Alfie Champion
|
9876643e3e
|
added rule for rundll32 launch of fsecure C3
|
2021-06-02 19:57:39 +01:00 |
|
Florian Roth
|
7288ae93b9
|
Merge pull request #1526 from WojciechLesicki/master
Added a new rule about loading dll CS via rundll32 and also some chan…
|
2021-06-01 21:54:26 +02:00 |
|
Florian Roth
|
eb4300756e
|
Update win_cobaltstrike_service_installs.yml
|
2021-06-01 21:53:25 +02:00 |
|
Florian Roth
|
736eeabf9f
|
Merge pull request #1527 from SigmaHQ/rule-devel
fix: rule FPs with Stealthy VSTO Persistence
|
2021-06-01 18:18:22 +02:00 |
|
Florian Roth
|
950b252d5c
|
Update process_creation_cobaltstrike_load_by_rundll32.yml
|
2021-06-01 18:11:19 +02:00 |
|
WojciechLesicki
|
d6f6b88b4c
|
I corrected the tag
|
2021-06-01 17:11:24 +02:00 |
|
WojciechLesicki
|
90a21d954a
|
Change title
|
2021-06-01 16:55:49 +02:00 |
|
WojciechLesicki
|
cc4c55ed10
|
Added a new rule about loading dll CS via rundll32 and also some changes about CobaltStrike Service Installations
|
2021-06-01 16:18:23 +02:00 |
|
Florian Roth
|
34cf1333de
|
fix: rule FPs with Stealthy VSTO Persistence
|
2021-06-01 13:58:35 +02:00 |
|
Florian Roth
|
b191efaab1
|
Merge pull request #1522 from SigmaHQ/rule-devel
rule: nginx core dump
|
2021-05-31 16:56:16 +02:00 |
|
Florian Roth
|
ab73dd4dd6
|
rule: nginx core dump
|
2021-05-31 10:49:42 +02:00 |
|
Florian Roth
|
5b4742b5f9
|
Merge pull request #1521 from frack113/fix_some_logsource
Fix some logsource to get more accurate
|
2021-05-31 10:07:29 +02:00 |
|
frack113
|
0b2037ccad
|
fix **firewall** is a category like in all other rules
|
2021-05-30 09:43:29 +02:00 |
|
frack113
|
aa34ff8e3c
|
Addition of System channel for more accurate detection
|
2021-05-30 09:27:08 +02:00 |
|
frack113
|
7d55c7ca80
|
category other is useless
Add a new reference
|
2021-05-30 09:17:41 +02:00 |
|
frack113
|
f91abf8929
|
Fix auditd is a service
|
2021-05-30 08:58:25 +02:00 |
|
frack113
|
a634452871
|
product is lowercase
|
2021-05-30 08:43:01 +02:00 |
|
frack113
|
58436c2a02
|
product is lowercase
|
2021-05-30 08:37:48 +02:00 |
|
frack113
|
33a5137bc7
|
Fix logsource to get accurate detection
|
2021-05-30 08:22:38 +02:00 |
|
Florian Roth
|
503df46968
|
Merge pull request #1518 from frack113/duplicate_uuid
Two last duplicate UUID
|
2021-05-28 09:29:26 +02:00 |
|
frack113
|
9a0604029e
|
duplicate uuid 5a105d34-05fc-401e-8553-272b45c1522d
- win_cobaltstrike_service_installs.yml
- win_mal_service_installs.yml
|
2021-05-27 21:06:07 +02:00 |
|
frack113
|
179bfa7d56
|
duplicate uuid 2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5
- sysmon_susp_webdav_client_execution.yml
- sysmon_wdigest_enable_uselogoncredential.yml
|
2021-05-27 20:59:26 +02:00 |
|
Florian Roth
|
06a84350ae
|
Merge pull request #1517 from SigmaHQ/rule-devel
rule: suspicious programs - no DLL in command line
|
2021-05-27 19:50:12 +02:00 |
|
Florian Roth
|
39900bb7c5
|
refactor: re-add exec seldction
|
2021-05-27 19:24:20 +02:00 |
|
Florian Roth
|
9af8e81cb4
|
Merge branch 'master' into rule-devel
|
2021-05-27 19:23:21 +02:00 |
|
Florian Roth
|
c3ab7d19f1
|
Merge pull request #1515 from jbeley/master
Modified win_susp_rclone_exec.yml to detect renamed rclone executable…
|
2021-05-27 18:22:16 +02:00 |
|
Florian Roth
|
431f34b985
|
fix: other locations
https://twitter.com/ber_m1ng/status/1397948048135778309
|
