valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 17:35:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
7,908 Commits 20 Branches 25 Tags 21 MiB
9f70336879
Commit Graph

5880 Commits

Author SHA1 Message Date
Cyb3rEng
851dfeee46
Changed selection2 condition 
changed from "\\wbem\\WmiPrvSE.exe" to "\wbem\WmiPrvSE.exe" to follow rule creation guidelines
 2021-09-08 21:24:18 -06:00
Cyb3rEng
77ee51dd76
Changed the category 
Changed category to file_event
 2021-09-08 21:22:26 -06:00
Cyb3rEng
5bbe3dec9b
Completed changes to selection1 and selection2 
changes were completed to remove ( * ) and stay within rule creation guide:
    - Image|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'

 WMIcommand|contains: 'Win32_Process\:\:Create'
 2021-09-08 21:14:58 -06:00
Cyb3rEng
49df2358de
Completed changes to selection1 
completed changes to selection1 to comply with rule creation guide with no ( * ) or ( \\ ) 

  - Image|endswith: '\wbem\WMIC.exe'
  - ProcessCommandLine|contains: 'wmic '
 2021-09-08 21:12:27 -06:00
Cyb3rEng
a3236e62a2
Changed selection2 conditions 
replaced *\wbem\WMIC.exe with Image|endswith: '\wbem\WMIC.exe' and ProcessCommandLine: *wmic * with ProcessCommandLine|contains: 'wmic '
 2021-09-08 21:10:47 -06:00
Cyb3rEng
1f577174f9
Changed endswith condition 
removed double // from "\wbem\WmiPrvSE.exe"
 2021-09-08 21:06:41 -06:00
Cyb3rEng
6ddc83901b
Changed Category 
Category Changed from process_creation to file_event
 2021-09-08 20:38:07 -06:00
Cyb3rEng
5ac0fded26
Merge branch 'SigmaHQ:master' into master 2021-09-08 20:26:59 -06:00
Sittikorn S
36ed5ee9d4
Update sysmon_dns_over_https_enabled.yml 2021-09-09 08:04:54 +07:00
frack113
8eb527d042 Update process_mailboxexport_share.yml 2021-09-08 20:21:02 +02:00
frack113
deb0ddfe09 fix duplicate tags 2021-09-08 20:16:53 +02:00
frack113
af8bf06b30 add missing tags 2021-09-08 20:14:49 +02:00
Florian Roth
b1540d65b9
refactor: simplified rule 2021-09-08 17:35:50 +02:00
Sittikorn S
c633e825e0
Update sysmon_dns_over_https_enabled.yml 2021-09-08 22:23:51 +07:00
Sittikorn S
847b8f49b4
Update sysmon_dns_over_https_enabled.yml 
Remove HKEY_LOCAL_MACHINE\ and revise Firefox object
 2021-09-08 22:22:53 +07:00
Florian Roth
e388bc6bfa
remove unsupported tag 2021-09-08 16:56:04 +02:00
Florian Roth
c9b4f5d326
CVE-2021-40444 2021-09-08 16:49:49 +02:00
Florian Roth
72ffe99b20
Merge pull request #2001 from SigmaHQ/rule-devel 
filter: empty thumbprint, PetitPotam rule
 2021-09-08 09:09:58 +02:00
frack113
993112c7eb
Merge pull request #2002 from frack113/missing_tag 
Add missing Tags #1974
 2021-09-08 06:26:55 +02:00
frack113
e712d9696b
Merge pull request #2000 from frack113/split_global 
Split frack113 global rules
 2021-09-08 06:26:35 +02:00
Cyb3rEng
e3b376e945
Completed Changes Based on Comments 
Removed :
unnecessary event ID
 2021-09-07 21:26:42 -06:00
Cyb3rEng
4130ceb208
Completed Changes Based on Comments 
Removed :
unnecessary event ID
 2021-09-07 21:25:52 -06:00
Cyb3rEng
8d47f9531b
Completed Changes Based on Comments 
Removed :
unnecessary event ID
 2021-09-07 21:22:01 -06:00
Cyb3rEng
13e6262055
Completed Changes Based on Comments 
