Florian Roth
|
8aabb58eca
|
Merge pull request #1498 from w0rk3r/otrf
Update broken OTRF Threat Hunter Playbook References
|
2021-05-26 13:06:16 +02:00 |
|
frack113
|
3717c68bb7
|
fix typo of level
|
2021-05-24 10:45:58 +02:00 |
|
Jonhnathan
|
687f2d67fc
|
Update Threat Hunter Playbook Reference
|
2021-05-22 01:09:30 -03:00 |
|
frack113
|
70a5c8bb5f
|
registry_event is a category
|
2021-05-12 08:51:38 +02:00 |
|
frack113
|
026320f613
|
registry_event is a category
|
2021-05-12 08:36:42 +02:00 |
|
phantinuss
|
da533c7425
|
fixed title capitalization
|
2021-05-05 15:22:09 +02:00 |
|
phantinuss
|
254a3bb122
|
new rules detecting the creation of a local hidden user
|
2021-05-05 15:12:07 +02:00 |
|
Florian Roth
|
0e9176776d
|
refactor: moved rule
|
2021-05-05 12:11:59 +02:00 |
|
SomeOne
|
4aae26cabd
|
Grouping filters
|
2021-05-01 21:05:34 +02:00 |
|
SomeOne
|
80dc6aaf59
|
Add FP and fix filters
|
2021-05-01 20:54:26 +02:00 |
|
Florian Roth
|
d24f0b8988
|
feat: generic registry events compatible with native audit logging
|
2021-04-26 09:31:36 +02:00 |
|
Florian Roth
|
c7ce9154d1
|
Merge pull request #1030 from stevengoossensB/master
Updated sysmon config and rewrite rules to use categories
|
2021-04-23 16:52:25 +02:00 |
|
Steven
|
d263b937b4
|
Clean-up service: sysmon as it will be replaced by filling the category
|
2021-04-15 02:02:25 +02:00 |
|
Steven
|
7b679cc1f7
|
- Modified rules to use categories instead of hardcoded event IDs
- Added file_delete category (Sysmon Event ID 23) to the generic translation file
|
2021-04-15 01:40:31 +02:00 |
|
Roberto Rodriguez
|
db0e969121
|
HybridConnectionMgr Service Activity
|
2021-04-12 16:26:15 -04:00 |
|
Thomas Patzke
|
3fef2a10b8
|
Merge branch 'pr-1158'
|
2021-04-08 23:01:54 +02:00 |
|
Thomas Patzke
|
a10db2df89
|
Fixes&improvements
|
2021-04-08 01:06:40 +02:00 |
|
Thomas Patzke
|
90efe974b8
|
Fixes and improvements
|
2021-04-03 00:08:55 +02:00 |
|
Anton Kutepov
|
d7ef865bb9
|
Merge remote-tracking branch 'upstream/master' and fix conflicts
|
2021-03-07 23:36:13 +03:00 |
|
Florian Roth
|
2b5f9f994f
|
Merge pull request #1376 from SigmaHQ/rule-devel
UNC2452 rules - GoldMax, GoldFinder, Sibot
|
2021-03-05 18:17:20 +01:00 |
|
Florian Roth
|
b864768de8
|
fix: wrong conditions
|
2021-03-05 11:55:49 +01:00 |
|
Florian Roth
|
c3b84f2d5b
|
UNC2452 rules - GoldMax, Sibot, GoldFinder
https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
|
2021-03-05 11:54:35 +01:00 |
|
Anton Kutepov
|
3f45269296
|
Merge branch 'oscd'
B
B
B
B
A
|
2021-03-02 22:58:41 +03:00 |
|
Florian Roth
|
b65dbee01f
|
Merge pull request #1366 from Neo23x0/rule-devel
rule: SilentProcessExit monitors
|
2021-02-26 18:09:44 +01:00 |
|
Florian Roth
|
ba7c7409a3
|
fix: typo in modified
|
2021-02-26 17:48:50 +01:00 |
|
Florian Roth
|
79acbbef9f
|
rule: SilentProcessExit monitors
|
2021-02-26 17:35:42 +01:00 |
|
jaegeral
|
e1f43f17c2
|
fixed various spelling errors all over rules and source code
|
2021-02-24 14:43:13 +00:00 |
|
Bhabesh Rai
