valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
3,982 Commits 20 Branches 25 Tags 21 MiB
7dec19afca
Commit Graph

3982 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Yugoslavskiy Daniil
7dec19afca add macos_create_hidden_account.yml; part of the oscd initiative task number 63 of the issue #1012 2020-10-11 22:01:05 +02:00
yugoslavskiy
0966d24031
Merge pull request #1033 from JPMinty/oscd 
Create rules-unsupported/win_remote_schtask.yml
 2020-10-11 19:39:33 +02:00
yugoslavskiy
4548da7fb9
Merge pull request #1034 from JPMinty/Remote_Service 
unsupported-rules/win_remote_service.yml
 2020-10-11 19:38:00 +02:00
JPMinty
21284c2c92 Added selection criteria + moved to Unsupported rule 2020-10-11 12:48:48 +10:30
JPMinty
10f5c38b20 Added conditional description + moved to unsupported-rules 2020-10-11 12:40:24 +10:30
Thomas Patzke
93616af1cb
Merge pull request #1036 from svch0stz/oscd4 
[OSCD] Create win_net_use_admin_share.yml
 2020-10-10 00:05:41 +02:00
Thomas Patzke
fe554a88cb
Merge pull request #1035 from svch0stz/oscd3 
[OSCD] Update win_susp_copy_lateral_movement.yml
 2020-10-10 00:03:26 +02:00
Thomas Patzke
f5cd2e0f0c
Merge pull request #1032 from svch0stz/oscd 
[OSCD] Created win_susp_wsl_lolbin.yml
 2020-10-09 23:56:50 +02:00
JPMinty
13ac0b0e72 Update win_remote_service.yml 2020-10-09 17:05:51 +10:30
JPMinty
bf43344858 Refactor for multiple log sources 2020-10-07 17:25:34 +10:30
JPMinty
c878d55ac0 Add oscd.community author 2020-10-07 16:59:18 +10:30
Thomas Patzke
986c80e593
Added oscd branch to CI 2020-10-07 08:20:26 +02:00
svch0stz
ca0f2146ab
Update win_net_use_admin_share.yml 2020-10-07 08:23:31 +11:00
svch0stz
3d048ceba0
Update win_susp_copy_lateral_movement.yml 2020-10-07 08:18:09 +11:00
svch0stz
ee2c79745f
Update win_susp_wsl_lolbin.yml 2020-10-07 08:12:51 +11:00
svch0stz
c82d5ac08e
Create win_net_use_admin_share.yml 2020-10-05 14:43:45 +11:00
svch0stz
60bd6a3692
Update win_susp_copy_lateral_movement.yml 2020-10-05 14:35:20 +11:00
svch0stz
dd2ab4082d
Update win_susp_copy_lateral_movement.yml 2020-10-05 14:33:00 +11:00
svch0stz
641f3031bd
Update win_susp_copy_lateral_movement.yml 2020-10-05 14:27:39 +11:00
JPMinty
6fc476b2a2 Delete win_remote_schtask.yml 2020-10-05 13:40:57 +10:30
JPMinty
99e52a6f7a Create win_remote_service.yml 2020-10-05 13:37:55 +10:30
svch0stz
3516819bf8
Delete win_net_use_admin_share.yml 2020-10-05 14:00:36 +11:00
svch0stz
c675be41e2
Create win_net_use_admin_share.yml 2020-10-05 13:57:50 +11:00
JPMinty
ad5b128d0d
Delete win_remote_service.yml 2020-10-05 13:26:12 +10:30
JPMinty
79d9cbe2c7 Create win_remote_service.yml 2020-10-05 13:23:00 +10:30
JPMinty
03b350ff0b Create win_remote_schtask.yml 2020-10-05 13:15:48 +10:30
svch0stz
bc947fefc1
Create win_susp_wsl_lolbin.yml 2020-10-05 13:36:40 +11:00
Florian Roth
d3ee1aba66 docs: MITRE ATT&CK(R) trademark references removed or adjusted 
https://github.com/Neo23x0/sigma/issues/1028
 2020-09-30 08:53:52 +02:00
Florian Roth
c17ca6d5fe
Merge pull request #1018 from savvyspoon/wcry-dns 
WannaCry Killswitch domain DNS query
 2020-09-29 09:27:21 +02:00
Florian Roth
d7d9c0e772
Merge pull request #1021 from hieuttmmo/master 
Sigma rule to detect AdFind.exe execution
 2020-09-27 09:50:41 +02:00
Florian Roth
8020fe3c40
false positive condition 2020-09-26 17:03:29 +02:00
Florian Roth
60795f7050
Update win_susp_adfind.yml 
Fear that a simple adfind.exe causes too many false positives
 2020-09-26 17:02:39 +02:00
Florian Roth
dbdd758365
Duplicate Rule 
we already have a rule for that
 2020-09-26 17:01:32 +02:00
Tran Trung Hieu
d4dd0600ad Fix logsource service to process_creation 2020-09-26 21:45:23 +07:00
Tran Trung Hieu
c756fc8576 Detect Suspicious AdFind Execution 2020-09-26 21:34:06 +07:00
Mike Wade
f76f80db80 Killswitch domain 2020-09-16 20:32:31 -06:00
Mike Wade
7b1ef9ea64 fixing test runner issues 2020-09-15 15:45:33 -06:00
Mike Wade
6ed36b0e41 fixed issues with tabs and duplicate tags 2020-09-15 08:52:00 -06:00
Florian Roth
2cd9b794e6
Merge pull request #1007 from d4rk-d4nph3/master 
Windows Defender AMSI Trigger Detected
 2020-09-15 15:45:00 +02:00
Florian Roth
19ccfb80da
Merge pull request #1016 from NVISO-BE/win_vul_cve_2020_1472 
Added win_vul_cve_2020_1472 rule
 2020-09-15 15:43:53 +02:00
Remco Hofman
6cadfa5b2b Added win_vul_cve_2020_1472 rule 2020-09-15 15:13:53 +02:00
Mike Wade
1ddba05eb2 Second round 2020-09-15 07:02:30 -06:00
Mike Wade
da9b32bdd6 we 2020-09-15 06:24:44 -06:00
Mike Wade
8ce73bd8df Fixed issues with tags and missing files 2020-09-15 06:10:57 -06:00
Thomas Patzke
b0ccf44243 Added test 2020-09-15 12:42:37 +02:00
Thomas Patzke
378d9c94cf Merge branch 'master' of https://github.com/socprime/sigma into pr-981 2020-09-15 12:14:49 +02:00
Thomas Patzke
64961c6d42 Added test 2020-09-15 09:06:02 +02:00
Thomas Patzke
28426f9b7f Merge branch 'Netwitness-EPL' of https://github.com/snake-jump/sigma into pr-1001 2020-09-15 08:29:03 +02:00
Florian Roth
50db6dcc69
Merge pull request #1002 from scottdermott/master 
+ Adding exclusion for Azure AD Sync (MSOL_xxxxxxxx)
 2020-09-15 08:17:02 +02:00
Florian Roth
ade9cf9b84
Merge pull request #1004 from oscd-initiative/master 
fix typos, update tags
 2020-09-15 08:16:25 +02:00