frack113
|
6bce0f967a
|
Merge pull request #2079 from zakibro/master
New Rule - Linux - Auditd - Clipboard Collection
|
2021-09-27 08:34:30 +02:00 |
|
zakibro
|
6a2785492d
|
Update lnx_auditd_clipboard_collection.yml
Changes after suggestion.
|
2021-09-27 07:59:43 +02:00 |
|
Pawel Mazur
|
4bbe4962b0
|
New Rule - Linux - Auditd - Clipboard Collection
|
2021-09-24 18:40:10 +02:00 |
|
Florian Roth
|
b7b0bd4275
|
Update lnx_clear_syslog.yml
|
2021-09-22 09:46:05 +02:00 |
|
frack113
|
7b995f2d99
|
Merge pull request #2057 from secDre4mer/master
Add two rules
|
2021-09-22 09:15:32 +02:00 |
|
frack113
|
ac639bb9ec
|
Merge pull request #2060 from zakibro/master
New Rule - Linux - Auditd - Screencapture with Import Tool
|
2021-09-22 08:41:50 +02:00 |
|
Pawel Mazur
|
e20e5033e7
|
New Rule - Linux - Auditd - Screencapture with Import Tool
|
2021-09-21 18:55:48 +02:00 |
|
Max Altgelt
|
bf9bc03258
|
chore: properly name and describe rules
|
2021-09-21 15:59:01 +02:00 |
|
Max Altgelt
|
346ff26809
|
feat: Add rule for syslog removal
|
2021-09-21 14:56:12 +02:00 |
|
Roberto Rodriguez
|
407289d300
|
Rule to detect the execution of a script via SCX RunAsprovider ExecuteScript
|
2021-09-18 03:50:37 -04:00 |
|
Florian Roth
|
260578dceb
|
fix: wrong modified field
|
2021-09-17 14:29:19 +02:00 |
|
Roberto Rodriguez
|
c17104b2eb
|
updated level to high
|
2021-09-17 04:30:17 -04:00 |
|
Roberto Rodriguez
|
7618cf4672
|
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell
|
2021-09-17 04:23:11 -04:00 |
|
frack113
|
33a51df46a
|
Update lnx_system_info_discovery.yml
|
2021-09-14 21:03:46 +02:00 |
|
frack113
|
a6da209507
|
Update lnx_auditd_system_info_discovery2.yml
|
2021-09-14 21:02:51 +02:00 |
|
frack113
|
a3477893de
|
Update lnx_auditd_network_service_scanning.yml
|
2021-09-14 21:02:13 +02:00 |
|
frack113
|
83531bb2ff
|
split global lnx_system_info_discovery.yml
|
2021-09-14 20:13:57 +02:00 |
|
frack113
|
38c0f83eaf
|
split global lnx_sudo_cve_2019_14287.yml
|
2021-09-14 20:07:13 +02:00 |
|
frack113
|
87e5fc48fa
|
split global lnx_security_tools_disabling.yml
|
2021-09-14 19:32:58 +02:00 |
|
frack113
|
ecefc6e913
|
add missing product
|
2021-09-14 19:29:49 +02:00 |
|
frack113
|
bc69900335
|
split global lnx_network_service_scanning.yml
|
2021-09-14 19:27:28 +02:00 |
|
frack113
|
30955c4884
|
split global lnx_auditd_cve_2021_3156_sudo_buffer_overflow.yml
|
2021-09-14 19:24:11 +02:00 |
|
frack113
|
1e4484bffb
|
split lnx_auditd_cve_2021_3156_sudo_buffer_overflow
|
2021-09-14 19:22:56 +02:00 |
|
frack113
|
7298225cbe
|
Merge pull request #2028 from zakibro/master
New Rule - Linux - Auditd - Screen Capture with xwd
|
2021-09-14 09:58:11 +02:00 |
|
zakibro
|
e47a7d9826
|
Update lnx_auditd_screencaputre_xwd.yml
|
2021-09-13 19:08:23 +02:00 |
|
Pawel Mazur
|
a8f9617ccd
|
New Rule - Linux - Auditd - Screen Capture with xwd
|
2021-09-13 18:56:33 +02:00 |
|
frack113
|
dc5c26ad2d
|
Merge pull request #2018 from zakibro/master