|
93c7931037
|
Added Stealthy Office Persistence via VSTO
|
2021-01-10 17:54:17 +05:45 |
|
yugoslavskiy
|
29fe6e46d8
|
Merge pull request #1211 from zipa-original/win_persistence_telemetry
[OSCD] Added a rule to detect abusing windows telemetry for persistence
|
2021-01-06 00:20:51 +03:00 |
|
yugoslavskiy
|
6f2e8c56b2
|
Merge pull request #1182 from nsaddler/lolbas80
[OSCD] LOLBAS wab.yml
|
2021-01-06 00:16:53 +03:00 |
|
yugoslavskiy
|
46eb01f3c5
|
Merge pull request #1164 from GlebSukhodolskiy/oscd_reg
[OSCD] Modified Rule "Autorun Keys Modification"
|
2021-01-06 00:11:58 +03:00 |
|
yugoslavskiy
|
319ebd158c
|
Merge pull request #1155 from sn0w0tter/oscd2
[OSCD] LOLBAS atbroker suspicious creation of ATs
|
2021-01-06 00:11:13 +03:00 |
|
yugoslavskiy
|
39991a8ab6
|
Merge pull request #1106 from stvetro/2020
[OSCD] Suspicious ftp.exe usage (LOLBin)
|
2021-01-05 23:13:03 +03:00 |
|
yugoslavskiy
|
c7e9522f29
|
Merge pull request #1077 from uchakin/oscd
[OSCD] UAC bypass added
|
2021-01-05 23:06:24 +03:00 |
|
yugoslavskiy
|
87e5e5a7fc
|
Merge pull request #1069 from nsaddler/oscd3
[OSCD] Powershell Script Installed as a Service Rule added
|
2021-01-05 22:58:21 +03:00 |
|
Florian Roth
|
40e0e3bc99
|
Merge pull request #1193 from w0rk3r/oscd_rules_improvement
[OSCD] Windows Rules - Review for improvements on selections and logic
|
2020-12-31 12:10:15 +01:00 |
|
Daniel Masse
|
d2edf715f2
|
Split up cmstp rule into 3 separate rules and remove duplicates
|
2020-12-23 12:17:39 -05:00 |
|
Florian Roth
|
f20f346a6a
|
Merge pull request #1264 from omkar72/sdev-1
Adding 2 rules - Conhost & office test registry persistence
|
2020-12-21 18:28:59 +01:00 |
|
Florian Roth
|
e78d7e6aee
|
Merge pull request #1296 from mat-gas/fix-references
fix "references" field + add test for references in plural form
|
2020-12-21 18:25:35 +01:00 |
|
OG
|
70fb078a56
|
Update sysmon_office_test_regadd.yml
|
2020-11-29 18:02:37 +05:30 |
|
Jonhnathan
|
a9fde0117b
|
Merge branch 'oscd' into oscd_rules_improvement
|
2020-11-28 14:52:31 -03:00 |
|
yugoslavskiy
|
5196926d60
|
Update sysmon_stickykey_like_backdoor.yml
|
2020-11-28 18:33:21 +01:00 |
|
yugoslavskiy
|
39c2258848
|
Update sysmon_registry_persistence_search_order.yml
|
2020-11-28 18:30:41 +01:00 |
|
Jonhnathan
|
95eb7424aa
|
Update sysmon_susp_run_key_img_folder.yml
|
2020-11-28 13:54:59 -03:00 |
|
Jonhnathan
|
f504ccc33f
|
Update sysmon_susp_reg_persist_explorer_run.yml
|
2020-11-28 13:52:36 -03:00 |
|
Jonhnathan
|
986800056c
|
Update sysmon_stickykey_like_backdoor.yml
|
2020-11-28 13:50:13 -03:00 |
|
Jonhnathan
|
ef34c94e6a
|
Update sysmon_registry_persistence_search_order.yml
|
2020-11-28 13:49:18 -03:00 |
|
Jonhnathan
|
06cc5049a4
|
Update sysmon_dns_serverlevelplugindll.yml
|
2020-11-28 13:46:02 -03:00 |
|
mat
|
b3e36281b5
|
fix reference field + add test for references in plural form
|
2020-11-27 10:17:45 +01:00 |
|
Jonhnathan
|
2ba146be07
|
Remove additional backlash
|
2020-11-20 02:03:06 -03:00 |
|