Removed :
unnecessary event ID
 2021-09-07 21:20:51 -06:00
Cyb3rEng
8dc1b03fef
Completed Changes Based on Comments 
Removed :
unnecessary event ID
 2021-09-07 21:19:43 -06:00
Cyb3rEng
bd4d21c41c
Completed changes based on comments 
Removed :
unnecessary event ID
 2021-09-07 21:17:12 -06:00
Cyb3rEng
75a6e5c95b
Completed Changes as per comments 
Removed :
unnecessary event ID
 2021-09-07 21:14:06 -06:00
Cyb3rEng
3b2ebe1580
Completed changes 
Removed :
unnecessary event ID
 2021-09-07 21:12:02 -06:00
Cyb3rEng
8467d5a65a
Modified Rule 
Removed :
unnecessary event ID
 2021-09-07 21:09:07 -06:00
Cyb3rEng
f0f3ecfe2f
Converted to LF 
Removed :
unnecessary event ID
 2021-09-07 21:00:35 -06:00
Cyb3rEng
932b7cf2ba
Merge branch 'SigmaHQ:master' into master 2021-09-07 19:58:09 -06:00
Thomas Patzke
d9edc9f0e3 Merge branch 'fix' 2021-09-08 00:19:09 +02:00
Thomas Patzke
143744bc12 Various fixes 
* Backslashes in regular expressions
* Casing of condition operators
* Further small errors
 2021-09-07 23:38:07 +02:00
frack113
4c3f8821c4 add missing tags 2021-09-07 18:16:46 +02:00
frack113
4e394d83a1 add missing tags 2021-09-07 17:45:41 +02:00
Rachel Rice
be5351947c
Unset date update 
Signed-off-by: Rachel Rice <rachel.rice@lacework.net>
 2021-09-07 16:36:59 +01:00
Florian Roth
1a55f4a294
filter: empty thumbprint, PetitPotam rule 2021-09-07 14:37:03 +02:00
Rachel Rice
eef6e71e2e
Update AWS Update Login Profile Rule fields 
Missed updating field from `responseElements.accessKey.userName` to `requestParameters.userName` on last update.
 2021-09-07 12:39:56 +01:00
frack113
0e5e4fa19d Split global rules 2021-09-07 13:30:32 +02:00
Florian Roth
cfbde22d2d
rule: PRIVATELOG image load 2021-09-07 10:10:14 +02:00
Florian Roth
3a305e82b9
fix: remove renamed files 2021-09-07 09:28:20 +02:00
Florian Roth
a8d8d878a0
remove uppercase files 2021-09-07 09:27:11 +02:00
Florian Roth
8b4fce3473
removed unneeded upper ticks 2021-09-07 09:21:44 +02:00
Florian Roth
c082ce0fe0
Merge branch 'master' into rule-devel 2021-09-07 09:20:47 +02:00
Florian Roth
57bfdc7a02
fix: more upper case chars 2021-09-07 09:19:23 +02:00
Florian Roth
0cce1c0245
fix: missing lowercase chars 2021-09-07 09:17:25 +02:00
Florian Roth
33be089ea2
fix: filename to lowercase 2021-09-07 09:16:35 +02:00
frack113
4f6b87fed5
Merge pull request #1997 from zakibro/master 
New Rule - Linux Hidden Files and Directories
 2021-09-07 09:12:04 +02:00
zakibro
bba66ca762
Update lnx_auditd_hidden_files_directories.yml 
Updating arguments section
 2021-09-07 07:57:50 +02:00
frack113
be442182fe convert to LF 2021-09-06 21:10:08 +02:00
frack113
9ef299c4f4 Change to LF 2021-09-06 21:07:49 +02:00
frack113
3b95b0c913
Remove useless Eventid 
Use tools/config/generic/windows-audit.yml to convert for security 4688
 2021-09-06 20:56:41 +02:00
zakibro
e9fa5bde2b
Update lnx_auditd_hidden_files_directories.yml 
Correction of tag
 2021-09-06 18:55:58 +02:00
Pawel Mazur
7c2895c73f New Rule - Linux Hidden Files and Directories 2021-09-06 18:43:49 +02:00
Pawel Mazur
59eb7ce032 Merge branch 'master' of https://github.com/zakibro/sigma 2021-09-06 18:41:19 +02:00
Pawel Mazur
