Florian Roth
|
b040c129be
|
fix: author field starting with an '@' symbol
|
2020-03-07 10:38:02 +01:00 |
|
Abhijit Khinvasara
|
07b553daa1
|
Merge branch 'master' of github.com:abhikhnvasara/sigma
|
2020-03-04 15:22:17 -08:00 |
|
Abhijit Khinvasara
|
46bc843e51
|
sort the list of backends presented in sigmac help
|
2020-03-04 15:21:28 -08:00 |
|
Abhijit Khinvasara
|
6a1f97b69e
|
Merge branch 'master' of github.com:abhikhnvasara/sigma
|
2020-03-04 15:11:18 -08:00 |
|
Abhijit Khinvasara
|
9cb395823c
|
Rework according to review comments.
|
2020-03-04 14:54:49 -08:00 |
|
2XXE (SRA)
|
ae56db97ff
|
mmc lateral movement detection 1
see https://github.com/Neo23x0/sigma/issues/576
|
2020-03-04 14:57:41 -05:00 |
|
Florian Roth
|
02d256b3b6
|
Merge pull request #651 from EccoTheFlintstone/fix_sysmon_registry
fix sysmon registry rules with HKLM/HKU format as used since 02/2017 in sysmon
|
2020-03-04 20:25:11 +01:00 |
|
ecco
|
b9e4734087
|
fix sysmon registry rules with HKLM/HKU format as used since 02/2017 in sysmon
|
2020-03-04 12:47:42 -05:00 |
|
Florian Roth
|
6bbb166f3d
|
rule: extended webshell rule with tomcat.exe
|
2020-03-04 14:25:57 +01:00 |
|
Florian Roth
|
53278c2a46
|
Merge pull request #649 from Neo23x0/devel
fix: avoiding FPs with Citrix software
|
2020-03-03 11:35:02 +01:00 |
|
Florian Roth
|
f98ad7a8df
|
fix: wrong identifier
|
2020-03-03 11:25:02 +01:00 |
|
Florian Roth
|
be4242aca8
|
fix avoiding FPs with MpCmdRun
ParentImage: C:\Windows\System32\services.exe
CommandLine: C:\Program Files\Microsoft Security Client\\MpCmdRun.exe
|
2020-03-03 11:16:59 +01:00 |
|
Florian Roth
|
7139bfb0cb
|
fix: avoiding FPs with Citrix software
writing C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_r23phtye.jsp.ps1
|
2020-03-03 11:01:42 +01:00 |
|
vunx2
|
b070ffab74
|
Merge branch 'master' of https://github.com/Neo23x0/sigma
|
2020-03-03 10:08:31 +07:00 |
|
Remco Hofman
|
d4b5dd5749
|
Exclude Azure AD sync accounts from AD Replication rule
|
2020-03-02 16:43:20 +01:00 |
|
Thomas Patzke
|
b63889af75
|
Fixed rules that likely will cause false negatives by fix
|
2020-03-01 23:14:53 +01:00 |
|
Thomas Patzke
|
01bd5cf0e0
|
Merge branch 'issue-645'
|
2020-03-01 22:41:13 +01:00 |
|
Thomas Patzke
|
0a62b8747e
|
Merge pull request #634 from EccoTheFlintstone/fp_fix3
Rule: restore initial behaviour matching single word with spaces on each side
|
2020-03-01 22:40:24 +01:00 |
|
Thomas Patzke
|
a0f7da8c03
|
Splunk XML backend rule title
Fixes #645
|
2020-03-01 22:23:35 +01:00 |
|
Florian Roth
|
a557c727dd
|
Merge pull request #644 from Neo23x0/devel
Devel
|
2020-02-29 16:17:12 +01:00 |
|
Florian Roth
|
19d383989c
|
fix: keyword expression in rule
|
2020-02-29 16:03:31 +01:00 |
|
Florian Roth
|
15a400ac51
|
fix: fixing bug in rule
|
2020-02-29 15:51:00 +01:00 |
|
Florian Roth
|
fa6458b70f
|
rule: two rules to detect CVE-2020-0688 exploitation
|
2020-02-29 15:45:45 +01:00 |
|
Florian Roth
|
fdcba84fc8
|
fix: escaped backslash
|
2020-02-29 10:12:59 +01:00 |
|
grumo35
|
0d932810b5
|
