Florian Roth
7bd820c151
Changes
2020-01-13 09:56:49 +01:00
sreemanshanker
8833b43cea
Merge pull request #1 from sreemanshanker/sreemanshanker-patch-1
...
Add files via upload
2020-01-13 13:21:29 +08:00
sreemanshanker
ffcfcb70ad
Add files via upload
2020-01-13 13:21:06 +08:00
Florian Roth
a29c832b6a
rule: updated netscaler rule
2020-01-07 14:42:16 +01:00
Florian Roth
c9a75a8371
fix: shortened path in Citrix Netscaler rule
2020-01-07 13:00:28 +01:00
Florian Roth
b03a43ca1b
Merge pull request #589 from 2d4d/add_cve_2019-19781
...
add rule for Citrix Netscaler CVE-2019-19781
2020-01-06 14:15:46 +01:00
2d4d
35fbdd1248
add rule for Citrix Netscaler CVE-2019-19781
2020-01-03 01:48:29 +01:00
2d4d
b98e57603e
add rule for Citrix Netscaler CVE-2019-19781
2020-01-03 00:34:52 +01:00
Florian Roth
ed5c77e1be
Merge pull request #587 from refractionPOINT/internal-name
...
Adding LimaCharlie support for OriginalFileName field.
2019-12-31 08:32:51 +01:00
Maxime Lamothe-Brassard
a3ad7cb1c5
Fixed actual event tag
2019-12-30 18:15:12 -08:00
Maxime Lamothe-Brassard
9b32086d92
Mapping OriginalFileName to event/INTERNAL_NAME now that it's available.
2019-12-30 15:58:18 -08:00
Florian Roth
c007ecf90c
Merge pull request #585 from Neo23x0/devel
...
Devel
2019-12-30 15:08:43 +01:00
Florian Roth
5980cb8d0c
rule: copy from admin share - lateral movement
2019-12-30 14:25:43 +01:00
Florian Roth
86e6b92903
rule: SecurityXploded tool
2019-12-30 14:25:29 +01:00
Florian Roth
5ad793e04a
Merge pull request #582 from tvjust/patch-1
...
Added new sticky key attack binary
2019-12-30 14:14:20 +01:00
Florian Roth
948af2993b
Merge pull request #583 from msec1203/msec1203-submit-rule1
...
MS Office Doc Load WMI DLL Rule
2019-12-30 14:13:58 +01:00
msec1203
dbdf6680e0
Update win_susp_winword_wmidll_load.yml
...
Update x2
2019-12-30 18:49:39 +09:00
msec1203
a45f877712
Update win_susp_winword_wmidll_load.yml
...
Fix to error on incorrect mitre tags used.
2019-12-30 18:41:16 +09:00
Florian Roth
e043bc2193
Merge pull request #584 from GelosSnake/master
...
FP in win_system_exe_anomaly.yml
2019-12-29 18:52:43 +01:00
GelosSnake
f574c20432
Update win_system_exe_anomaly.yml
...
fixing to much original fork.
2019-12-29 18:02:49 +02:00
GelosSnake
7e7f6d1182
Update win_system_exe_anomaly.yml
...
Following sigma event I've noticed my twitter account was referenced:
https://twitter.com/GelosSnake/status/934900723426439170
Rule:
https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_system_exe_anomaly.yml
Seems like - '\SystemRoot\System32\\*' is missing and hence triggering an FP.
2019-12-29 18:01:19 +02:00
msec1203
845d67f1f3
Initial Upload
...
Submit Sigma Rule For Detecting Word Loading WMI DLL's.
2019-12-29 23:14:29 +09:00
Justin Schoenfeld
a1f07cdb4b
Added new sticky key attack binary
2019-12-29 08:32:23 -05:00
Florian Roth
042c58dfc1
Merge pull request #581 from david-burkett/master
...
Trickbot behavioral recon activity / svchost spawned without CLI
2019-12-28 18:11:34 +01:00
david-burkett
4a65a25070
svchost spawned without cli
2019-12-28 10:28:08 -05:00
Florian Roth
5e59bbb3c3
Added MITRE ATT&CK Technique T1482
...
https://attack.mitre.org/techniques/T1482/
2019-12-28 16:02:26 +01:00
david-burkett
35b4806104
corrected logic
2019-12-28 09:55:39 -05:00
David Burkett
474a8617e5
Trickbot behavioral recon activity
2019-12-27 21:25:53 -05:00
Florian Roth
62bd2cc3ab
Merge pull request #572 from alessiodallapiazza/master
...
Add the ability to detect PowerUp - Invoke-AllChecks
2019-12-23 12:57:55 +01:00
Alessio Dalla Piazza
0ff81cc693
Merge pull request #1 from alessiodallapiazza/alessiodallapiazza-patch-1
...
Add the ability to detect PowerUp - Invoke-AllChecks
2019-12-23 11:51:34 +01:00
Alessio Dalla Piazza
f45587074b
Add the ability to detect PowerUp - Invoke-AllChecks
...
PowerUp allow attackers to check if is possible to have a local privilege escalation attacks against Windows systems. The main function is called "Invoke-AllChecks" and check possible path of escalation.
2019-12-23 11:50:57 +01:00
Florian Roth
04afcccd2c
Merge pull request #571 from Neo23x0/devel
...
rule: whoami as local system
2019-12-22 19:23:50 +01:00
Florian Roth
fc8607bbea
rule: whoami as local system
2019-12-22 18:50:26 +01:00
Florian Roth
a7ca386a1b
Merge pull request #570 from Neo23x0/devel
...
CreateMiniDump
2019-12-22 08:40:45 +01:00
Florian Roth
fb76f2b9ac
rule: CreateMiniDump
2019-12-22 08:29:12 +01:00
Florian Roth
511229c0b6
rule: modified Bloodhound rule
2019-12-21 21:22:13 +01:00
Thomas Patzke
530ac854df
Added sigma2attack to CI testing
2019-12-20 22:53:22 +01:00
Thomas Patzke
781f53332b
Merge pull request #566 from christophetd/sigma2attack
...
Add sigma2attack
2019-12-20 21:57:02 +01:00
Florian Roth
1fd4c26005
Merge pull request #569 from Neo23x0/devel
...
rule: improved bloodhound rule
2019-12-20 17:32:21 +01:00
Florian Roth
0fa5ba925e
rule :improved bloodhound rule
2019-12-20 17:23:40 +01:00
Florian Roth
cbebaf637f
Merge pull request #568 from Neo23x0/devel
...
Devel
2019-12-20 16:22:29 +01:00
Florian Roth
0e82dce2a0
fix: fixed wrong condition
2019-12-20 16:11:39 +01:00
Florian Roth
0000257371
rule: improved bloodhound rule
2019-12-20 16:08:26 +01:00
Florian Roth
3a933c38f2
rule: changed level of BloodHound rule
2019-12-20 15:37:58 +01:00
Florian Roth
68efeb909d
rule: false positive condition for BloodHound rule
2019-12-20 15:35:13 +01:00
Florian Roth
825b1edb0f
Merge pull request #567 from Neo23x0/devel
...
Devel
2019-12-20 15:32:56 +01:00
Florian Roth
5f061c15d0
fix: fixed missing condition
2019-12-20 15:18:05 +01:00
Florian Roth
bb466407ee
rule: operation Wocao activity
2019-12-20 15:00:07 +01:00
Florian Roth
708c17e2bc
rule: Bloodhound
2019-12-20 14:59:36 +01:00
Florian Roth
ab038d1ac7
style: minor changes
2019-12-20 14:59:26 +01:00
