Roberto Rodriguez
87ce07088f
Update sysmon_plugx_susp_exe_locations.yml
...
Duplicate rule title: https://github.com/Neo23x0/sigma/search?q=Executable+used+by+PlugX+in+Uncommon+Location&unscoped_q=Executable+used+by+PlugX+in+Uncommon+Location
This impats Elastalert integration since you cannot have two rules with the same name
2018-12-05 07:58:13 +03:00
Roberto Rodriguez
bff7ec52db
Update av_relevant_files.yml
...
Duplicate rule title: https://github.com/Neo23x0/sigma/search?q=Antivirus+Exploitation+Framework+Detection&unscoped_q=Antivirus+Exploitation+Framework+Detection
This affetcs Elastalert integration
2018-12-05 07:53:53 +03:00
Roberto Rodriguez
104ee6c33b
Update win_susp_commands_recon_activity.yml
...
Rule missing "by CommandLine" which marchs the query_key value of the elastalert format to NULL.
2018-12-05 05:55:36 +03:00
Roberto Rodriguez
328762ed67
Update powershell_xor_commandline.yml
...
Ducplicate names again for https://github.com/Neo23x0/sigma/search?q=Suspicious+Encoded+PowerShell+Command+Line&unscoped_q=Suspicious+Encoded+PowerShell+Command+Line . This brakes elastalert integration since each rule needs to have its own unique name.
2018-12-05 05:51:41 +03:00
Roberto Rodriguez
6dc36c8749
Update win_eventlog_cleared.yml
...
Experimental Rule is a duplicate of bfc7012043/rules/windows/builtin/win_susp_eventlog_cleared.yml
2018-12-05 05:40:00 +03:00
Roberto Rodriguez
c8990962d2
Update win_rare_service_installs.yml
...
same count() by ServiceFileName < 5 aded to make sigmac work with elastalert integration
2018-12-05 05:33:56 +03:00
Roberto Rodriguez
f0b23af10d
Update win_rare_schtasks_creations.yml
...
Count(taskName) not being taken by elastalert integration with Sigmac
2018-12-05 05:10:08 +03:00
Thomas Patzke
f9d9d653dc
Merge pull request #199 from sisecbe/patch-1
...
Distinct count in aggragation function
2018-12-04 23:42:16 +01:00
Thomas Patzke
3288f6425b
Merge branch 'SherifEldeeb-master'
2018-12-04 23:38:02 +01:00
Thomas Patzke
900db72557
Merge branch 'master' of https://github.com/SherifEldeeb/sigma into SherifEldeeb-master
2018-12-04 23:35:23 +01:00
Florian Roth
3861dd5912
Rule: APT29 campaign against US think tanks
...
https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/
2018-12-04 17:04:03 +01:00
Florian Roth
2bf0170956
Merge pull request #202 from tuckner/master
...
Fixed backslash escape
2018-12-03 22:22:53 +01:00
tuckner
2c5c92ab0a
fixed backslash escape
2018-12-03 15:09:29 -06:00
Florian Roth
a805d18bba
Merge pull request #198 from kpolley/consistent_filetype
...
changed .yaml files to .yml for consistency
2018-12-03 09:00:14 +01:00
Florian Roth
7e05b2546a
Merge pull request #201 from 41thexplorer/master
...
Adding new rules detecting recently active APTs
2018-12-03 08:59:46 +01:00
AL
9f1df6164b
adding new rules detecting recently active APTs
2018-12-03 09:42:29 +02:00
Florian Roth
2ebbdebe46
rule: Cobalt Strike beacon detection via Remote Threat Creation
...
https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f
2018-11-30 10:25:05 +01:00
Thomas Patzke
e502550d76
Merge branch 'lsoumille-master'
2018-11-29 00:03:12 +01:00
Thomas Patzke
f6ad36f530
Fixed rule
2018-11-29 00:00:18 +01:00
Thomas Patzke
1118b80288
Added elastalert backend to CI testing
2018-11-29 00:00:00 +01:00
Thomas Patzke
0a5caae5df
Merge branch 'master' of https://github.com/lsoumille/sigma into lsoumille-master
2018-11-28 23:53:15 +01:00
Florian Roth
99e0a4defb
fix: SPARK config duplicate identifier
2018-11-27 14:05:13 +01:00
lsoumille
50c74b94bc
add elastalert backend support
2018-11-23 20:39:15 +01:00
sisecbe
c848c473a3
Error when empty fields attribute
2018-11-23 15:37:42 +01:00
sisecbe
31eae25756
Indentation error
2018-11-23 15:20:17 +01:00
sisecbe
e43909678e
Added the fields attribute parser
...