Update sysmon_cred_dump_tools_dropped_files.yml
Adding sysinternal's procdump utility more about this on : https://en.hackndo.com/remote-lsass-dump-passwords/
|
2020-02-28 15:16:18 +01:00 |
|
vunx2
|
58f5fa1b8e
|
change to github
|
2020-02-28 16:56:48 +07:00 |
|
vunx2
|
139600009b
|
conflict
|
2020-02-28 16:50:30 +07:00 |
|
Florian Roth
|
9e86170d79
|
Merge pull request #641 from NVISO-BE/web_exchange_cve_2020_0688_exploit
CVE 2020-0688 Exploit attempt rule
|
2020-02-27 13:34:05 +01:00 |
|
Remco Hofman
|
4f45e14a56
|
Match on c-uri instead of c-uri-path
|
2020-02-27 13:23:25 +01:00 |
|
Remco Hofman
|
ff35eb0052
|
Title capitalization
|
2020-02-27 12:56:56 +01:00 |
|
Remco Hofman
|
72e34d2aa5
|
CVE 2020-0688 Exploit attempt rule
|
2020-02-27 12:51:10 +01:00 |
|
Florian Roth
|
f88225dd2a
|
Merge pull request #640 from Neo23x0/devel
fix: broader exclusion for rule - OneDrive false positives
|
2020-02-26 18:41:52 +01:00 |
|
Florian Roth
|
6bbd80a8ee
|
fix: broader exclusion for rule - OneDrive false positives
|
2020-02-26 18:31:58 +01:00 |
|
Florian Roth
|
ada0edb822
|
Merge pull request #621 from wagga40/new_koadic_rule
New Koadic detection rule
|
2020-02-26 13:25:03 +01:00 |
|
Florian Roth
|
0ba6874645
|
Merge pull request #638 from Neo23x0/devel
Several false positives with new rules
|
2020-02-26 09:46:02 +01:00 |
|
Florian Roth
|
ca2cc87f0c
|
fixed regex syntax to wildcard syntax
|
2020-02-26 09:43:29 +01:00 |
|
Florian Roth
|
1c90d6badd
|
level increased
|
2020-02-26 09:42:31 +01:00 |
|
Florian Roth
|
c8afd4a16b
|
Merge pull request #637 from tjgeorgen/patch-1
fix missing status & description in status field
|
2020-02-26 09:40:55 +01:00 |
|
Florian Roth
|
031e6d3ee6
|
Merge pull request #635 from EccoTheFlintstone/fix_fp4
wmiprvse subprocess: add fallback check on username instead of only l…
|
2020-02-26 09:40:34 +01:00 |
|
Florian Roth
|
4f3e3166d3
|
fixing false positives
|
2020-02-26 09:33:55 +01:00 |
|
Florian Roth
|
82d2b1e6f0
|
Merge branch 'master' into devel
# Conflicts:
# rules/windows/process_creation/win_susp_squirrel_lolbin.yml
|
2020-02-26 09:27:48 +01:00 |
|
Florian Roth
|
e7aff17e72
|
FP: OneDrive setup
|
2020-02-26 09:26:19 +01:00 |
|
Tom Georgen
|
74f3fe70cc
|
fix missing status & description in status field
|
2020-02-25 16:30:41 -05:00 |
|
Thomas Patzke
|
65444f7a77
|
Release 0.16.0
|
2020-02-25 22:19:52 +01:00 |
|
Thomas Patzke
|
4e42bebb34
|
Merge branch 'socprime-master'
|
2020-02-25 21:32:59 +01:00 |
|
Florian Roth
|
a152853ac3
|
Merge pull request #624 from Antonlovesdnb/master
New rules for Macro Detections
|
2020-02-25 15:44:31 +01:00 |
|
Antonlovesdnb
|
e8b861bff4
|
Update sysmon_susp_winword_vbadll_load.yml
|
2020-02-25 09:24:29 -05:00 |
|
Antonlovesdnb
|
4c5d489428
|
Update sysmon_susp_office_kerberos_dll_load.yml
|
2020-02-25 09:23:52 -05:00 |
|
Antonlovesdnb
|
f92e2f2b18
|
Update sysmon_susp_office_dotnet_assembly_dll_load.yml
|
2020-02-25 09:23:22 -05:00 |
|
Antonlovesdnb
|
8141b1ae90
|
Update sysmon_susp_office_dsparse_dll_load.yml
|
2020-02-25 09:22:56 -05:00 |
|