2021-05-27 18:12:20 +02:00 |
|
Florian Roth
|
a4e6f58b16
|
rule: suspicious programs - no DLL in command line
|
2021-05-27 17:49:10 +02:00 |
|
Florian Roth
|
fa45298474
|
Merge pull request #1516 from SigmaHQ/rule-devel
Update win_susp_regedit_trustedinstaller.yml
|
2021-05-27 17:48:48 +02:00 |
|
Jeff Beley
|
f675ac36b1
|
Modified win_susp_rclone_exec.yml to detect renamed rclone executables and rclone executed from inside of other programs (BEACON)
|
2021-05-27 15:03:52 +00:00 |
|
Florian Roth
|
61f5e66569
|
Update win_susp_regedit_trustedinstaller.yml
|
2021-05-27 16:57:41 +02:00 |
|
Florian Roth
|
71625c54f0
|
Merge pull request #1514 from SigmaHQ/rule-devel
ProcessHacker rule, NCCGroup rclone rules
|
2021-05-27 16:30:30 +02:00 |
|
Florian Roth
|
d1582944a7
|
fix: dates in new rules
|
2021-05-27 16:30:09 +02:00 |
|
Florian Roth
|
d5e8d1153f
|
fix: missing condition
|
2021-05-27 15:04:13 +02:00 |
|
Florian Roth
|
7ce7095c2c
|
fix: title with lower case letters
|
2021-05-27 15:01:32 +02:00 |
|
Florian Roth
|
6e31bc3037
|
Merge pull request #1485 from V1D1AN/master
Update ecs-zeek-elastic-beats-implementation.yml
|
2021-05-27 14:59:14 +02:00 |
|
Florian Roth
|
5cf7078fb3
|
Merge pull request #1484 from ZikyHD/filter_sysmon_in_memory_assembly_execution
Add filter on sdiagnhost.exe in Suspicious In-Memory Module Execution…
|
2021-05-27 12:55:31 +02:00 |
|
Florian Roth
|
ea430c8823
|
Merge pull request #1471 from d4rk-d4nph3/master
Updated rule for Advanced IP Scanner and new rule for PowerView
|
2021-05-27 12:55:03 +02:00 |
|
Florian Roth
|
8d834cf681
|
Merge pull request #1480 from ZikyHD/fix_sysmon_cred_dump_lsass_access
Add Windows Defender on WL
|
2021-05-27 12:54:15 +02:00 |
|
Florian Roth
|
d8827fc29d
|
Merge pull request #1481 from ZikyHD/improve_win_tool_psexec
Add Sysmon EventID 11, 17 and 18 to win_tool_psexec rule
|
2021-05-27 12:53:56 +02:00 |
|
Florian Roth
|
1bf9546fad
|
Merge pull request #1482 from ZikyHD/improve_sysmon_creation_system_file
Exclude dism.exe
|
2021-05-27 12:53:27 +02:00 |
|
Florian Roth
|
9239690ef3
|
Merge pull request #1488 from dacelbot/master
Contribute AWS snapshot exfiltration rule
|
2021-05-27 12:52:46 +02:00 |
|
Florian Roth
|
a80c29a7c2
|
Merge pull request #1491 from w0rk3r/patch-1
Adds Schema Value equivalent of WriteData to rules/windows/builtin/win_GPO_scheduledtasks.yml
|
2021-05-27 12:52:14 +02:00 |
|
Florian Roth
|
059e669ac6
|
Merge pull request #1496 from frack113/falsepositives_NOT_a_list
Fix rule where Falsepositives not a valid value
|
2021-05-27 12:51:54 +02:00 |
|
Florian Roth
|
e397a2974e
|
Merge pull request #1511 from frack113/fix_missing_eventid_Obfuscation
Fix missing eventid when converting windows obfuscation rules
|
2021-05-27 12:51:22 +02:00 |
|
Florian Roth
|
3cd2730a26
|
rule: process hacker priv esc
|
2021-05-27 12:49:54 +02:00 |
|
Florian Roth
|
c0b93a010c
|
NCCGroup rules from rclone blog post
https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
|
2021-05-27 12:49:40 +02:00 |
|
Florian Roth
|
f16aca7a35
|
Merge pull request #1512 from SigmaHQ/rule-devel
duplicate UUIDs, regedit as trusted installer
|
2021-05-27 12:42:36 +02:00 |
|
Florian Roth
|
7812a4217c
|
rule: regedit as trustedinstaller
|
2021-05-27 11:36:05 +02:00 |
|
Florian Roth
|
b5352ac5f7
|
fix: duplicate UUIDs
|
2021-05-27 10:29:21 +02:00 |
|