9f5f25e480 New Rule - Linux Hidden Files and Directories 2021-09-06 18:40:39 +02:00
zakibro
f52860d6ab
Merge branch 'SigmaHQ:master' into master 2021-09-06 18:40:02 +02:00
Pawel Mazur
3eb354e34c Merge branch 'master' of https://github.com/zakibro/sigma 2021-09-06 18:37:45 +02:00
Pawel Mazur
ef3efd8fd3 New Rule Linux - Hidden Files and Directories 2021-09-06 18:37:02 +02:00
Austin Songer
0de95e355a
Update azure_federation_modified.yml 2021-09-06 11:31:52 -05:00
Austin Songer
e6e3fc2eec
Update azure_federation_modified.yml 2021-09-06 11:16:35 -05:00
Austin Songer
6025df63ee
Create azure_federation_modified.yml 2021-09-06 11:06:58 -05:00
Florian Roth
6b2bacd2cc
Merge pull request #1979 from frack113/test_global 
Change ID in global action rule
 2021-09-06 08:44:14 +02:00
frack113
013eb2e11f
Merge pull request #1993 from zakibro/master 
New Rule - Linux-Audio-Capture
 2021-09-05 18:30:45 +02:00
frack113
44a5792be3 Revert win_apt_apt29_tor.yml 2021-09-05 12:34:24 +02:00
frack113
ca4c156fa4 Update win_apt_apt29_tor.yml 2021-09-05 11:20:57 +02:00
frack113
acf2bfbd27 Update sigma_uuid verify 
Make a better verify code
 2021-09-05 10:43:42 +02:00
zakibro
5042ba65ac
Update lnx_auditd_audio_capture.yml 
Added more references about arecord.
 2021-09-05 09:28:53 +02:00
Austin Songer
fa5554660c
Update sysmon_mal_cobaltstrike_re.yml 2021-09-04 17:33:05 -05:00
Pawel Mazur
caf78b5ea1 New Rule - Linux-Audio-Capture 2021-09-04 22:10:34 +02:00
Austin Songer
e7c5827776
Update azure_service_principal_removed.yml 2021-09-03 22:43:11 -05:00
Austin Songer
0612ea7f6e
Update azure_device_no_longer_managed_or_compliant.yml 2021-09-03 22:42:26 -05:00
Austin Songer
c420a17e05
Update azure_service_principal_removed.yml 2021-09-03 22:29:21 -05:00
Austin Songer
fda1e3362e
Update azure_owner_removed_from_application_or_service_principal.yml 2021-09-03 22:29:12 -05:00
Austin Songer
9d26116d27
Update azure_device_no_longer_managed_or_compliant.yml 2021-09-03 22:29:02 -05:00
Austin Songer
8fe7bfc452
Update azure_application_deleted.yml 2021-09-03 22:28:53 -05:00
Austin Songer
c021ae9e7c
Update and rename azure_device_or_configuration_deleted.yml to azure_device_or_configuration_modified_or_deleted.yml 2021-09-03 22:28:35 -05:00
Austin Songer
6744fb7f2e
Create azure_application_deleted.yml 2021-09-03 22:25:34 -05:00
Austin Songer
70ac0104cf
Create azure_service_principal_removed.yml 2021-09-03 22:25:01 -05:00
Austin Songer
6e15618c75
Create azure_device_or_configuration_deleted.yml 2021-09-03 22:24:32 -05:00
Austin Songer
b478132769
Create azure_owner_removed_from_application_or_service_principal.yml 2021-09-03 22:23:59 -05:00
Austin Songer
c0bdc3fb1b
Create azure_device_no_longer_managed_or_compliant.yml 2021-09-03 22:23:21 -05:00
frack113
6780182c37
Merge pull request #1974 from frack113/tags_pack2 
Add missing Tags
 2021-09-03 19:13:32 +02:00
frack113
2e474628fa
Merge pull request #1987 from zakibro/master 
New Rule - Linux-Auditd-System Information Discovery
 2021-09-03 19:10:28 +02:00
frack113
688df3405a
Merge pull request #1970 from frack113/red_T1564.004_1 
Redcanary  t1564.004  ADS test 1
 2021-09-03 19:06:51 +02:00