Make a table with the fields present in the fields attribute
2018-11-23 15:11:12 +01:00
sisecbe
c2eb87133d
Distinct count in aggragation function
...
Added dc() instead of count() when group-by field is present. Because count() doesn't do a distinct count in Splunk. Must be the dc() function instead.
2018-11-23 15:04:08 +01:00
Florian Roth
7ba1fe4309
Turla PNG Dropper Service Name
2018-11-23 08:46:20 +01:00
Florian Roth
e7762c71ce
Merge remote-tracking branch 'origin/master'
2018-11-22 19:14:12 +01:00
Florian Roth
ec83ab5e13
APT28 Zebrocy rule
...
https://app.any.run/tasks/54acca9a-394e-4384-a0c8-91a96d36c81d
2018-11-22 19:14:07 +01:00
Thomas Patzke
aa1a953a65
Moved node dumping code to generic location
2018-11-21 23:22:38 +01:00
Thomas Patzke
26d888aec3
Removed "not null" handling code
...
Feature was removed some time ago.
2018-11-21 22:56:48 +01:00
Thomas Patzke
a1940c6eaa
Simplified rule
2018-11-21 22:34:04 +01:00
Thomas Patzke
9e28669c33
Backend es-qs return quotes on empty or whitespace-only string
2018-11-21 22:29:12 +01:00
Kyle Polley
60538e2e12
changed .yaml files to .yml for consistency
2018-11-20 21:07:36 -08:00
Thomas Patzke
49d464f979
Fixed wildcards in es-qs backend
2018-11-20 23:23:54 +01:00
Florian Roth
a31acd6571
fix: fixed procdump rule
2018-11-17 09:10:26 +01:00
Florian Roth
fd06cde641
Rule: Detect base64 encoded PowerShell shellcode
...
https://twitter.com/cyb3rops/status/1063072865992523776
2018-11-17 09:10:09 +01:00
Sherif Eldeeb
23eddafb39
Replace "logsource: description" with "definition" to match the specs
2018-11-15 09:00:06 +03:00
Sherif Eldeeb
cd5950749e
revert to upstream
2018-11-15 08:45:25 +03:00
Sherif Eldeeb
742192b452
Merge pull request #4 from Neo23x0/master
...
fetch updates from upstream
2018-11-15 08:32:33 +03:00
Florian Roth
b92c032c2d
Linux JexBoss back connect shell
2018-11-08 23:21:36 +01:00
Florian Roth
fc7a750f0f
Added RSA NetWitness to the supported targets
2018-11-07 22:56:51 +01:00
Thomas Patzke
102b56dfe3
Merge branch 'tuckner-master'
2018-11-07 22:53:15 +01:00
Thomas Patzke
396a030ed1
Removed duplicate code
2018-11-07 22:52:12 +01:00
Thomas Patzke
6b8ddd6ac0
Added CI test for NetWitness backend
2018-11-07 22:36:34 +01:00
Thomas Patzke
116a0e9f03
Merge branch 'master' of https://github.com/tuckner/sigma into tuckner-master
2018-11-07 22:27:41 +01:00
Thomas Patzke
fe79be894b
Merge branch 'master' of https://github.com/Neo23x0/sigma
2018-11-07 14:01:21 +01:00
Thomas Patzke
5053cc4e95
Fixed optimizing of not conditions with subexpressions
...
Optimization pass traversal is cut at ConditionNOT nodes.
2018-11-07 13:54:45 +01:00
Thomas Patzke
a88b1e81ec
Optimizer debugging code cleanup
...
* Removed commented debugging code
* Output to stdin
* Coverage exception for _dumpNode
2018-11-07 13:49:08 +01:00
