7645 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Pawel Mazur	864286e206	New Rule - Linux-Auditd-System Information Discovery	2021-09-03 11:33:18 +02:00
frack113	b731c20594	Merge pull request #1971 from phantinuss/master ... fix: prevent possible FPs	2021-09-02 15:34:46 +02:00
frack113	a048403089	Merge pull request #1973 from klingerko/cs_namedpipe_updates ... Remove duplicate and regex improvements	2021-09-02 15:25:01 +02:00
phantinuss	ab721c736c	chore: move level/falsepositives to bottom	2021-09-02 14:55:17 +02:00
klingerko	15e25f9635	update modifed date	2021-09-02 14:50:14 +02:00
phantinuss	0b373ff1e9	fix: remove 2nd selection due to FPs	2021-09-02 14:47:47 +02:00
phantinuss	5cb6eed52e	fix: remove single value lists	2021-09-02 14:09:03 +02:00
phantinuss	f4a5df67ae	further narrowing down of the selection, therefore removing the filter	2021-09-02 10:28:01 +02:00
Florian Roth	0603581111	Merge pull request #1969 from SigmaHQ/rule-devel ... More Named Pipe Rules and WMI rule refactoring	2021-09-02 10:15:00 +02:00
frack113	5212b388c6	Merge pull request #1967 from d4rk-d4nph3/master ... Added rule for detection of Atera RMM Agent installation	2021-09-02 09:19:49 +02:00
Thomas Patzke	51bc036dbf	Merge pull request #1921 from roysjosh/azure-sentinel-arm-output ... Azure Sentinel support	2021-09-01 22:26:42 +02:00
Thomas Patzke	3d6ad1bc0f	Merge pull request #1944 from ncrqnt/elastic-subtechniques ... [Elastic] Add support for authors and subtechniques	2021-09-01 22:25:10 +02:00
Thomas Patzke	6d3f7069e6	Merge pull request #1962 from neu5ron/qoutes_and_wildcards ... Elasticsearch Backend fix small corner cases of quotes and wildcards	2021-09-01 22:08:40 +02:00
Konstantin Klinger	457da818a4	regex optimisations	2021-09-01 17:06:55 +02:00
Konstantin Klinger	e83ee55573	remove duplicate	2021-09-01 17:05:36 +02:00
Florian Roth	b0c2d7b75a	fix: tags for WMI / execution / persistence	2021-09-01 16:34:50 +02:00
Florian Roth	2f7f050ad8	fix: removed tags	2021-09-01 16:32:27 +02:00
phantinuss	0b38237dbf	fix: add relation to now obsolete rule	2021-09-01 15:38:29 +02:00
phantinuss	ae9966bdcc	fix: unifying two overlapping rules	2021-09-01 14:48:32 +02:00
phantinuss	deefcaa8ac	fix: prevent possible FPs with the respective command only used as the last parameter	2021-09-01 14:33:46 +02:00
frack113	434c3891ff	Merge pull request #1965 from frack113/add_tags ... Add tags when missing	2021-09-01 14:07:31 +02:00
Florian Roth	1aac21ba79	fix: single list item issue	2021-09-01 14:03:42 +02:00
Florian Roth	1c4f642227	Merge pull request #1699 from matsto/patch-1 ... Fixed transformation modifier for keywords	2021-09-01 14:02:10 +02:00
Florian Roth	505140d273	rule: extended WMI suspicious scripts rule	2021-09-01 13:57:48 +02:00
Florian Roth	e787420be1	rule: WMI filter content encoded executable	2021-09-01 13:57:36 +02:00
Florian Roth	8761927e8c	rule: susp scrcons.exe creating named pipe	2021-09-01 13:57:17 +02:00
Florian Roth	affc929c3b	LiquidSnake named pipe	2021-09-01 13:54:47 +02:00
Florian Roth	c8b3036949	Merge pull request #1968 from SigmaHQ/rule-devel ... docs: note to improved sysmon config	2021-09-01 13:21:28 +02:00
Florian Roth	f102b2d9a1	docs: note to improved sysmon config	2021-09-01 13:07:18 +02:00
Florian Roth	8bba246205	refactor: better way to write it	2021-09-01 12:57:34 +02:00
frack113	2cb5f5e4c6	add missing tags	2021-09-01 12:54:21 +02:00
Florian Roth	c146bc44c7	Merge branch 'master' into patch-1	2021-09-01 12:48:51 +02:00
Bhabesh Rai	6859b6c38f	Added rule for detection of Atera RMM Agent installation	2021-09-01 15:24:47 +05:45
frack113	af599e4877	Merge pull request #1958 from phantinuss/master ... Bulk of new rules, mainly UAC Bypasses	2021-09-01 10:53:02 +02:00
frack113	892c58270a	Update tags	2021-09-01 10:33:57 +02:00
frack113	4b8ffbc183	Update tags	2021-09-01 10:30:43 +02:00
phantinuss	9ffdced740	fix: implement suggestions from PR discussion	2021-09-01 10:21:37 +02:00
frack113	240c5584ff	update tags	2021-09-01 09:56:46 +02:00
frack113	6f3fc7036e	Update tags	2021-09-01 09:45:31 +02:00
frack113	3ed7d6e330	Merge pull request #1959 from frack113/update_ps ... Update PowerShell rules	2021-09-01 08:06:31 +02:00
frack113	b8a1f4c63b	Merge pull request #1961 from SigmaHQ/rule-devel ... SideWalk User-Agent used by Sparkling Goblin	2021-09-01 08:06:15 +02:00
frack113	9671d6c0db	Merge pull request #1960 from austinsonger/sysmon_dns_over_https_enabled.yml ... sysmon_dns_over_https_enabled.yml	2021-08-31 18:37:29 +02:00
neu5ron	414e851108	Merge branch 'master' into qoutes_and_wildcards ... Signed-off-by: neu5ron <neu5ron@users.noreply.github.com>	2021-08-31 12:06:20 -04:00
Florian Roth	9b20060275	SideWalk UA	2021-08-31 17:14:19 +02:00
frack113	cff572b752	Update sysmon_dns_over_https_enabled.yml	2021-08-31 17:11:04 +02:00
phantinuss	add1ad40f8	additional UAC bypass rule	2021-08-31 16:23:32 +02:00
phantinuss	59d8e0b866	add System IntegrityLevel to uac bypass rules, the level is not used most of the time, but might	2021-08-31 16:18:05 +02:00
Austin Songer	9dc8d38565	Create sysmon_dns_over_https_enabled.yml	2021-08-31 09:14:14 -05:00
phantinuss	6eb7245673	fix: remove user sid, match any sid instead	2021-08-31 15:58:57 +02:00
frack113	eb434732a7	move rule not only powershell	2021-08-31 13:48:07 +02:00