frack113
77c6b74c72
Merge pull request #1985 from mvelazc0/master 
Adding Petitpotam/ADCS attack vector detections
 2021-09-03 19:06:03 +02:00
mvelazco
a7a002cb7f updating fields as per frack113 feedback 2021-09-03 10:01:54 -04:00
frack113
769451dc03
Add missing id 2021-09-03 13:42:15 +02:00
frack113
815134df7f
Cleanup 2021-09-03 13:30:10 +02:00
phantinuss
aa2e86963c
fix: rename filter 2021-09-03 13:26:34 +02:00
phantinuss
f3bdb0e43d
fix: remove unneeded selection 2021-09-03 13:26:23 +02:00
phantinuss
2de2de8433
Addition to UAC Bypasses 2021-09-03 13:26:11 +02:00
zakibro
8bd859f550
Update lnx_auditd_system_info_discovery.yml 2021-09-03 13:07:42 +02:00
ncrqnt
adc3c9e608 fixed date: switched day/month 2021-09-03 12:03:38 +02:00
Pawel Mazur
864286e206 New Rule - Linux-Auditd-System Information Discovery 2021-09-03 11:33:18 +02:00
frack113
89562273cc
Merge pull request #1984 from austinsonger/azure_app_credential_modification.yml 
azure_app_credential_modification.yml
 2021-09-03 08:17:55 +02:00
frack113
88389f945d
Merge pull request #1983 from austinsonger/azure_service_principal_created.yml 
azure_service_principal_created.yml
 2021-09-03 08:14:47 +02:00
frack113
d40cdec062
Merge pull request #1982 from austinsonger/azure_network_firewall_policy_modified_or_deleted.yml 
azure_network_firewall_policy_modified_or_deleted.yml
 2021-09-03 08:13:30 +02:00
frack113
bd1b4c0d70
Merge pull request #1978 from rachelrice/update_aws_login 
Update AWS Update Login Profile rule
 2021-09-03 08:12:28 +02:00
frack113
1fc2a39720
Merge pull request #1975 from frack113/red_T1564.004_2 
Redcanary  t1564.004 test 2
 2021-09-03 08:12:08 +02:00
frack113
11e4b900e4 Update global id 2021-09-03 06:59:40 +02:00
frack113
135d0a2c61 Update global id 2021-09-03 06:50:00 +02:00
frack113
a6bb5574fb Update global id 2021-09-03 06:35:35 +02:00
mvelazco
ba41e922d2 adding Petitpotam host detections 2021-09-03 00:12:49 -04:00
Austin Songer
775c0e8e7f
Update azure_app_credential_modification.yml 2021-09-02 21:00:21 -05:00
Austin Songer
643ec0abe3
Update azure_service_principal_created.yml 2021-09-02 21:00:02 -05:00
Austin Songer
10af7bbdb1
Create azure_app_credential_modification.yml 2021-09-02 20:53:32 -05:00
Austin Songer
d25fd420d6
Create azure_service_principal_created.yml 2021-09-02 20:48:35 -05:00
Austin Songer
1272c76ae7
Create azure_network_firewall_policy_modified_or_deleted.yml 2021-09-02 20:31:27 -05:00
frack113
d02ee1eddd Update global ID 2021-09-02 21:16:55 +02:00
frack113
f90c7558a7 update global id 2021-09-02 21:03:25 +02:00
frack113
ac90ee0002 Update global ID 2021-09-02 20:23:23 +02:00
frack113
086a15fc45 Update global ID 2021-09-02 20:07:03 +02:00
Rachel Rice
78d3fa4795
Update AWS STS AssumeRole Misuse rule 
Update selection criteria for AWS STS AssumeRole Misuse rule for any event by an AssumedRole userIdentity.
Closes SigmaHQ/sigma#1963.
 2021-09-02 17:40:35 +01:00
Rachel Rice
7ccb773b20
Update AWS Update Login Profile rule 
Update selection criteria for AWS Update Login Profile rule to check for mismatch between userIdentity.arn and requestParameters.userName.
Closes SigmaHQ/sigma#1966.
