4347 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
OG	8e801ede32	Update win_susp_psexec_eula.yml	2020-11-29 17:45:29 +05:30
mat	b3e36281b5	fix reference field + add test for references in plural form	2020-11-27 10:17:45 +01:00
Florian Roth	3d39d49d65	Merge pull request #1295 from findthebad/fix-winlogbeat-config ... Updated winlogbeat.yml config to include OriginalFileName	2020-11-26 23:17:45 +01:00
findthebad	ad899899ab	Updated winlogbeat.yml config to include OriginalFileName	2020-11-26 14:48:14 -05:00
Florian Roth	084cd39505	Merge pull request #1294 from Neo23x0/devel ... Trickbot rules improved	2020-11-26 10:13:35 +01:00
Florian Roth	c6fc9de144	New Trickbot wermgr rule	2020-11-26 09:54:27 +01:00
Florian Roth	c111ab3141	Improved Trickbot recon rule	2020-11-26 09:54:13 +01:00
Florian Roth	b31ed47ccf	Merge branch 'master' into devel	2020-11-26 09:44:56 +01:00
Florian Roth	13354dd7a2	Merge pull request #1293 from hegga/cb-fix-domain-fieldmapping ... Fix field mapping for DestinationHostname	2020-11-26 09:40:28 +01:00
Helge Aksdal	3a7c114ca3	Fix field mapping for DestinationHostname	2020-11-26 04:17:28 +01:00
bczyz1	05398ae95e	change field newprocessname -> image	2020-11-23 13:43:19 +01:00
toffeebr33k	c8c4183678	Update aws_enum_listing.yml	2020-11-22 01:53:58 +08:00
toffeebr33k	3d0e1988c6	Update aws_enum_listing.yml	2020-11-22 01:41:20 +08:00
toffeebr33k	273590b151	Update aws_enum_listing.yml	2020-11-22 01:17:42 +08:00
toffeebr33k	52fca0fe3a	Update aws_enum_listing.yml	2020-11-22 01:05:56 +08:00
toffeebr33k	e764ca687a	Update aws_enum_listing.yml	2020-11-22 00:50:34 +08:00
toffeebr33k	00504ee186	Update aws_update_login_profile.yml	2020-11-22 00:42:25 +08:00
toffeebr33k	3dd1525b98	Update aws_update_login_profile.yml	2020-11-22 00:38:41 +08:00
toffeebr33k	6b65180464	Add files via upload	2020-11-22 00:33:47 +08:00
toffeebr33k	cff82ff79a	Delete aws_update_login_profile.yml	2020-11-22 00:33:17 +08:00
toffeebr33k	7e1c918b4d	Delete aws_enum_listing.yml	2020-11-22 00:32:59 +08:00
toffeebr33k	551764b630	Add files via upload	2020-11-22 00:26:17 +08:00
toffeebr33k	3dd25ddea4	Delete aws_update_login_profile.yml	2020-11-22 00:25:54 +08:00
toffeebr33k	fba9c12bb2	Delete aws_enum_listing.yml	2020-11-22 00:25:29 +08:00
toffeebr33k	6c1f3f5969	Update aws_update_login_profile.yml	2020-11-21 23:45:10 +08:00
toffeebr33k	70e725e82e	Update aws_enum_listing.yml	2020-11-21 23:44:14 +08:00
toffeebr33k	596d1b6e4c	Update aws_update_login_profile.yml	2020-11-21 23:29:49 +08:00
toffeebr33k	a786ebd04b	Update aws_enum_listing.yml	2020-11-21 23:28:57 +08:00
toffeebr33k	1ca903b168	Update aws_enum_listing.yml	2020-11-21 23:22:07 +08:00
toffeebr33k	7f61591865	Add files via upload	2020-11-21 23:12:50 +08:00
Thomas Patzke	0ed54a6cae	Merge pull request #1290 from arollyson/helix_backend ... Backend: FireEye Helix	2020-11-21 00:06:19 +01:00
Lionel	7ca368d1ed	fix issue 1285 ... https://github.com/Neo23x0/sigma/issues/1285	2020-11-20 16:42:20 +01:00
bczyz1	193021eff8	Update win_apt_slingshot.yml ... fix condition	2020-11-20 09:19:03 +01:00
Alek Rollyson	83b8af6cd2	Add FirEye Helix backend	2020-11-19 11:18:28 -05:00
weslambert	832e582b8d	Fix typo	2020-11-17 17:44:40 -05:00
Tiago Faria	93b06d5425	add SIEGMA and S2AN	2020-11-17 22:36:47 +00:00
Florian Roth	7566f19635	Merge pull request #1267 from w0rk3r/ecs-1 ... Suricata ECS	2020-11-17 15:05:47 +01:00
Florian Roth	9944c0e563	Merge branch 'master' into pr/1267	2020-11-17 14:33:55 +01:00
Florian Roth	1540241106	Merge branch 'master' of https://github.com/Neo23x0/sigma	2020-11-17 14:29:42 +01:00
Florian Roth	88e3de816d	docs: uberAgent ESA target in README	2020-11-17 14:29:36 +01:00
Florian Roth	c5c6557ca2	Merge pull request #1256 from vastlimits/master ... Backend: uberAgent ESA converter backend	2020-11-17 14:29:01 +01:00
Florian Roth	94540ea0b6	Merge pull request #1284 from heyibrahimkhan/master ... added role name field to ecs-cloudtrail.	2020-11-17 14:24:40 +01:00
heyibrahimkhan@gmail.com	eed4fe04d5	added role name field to ecs-cloudtrail.	2020-11-13 05:59:55 +05:00
Simen Lybekk	c0a7cdc3de	mdatp: Use case-insensitive searches by default ... This sohuld match the draft Sigma specification as well as other backends	2020-11-12 14:09:30 +01:00
Simen Lybekk	a75d4fb561	mdatp: Add more field mappings and table<->generic event mappings, skip IMPHASH as it's not supported	2020-11-12 13:15:38 +01:00
Sven Scharmentke	446b0b7f9d	Merge branch 'master_origin'	2020-11-11 12:32:53 +01:00
Sven Scharmentke	a58d04e4df	Rules: Support image_load	2020-11-11 12:31:55 +01:00
Thomas Patzke	43b9b17767	Merge pull request #1281 from andurin/kibana-ndjson-configs ... kibana-ndjson for all configs which already have kibana	2020-11-11 07:34:37 +01:00
Florian Roth	af4d546408	Merge pull request #1282 from Neo23x0/rule-devel ... fix: FPs with notepad++ GUP rule	2020-11-10 13:39:28 +01:00
Florian Roth	2e9d7951a6	Merge pull request #1272 from bczyz1/patch-2 ... Fix typo in win_apt_lazarus_session_hijack.yml	2020-11-10 13:35:08 +01:00