3522 Commits

Author	SHA1	Message	Date
WojciechLesicki	8b707bc948	Added also \status_ pipe.	2021-05-25 21:58:22 +02:00
WojciechLesicki	f1a0308e73	Add one more pipe, references etc.	2021-05-25 21:07:23 +02:00
WojciechLesicki	38552e98cf	Adding some pipes	2021-05-25 15:47:34 +02:00
frack113	3717c68bb7	fix typo of level	2021-05-24 10:45:58 +02:00
frack113	104a004b3d	fix typo of tags	2021-05-24 10:41:17 +02:00
frack113	afb3d63900	fix typo of fields	2021-05-24 10:37:14 +02:00
frack113	1fcd0bf951	fix typo of fields	2021-05-24 10:34:56 +02:00
Florian Roth	576e047e76	Delete win_susp_Register_cimprovider.yml	2021-05-22 15:43:41 +02:00
Florian Roth	4c281d117c	fix: bug in rule syntax	2021-05-22 15:31:23 +02:00
Florian Roth	9b7fb0c0f3	Update win_susp_shell_spawn_from_winrm.yml	2021-05-22 15:28:50 +02:00
Florian Roth	7e1ac347ef	Merge branch 'master' into rule-devel	2021-05-22 15:27:32 +02:00
Florian Roth	c0d58cb7f9	PAExec and PSexec rules	2021-05-22 10:52:01 +02:00
Florian Roth	a0efd7a4dc	Merge pull request #1494 from Karneades/patch-1 ... Add keyword WinRM to remote powershell rules	2021-05-21 10:35:18 +02:00
Andreas Hunkeler	e58c59dcfd	Update modified field in WinRM rule	2021-05-21 09:29:11 +02:00
Andreas Hunkeler	d8ec5fa6af	Add modified field in WinRM rule	2021-05-21 09:28:45 +02:00
Florian Roth	a30391f3b4	Merge pull request #1495 from SigmaHQ/rule-devel ... rule refactoring: Cobalt Strike service start	2021-05-20 17:43:29 +02:00
Andreas Hunkeler	93241e7fc6	Add keyword WinRM to remote powershell process rule	2021-05-20 17:03:32 +02:00
Andreas Hunkeler	b46f65965d	Add keyword WinRM to remote powershell network rule	2021-05-20 17:02:17 +02:00
Andreas Hunkeler	3763e54b99	Add keyword WinRM to remote powershell process rule	2021-05-20 17:00:25 +02:00
Andreas Hunkeler	226a666827	rule: add rule to detect shell spawn from WinRM host process	2021-05-20 16:05:13 +02:00
Florian Roth	ebac8a098f	rule refactoring: Cobalt Strike service start	2021-05-20 10:05:12 +02:00
Florian Roth	5a3af872d8	Merge pull request #1479 from SigmaHQ/rule-devel ... Rule devel, Trademark test	2021-05-15 13:42:34 +02:00
Florian Roth	9b32e72d0b	fix: syntax issue	2021-05-15 13:19:12 +02:00
Florian Roth	02bf32ce6c	fixed more legal issues	2021-05-15 13:09:08 +02:00
Florian Roth	48757423ef	rule darkside patterns	2021-05-14 18:06:53 +02:00
Florian Roth	a655c5c1a0	update ngrok rule	2021-05-14 17:44:53 +02:00
Florian Roth	e4a1ce4498	rule: ngrok rdp port exposure	2021-05-14 17:34:52 +02:00
Florian Roth	30bee7204c	Merge pull request #1475 from wagga40/master ... Modified some field values for case sensitive backends (SQL)	2021-05-14 08:59:39 +02:00
Florian Roth	83068416fa	Merge pull request #1458 from P4rtyH4RD/P4rtyH4RD-patch-1-mitre-code ... Update powershell_suspicious_getprocess_lsass.yml	2021-05-14 08:59:14 +02:00
wagga40	8944ccea04	Modified some field values for case sensitive backends (SQL)	2021-05-13 06:19:04 +02:00
frack113	cccfb3e59e	file_event is a category	2021-05-12 09:05:52 +02:00
frack113	0fd8606e00	image_load is a category	2021-05-12 09:02:04 +02:00
frack113	fa72242ff0	image_load is a category	2021-05-12 08:59:51 +02:00
frack113	ecc0fcb082	process_creation is a category	2021-05-12 08:57:57 +02:00
frack113	cf0a710b4d	process_creation is a category	2021-05-12 08:55:35 +02:00
frack113	70a5c8bb5f	registry_event is a category	2021-05-12 08:51:38 +02:00
frack113	026320f613	registry_event is a category	2021-05-12 08:36:42 +02:00
Florian Roth	7d7f8c90ec	Merge pull request #1443 from icthieves/patch-3 ... Update win_scm_database_privileged_operation.yml	2021-05-11 15:00:20 +02:00
Florian Roth	980ea97217	Merge pull request #1444 from icthieves/patch-2 ... Update win_scm_database_handle_failure.yml	2021-05-11 15:00:09 +02:00
Florian Roth	7bc733a3cf	Merge pull request #1473 from frack113/master ... Correct the sysmon case-sensitive Key	2021-05-11 14:59:20 +02:00
Florian Roth	0fcbce9932	Merge pull request #1465 from austinsonger/win_susp_certutil_command.yml ... Got Rid of References that are no longer valid.	2021-05-11 14:32:47 +02:00
Florian Roth	85736ad859	Merge pull request #1467 from 2d4d/master ... Update av_webshell.yml	2021-05-11 14:32:11 +02:00
frack113	f07c368ae0	Correct cast-sensitive Key "OriginalFileName"	2021-05-11 11:18:01 +02:00
frack113	c4c720cc30	Correct cast-sensitive Key "OriginalFileName"	2021-05-11 11:16:12 +02:00
frack113	720dd24814	Correct cast-sensitive Key "OriginalFilename"	2021-05-11 11:13:33 +02:00
frack113	a1b0dfc0cd	Correct cast-sensitive Key "DestinationIp"	2021-05-11 10:49:10 +02:00
Florian Roth	67e807983c	Merge pull request #1470 from SigmaHQ/rule-devel ... New CS rule for malformed UAs, FP fixes	2021-05-10 13:40:27 +02:00
Florian Roth	fcb7aa3bcf	fix: FPs with rules	2021-05-10 12:42:59 +02:00
Florian Roth	270aedfd62	Merge pull request #1469 from d4rk-d4nph3/master ... Added rule for RClone usage for exfiltration	2021-05-10 10:50:35 +02:00
Bhabesh Rai	9c8b9756e5	Added rule for RClone usage for exfiltration	2021-05-10 14:06:53 +05:45