 |
|
Florian Roth
|
6b86dacc9e
|
rule: razor installer
|
2021-08-23 18:44:15 +02:00 |
|
frack113
|
be316db84d
|
Merge pull request #1899 from secDre4mer/master
feat: Add rule for malicious CSR export on Exchange
|
2021-08-23 17:26:16 +02:00 |
|
SomeOne
|
037f33b5e2
|
Replace by default windows fieldnames
|
2021-08-23 15:24:48 +02:00 |
|
Florian Roth
|
91b42f9077
|
fix: indentation
|
2021-08-23 15:03:59 +02:00 |
|
SomeOne
|
45f30cb2b4
|
Add fields to event log cleared
|
2021-08-23 15:00:07 +02:00 |
|
frack113
|
25072e37b3
|
update references
|
2021-08-23 13:30:46 +02:00 |
|
frack113
|
33c6ff6b5f
|
add powershell_suspicious_win32_pnpentity
|
2021-08-23 13:17:35 +02:00 |
|
Max Altgelt
|
82dde594d1
|
feat: Add rule for malicious CSR export on Exchange
|
2021-08-23 11:20:30 +02:00 |
|
Florian Roth
|
a0f72e5f6f
|
rule: suspicious splwow64 process starts
|
2021-08-23 10:41:42 +02:00 |
|
Florian Roth
|
dc3ed771b5
|
rule: EfsPotato Named Pipe
|
2021-08-23 08:32:50 +02:00 |
|
frack113
|
fc9666fb4e
|
Merge pull request #1896 from ZikyHD/fix_old_technics
Replace old mitre techniques by new one
|
2021-08-22 18:56:08 +02:00 |
|
frack113
|
0a410010a2
|
Merge pull request #1877 from frack113/red_back
Add t1546 redcanary rules
|
2021-08-22 18:50:58 +02:00 |
|
SomeOne
|
295054dcbe
|
Replace old mitre techniques by new one
|
2021-08-22 13:57:56 +02:00 |
|
frack113
|
064c65cb1f
|
Merge pull request #1892 from frack113/clean_PS
Powershell Cleanup
|
2021-08-21 18:04:52 +02:00 |
|
frack113
|
07a87aa7f8
|
Merge pull request #1858 from frack113/fix_pr718
Replace pr718
|
2021-08-21 18:02:30 +02:00 |
|
frack113
|
a44206bfa0
|
Some cleanup
|
2021-08-21 17:33:39 +02:00 |
|
pbssubhash
|
eee497f656
|
Title modification
|
2021-08-21 20:04:03 +05:30 |
|
pbssubhash
|
a415463f5b
|
Modified rule
|
2021-08-21 19:37:28 +05:30 |
|
pbssubhash
|
fba54b8d69
|
First Rule commit
|
2021-08-21 17:47:56 +05:30 |
|
frack113
|
42c90b9d20
|
fix powershell_psattack error
|
2021-08-21 10:05:47 +02:00 |
|
frack113
|
2f683b9ab7
|
fix powershell_clear_powershell_history error
|
2021-08-21 10:00:48 +02:00 |
|
frack113
|
0fb6c35b1f
|
Cleanup PS rules
|
2021-08-21 09:58:58 +02:00 |
|
frack113
|
da839775fe
|
Update PS rules
|
2021-08-21 09:50:59 +02:00 |
|
frack113
|
6c529f7ab2
|
Update PS rules
|
2021-08-21 09:33:52 +02:00 |
|
frack113
|
cb95582077
|
Update PowerShell rule
|
2021-08-21 09:08:38 +02:00 |
|
Florian Roth
|
b92346ba5f
|
Merge pull request #1882 from austinsonger/win_susp_bitstransfer.yml
win_susp_bitstransfer.yml
|
2021-08-20 16:53:52 +02:00 |
|
frack113
|
7ebd411190
|
update ref from conti_leak
|
2021-08-20 14:22:17 +02:00 |
|
Austin Songer
|
fe0e1353e0
|
Update win_susp_bitstransfer.yml
|
2021-08-19 22:24:23 -05:00 |
|
Austin Songer
|
8d57ae5ffd
|
Create win_susp_bitstransfer.yml
|
2021-08-19 21:57:37 -05:00 |
|
frack113
|
23ad8cd14e
|
remove bad rules
|
2021-08-19 18:30:32 +02:00 |
|
frack113
|
3283664154
|
Update remove useless rules
|
2021-08-19 18:28:44 +02:00 |
|
frack113
|
f1a84536c3
|
update fix
|
2021-08-19 17:55:41 +02:00 |
|
frack113
|
600c6233c2
|
Merge pull request #1874 from gs3cl/patch-1
Update win_nltest_query.yml
|
2021-08-19 16:18:20 +02:00 |
|