 2021-09-02 17:37:41 +01:00
frack113
9bcefc6a93 move uuid from global 2021-09-02 16:05:05 +02:00
frack113
b731c20594
Merge pull request #1971 from phantinuss/master 
fix: prevent possible FPs
 2021-09-02 15:34:46 +02:00
frack113
a048403089
Merge pull request #1973 from klingerko/cs_namedpipe_updates 
Remove duplicate and regex improvements
 2021-09-02 15:25:01 +02:00
phantinuss
ab721c736c
chore: move level/falsepositives to bottom 2021-09-02 14:55:17 +02:00
klingerko
15e25f9635 update modifed date 2021-09-02 14:50:14 +02:00
phantinuss
0b373ff1e9
fix: remove 2nd selection due to FPs 2021-09-02 14:47:47 +02:00
frack113
6a1b95d947
Findstr covert by win_susp_findstr.yml 2021-09-02 14:22:59 +02:00
frack113
aaa568ff2d
print covert by win_susp_print.yml 2021-09-02 14:18:38 +02:00
phantinuss
5cb6eed52e
fix: remove single value lists 2021-09-02 14:09:03 +02:00
phantinuss
f4a5df67ae
further narrowing down of the selection, therefore removing the filter 2021-09-02 10:28:01 +02:00
frack113
90e673e5ac fix invalid tags 2021-09-02 10:17:50 +02:00
Florian Roth
0603581111
Merge pull request #1969 from SigmaHQ/rule-devel 
More Named Pipe Rules and WMI rule refactoring
 2021-09-02 10:15:00 +02:00
frack113
6f1f70ca5e Add missing tags 2021-09-02 09:59:19 +02:00
frack113
25c6f69ea3 update references 2021-09-02 09:51:44 +02:00
frack113
5e87970c77 add powershell_store_file_in_alternate_data_stream.yml 2021-09-02 09:47:54 +02:00
frack113
5212b388c6
Merge pull request #1967 from d4rk-d4nph3/master 
Added rule for detection of Atera RMM Agent installation
 2021-09-02 09:19:49 +02:00
frack113
e0cd35261c add missing tags 2021-09-01 20:01:03 +02:00
frack113
1ba0a7c7a3 add missing tags 2021-09-01 19:38:35 +02:00
Konstantin Klinger
457da818a4 regex optimisations 2021-09-01 17:06:55 +02:00
Konstantin Klinger
e83ee55573 remove duplicate 2021-09-01 17:05:36 +02:00
Florian Roth
b0c2d7b75a
fix: tags for WMI / execution / persistence 2021-09-01 16:34:50 +02:00
Florian Roth
2f7f050ad8
fix: removed tags 2021-09-01 16:32:27 +02:00
phantinuss
0b38237dbf
fix: add relation to now obsolete rule 2021-09-01 15:38:29 +02:00
phantinuss
ae9966bdcc
fix: unifying two overlapping rules 2021-09-01 14:48:32 +02:00
phantinuss
deefcaa8ac
fix: prevent possible FPs with the respective command only used as the last parameter 2021-09-01 14:33:46 +02:00
frack113
434c3891ff
Merge pull request #1965 from frack113/add_tags 
Add tags when missing
 2021-09-01 14:07:31 +02:00
Florian Roth
1aac21ba79
fix: single list item issue 2021-09-01 14:03:42 +02:00
Florian Roth
1c4f642227
Merge pull request #1699 from matsto/patch-1 
Fixed transformation modifier for keywords
 2021-09-01 14:02:10 +02:00
frack113
2dbbaf0180 fix missing char in date 2021-09-01 14:00:55 +02:00
Florian Roth
505140d273
rule: extended WMI suspicious scripts rule 2021-09-01 13:57:48 +02:00
Florian Roth
e787420be1
rule: WMI filter content encoded executable 2021-09-01 13:57:36 +02:00
Florian Roth
8761927e8c
rule: susp scrcons.exe creating named pipe 2021-09-01 13:57:17 +02:00
frack113
e71fce6f11 fix errors 2021-09-01 13:55:14 +02:00
Florian Roth
affc929c3b
LiquidSnake named pipe 2021-09-01 13:54:47 +02:00
frack113
80dbfa7af5 add process_creation_alternate_data_streams.yml 2021-09-01 13:52:09 +02:00