3986 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
omkargudhate22	8f618c9a1f	changed condition	2020-10-12 18:59:53 +05:30
omkargudhate22	f162bc1aff	remove space	2020-10-12 18:53:47 +05:30
omkargudhate22	0e3c51316a	updated	2020-10-12 18:50:18 +05:30
omkargudhate22	ecb42fb5dd	Update sysmon_susp_clr_logs.yml	2020-10-12 18:50:07 +05:30
omkar72	cf60438c93	clr logs creation	2020-10-12 18:42:09 +05:30
yugoslavskiy	0966d24031	Merge pull request #1033 from JPMinty/oscd ... Create rules-unsupported/win_remote_schtask.yml	2020-10-11 19:39:33 +02:00
yugoslavskiy	4548da7fb9	Merge pull request #1034 from JPMinty/Remote_Service ... unsupported-rules/win_remote_service.yml	2020-10-11 19:38:00 +02:00
JPMinty	21284c2c92	Added selection criteria + moved to Unsupported rule	2020-10-11 12:48:48 +10:30
JPMinty	10f5c38b20	Added conditional description + moved to unsupported-rules	2020-10-11 12:40:24 +10:30
Thomas Patzke	93616af1cb	Merge pull request #1036 from svch0stz/oscd4 ... [OSCD] Create win_net_use_admin_share.yml	2020-10-10 00:05:41 +02:00
Thomas Patzke	fe554a88cb	Merge pull request #1035 from svch0stz/oscd3 ... [OSCD] Update win_susp_copy_lateral_movement.yml	2020-10-10 00:03:26 +02:00
Thomas Patzke	f5cd2e0f0c	Merge pull request #1032 from svch0stz/oscd ... [OSCD] Created win_susp_wsl_lolbin.yml	2020-10-09 23:56:50 +02:00
JPMinty	13ac0b0e72	Update win_remote_service.yml	2020-10-09 17:05:51 +10:30
JPMinty	bf43344858	Refactor for multiple log sources	2020-10-07 17:25:34 +10:30
JPMinty	c878d55ac0	Add oscd.community author	2020-10-07 16:59:18 +10:30
Thomas Patzke	986c80e593	Added oscd branch to CI	2020-10-07 08:20:26 +02:00
svch0stz	ca0f2146ab	Update win_net_use_admin_share.yml	2020-10-07 08:23:31 +11:00
svch0stz	3d048ceba0	Update win_susp_copy_lateral_movement.yml	2020-10-07 08:18:09 +11:00
svch0stz	ee2c79745f	Update win_susp_wsl_lolbin.yml	2020-10-07 08:12:51 +11:00
svch0stz	c82d5ac08e	Create win_net_use_admin_share.yml	2020-10-05 14:43:45 +11:00
svch0stz	60bd6a3692	Update win_susp_copy_lateral_movement.yml	2020-10-05 14:35:20 +11:00
svch0stz	dd2ab4082d	Update win_susp_copy_lateral_movement.yml	2020-10-05 14:33:00 +11:00
svch0stz	641f3031bd	Update win_susp_copy_lateral_movement.yml	2020-10-05 14:27:39 +11:00
JPMinty	6fc476b2a2	Delete win_remote_schtask.yml	2020-10-05 13:40:57 +10:30
JPMinty	99e52a6f7a	Create win_remote_service.yml	2020-10-05 13:37:55 +10:30
svch0stz	3516819bf8	Delete win_net_use_admin_share.yml	2020-10-05 14:00:36 +11:00
svch0stz	c675be41e2	Create win_net_use_admin_share.yml	2020-10-05 13:57:50 +11:00
JPMinty	ad5b128d0d	Delete win_remote_service.yml	2020-10-05 13:26:12 +10:30
JPMinty	79d9cbe2c7	Create win_remote_service.yml	2020-10-05 13:23:00 +10:30
JPMinty	03b350ff0b	Create win_remote_schtask.yml	2020-10-05 13:15:48 +10:30
svch0stz	bc947fefc1	Create win_susp_wsl_lolbin.yml	2020-10-05 13:36:40 +11:00
Florian Roth	d3ee1aba66	docs: MITRE ATT&CK(R) trademark references removed or adjusted ... https://github.com/Neo23x0/sigma/issues/1028	2020-09-30 08:53:52 +02:00
Florian Roth	c17ca6d5fe	Merge pull request #1018 from savvyspoon/wcry-dns ... WannaCry Killswitch domain DNS query	2020-09-29 09:27:21 +02:00
Florian Roth	d7d9c0e772	Merge pull request #1021 from hieuttmmo/master ... Sigma rule to detect AdFind.exe execution	2020-09-27 09:50:41 +02:00
Florian Roth	8020fe3c40	false positive condition	2020-09-26 17:03:29 +02:00
Florian Roth	60795f7050	Update win_susp_adfind.yml ... Fear that a simple adfind.exe causes too many false positives	2020-09-26 17:02:39 +02:00
Florian Roth	dbdd758365	Duplicate Rule ... we already have a rule for that	2020-09-26 17:01:32 +02:00
Tran Trung Hieu	d4dd0600ad	Fix logsource service to process_creation	2020-09-26 21:45:23 +07:00
Tran Trung Hieu	c756fc8576	Detect Suspicious AdFind Execution	2020-09-26 21:34:06 +07:00
Mike Wade	f76f80db80	Killswitch domain	2020-09-16 20:32:31 -06:00
Mike Wade	7b1ef9ea64	fixing test runner issues	2020-09-15 15:45:33 -06:00
Mike Wade	6ed36b0e41	fixed issues with tabs and duplicate tags	2020-09-15 08:52:00 -06:00
Florian Roth	2cd9b794e6	Merge pull request #1007 from d4rk-d4nph3/master ... Windows Defender AMSI Trigger Detected	2020-09-15 15:45:00 +02:00
Florian Roth	19ccfb80da	Merge pull request #1016 from NVISO-BE/win_vul_cve_2020_1472 ... Added win_vul_cve_2020_1472 rule	2020-09-15 15:43:53 +02:00
Remco Hofman	6cadfa5b2b	Added win_vul_cve_2020_1472 rule	2020-09-15 15:13:53 +02:00
Mike Wade	1ddba05eb2	Second round	2020-09-15 07:02:30 -06:00
Mike Wade	da9b32bdd6	we	2020-09-15 06:24:44 -06:00
Mike Wade	8ce73bd8df	Fixed issues with tags and missing files	2020-09-15 06:10:57 -06:00
Thomas Patzke	b0ccf44243	Added test	2020-09-15 12:42:37 +02:00
Thomas Patzke	378d9c94cf	Merge branch 'master' of https://github.com/socprime/sigma into pr-981	2020-09-15 12:14:49 +02:00