New Linux Auditd Rules - Steghide Steganography
|
2021-09-12 08:29:56 +02:00 |
|
zakibro
|
6412ddaaee
|
Update lnx_auditd_steghide_extract_steganography.yml
|
2021-09-11 11:19:21 +02:00 |
|
zakibro
|
d0741f9f3a
|
Update lnx_auditd_steghide_embed_steganography.yml
Formatting and detection changes
|
2021-09-11 11:18:08 +02:00 |
|
Pawel Mazur
|
89f15c01f9
|
New Linux Auditd Rules - Steghide Steganography
|
2021-09-11 10:56:17 +02:00 |
|
frack113
|
4a03ef6e0b
|
Merge pull request #2007 from zakibro/master
New Rule - Linux Auditd Hidden Files - Steganography
|
2021-09-10 09:18:28 +02:00 |
|
zakibro
|
a4dffc14d4
|
Update lnx_auditd_unzip_hidden_zip_files_steganography.yml
Fixing formatting
|
2021-09-10 07:54:56 +02:00 |
|
zakibro
|
0b5e8cb980
|
Update lnx_auditd_hidden_zip_files_steganography.yml
Formatting changes
|
2021-09-10 07:52:35 +02:00 |
|
Pawel Mazur
|
5a5769cce6
|
New Rule - Linux - Steganography Unzip Hidden Information From Picture File
|
2021-09-09 20:38:25 +02:00 |
|
zakibro
|
3fbe5478c3
|
Update and rename lnx_auditd_hidden_files_steganography.yml to lnx_auditd_hidden_zip_files_steganography.yml
Splitting the rule into separate rules
|
2021-09-09 20:34:20 +02:00 |
|
zakibro
|
458973af81
|
Update lnx_auditd_hidden_files_steganography.yml
Adding missing field: action
|
2021-09-09 16:52:58 +02:00 |
|
zakibro
|
62db796fc2
|
Update lnx_auditd_hidden_files_steganography.yml
Formatting changes
|
2021-09-09 16:46:41 +02:00 |
|
zakibro
|
0971fe1d49
|
Update lnx_auditd_hidden_files_steganography.yml
Fixing the listing issue
|
2021-09-09 16:27:57 +02:00 |
|
Pawel Mazur
|
41458d8a5a
|
New Rule - Linux Auditd Hidden Files - Steganography
|
2021-09-09 16:13:27 +02:00 |
|
frack113
|
4c3f8821c4
|
add missing tags
|
2021-09-07 18:16:46 +02:00 |
|
zakibro
|
bba66ca762
|
Update lnx_auditd_hidden_files_directories.yml
Updating arguments section
|
2021-09-07 07:57:50 +02:00 |
|
zakibro
|
e9fa5bde2b
|
Update lnx_auditd_hidden_files_directories.yml
Correction of tag
|
2021-09-06 18:55:58 +02:00 |
|
Pawel Mazur
|
7c2895c73f
|
New Rule - Linux Hidden Files and Directories
|
2021-09-06 18:43:49 +02:00 |
|
Pawel Mazur
|
59eb7ce032
|
Merge branch 'master' of https://github.com/zakibro/sigma
|
2021-09-06 18:41:19 +02:00 |
|
Pawel Mazur
|
9f5f25e480
|
New Rule - Linux Hidden Files and Directories
|
2021-09-06 18:40:39 +02:00 |
|
zakibro
|
f52860d6ab
|
Merge branch 'SigmaHQ:master' into master
|
2021-09-06 18:40:02 +02:00 |
|
Pawel Mazur
|
3eb354e34c
|
Merge branch 'master' of https://github.com/zakibro/sigma
|
2021-09-06 18:37:45 +02:00 |
|
Pawel Mazur
|
ef3efd8fd3
|
New Rule Linux - Hidden Files and Directories
|
2021-09-06 18:37:02 +02:00 |
|
Florian Roth
|
6b2bacd2cc
|
Merge pull request #1979 from frack113/test_global
Change ID in global action rule
|
2021-09-06 08:44:14 +02:00 |
|
zakibro
|
5042ba65ac
|
Update lnx_auditd_audio_capture.yml
Added more references about arecord.
|
2021-09-05 09:28:53 +02:00 |
|