Thomas Patzke
df6ad82770
Removed redundant attribute from rule
...
EventID 4657 already implies the modification.
2018-06-21 23:59:55 +02:00
Florian Roth
946c946366
Rule: NTLM logon
2018-06-13 00:08:46 +02:00
Florian Roth
e23cdafb85
Rule: Fixed missing description
2018-06-13 00:08:46 +02:00
Florian Roth
9c817a493b
Rule: DCSync
2018-06-03 16:00:57 +02:00
Florian Roth
8e500d2caa
Bugfix in rule
2018-05-29 14:11:12 +02:00
Florian Roth
2db00b8559
Rule: whoami execution
2018-05-22 16:59:58 +02:00
Thomas Patzke
079c04f28d
Fixed rule scope
2018-05-18 14:23:52 +02:00
Thomas Patzke
6a3fcdc68c
Unified 0x values with other rules
2018-05-13 22:28:43 +02:00
Florian Roth
49877a6ed0
Moved and renamed rule
2018-04-18 16:53:11 +02:00
Florian Roth
8420d3174a
Reordered
2018-04-18 16:34:16 +02:00
yt0ng
c637c2e590
Adding Detections for renamed wmic and format
...
https://subt0x11.blogspot.ch/2018/04/wmicexe-whitelisting-bypass-hacking.html
https://twitter.com/mattifestation/status/986280382042595328
2018-04-18 15:02:52 +02:00
Florian Roth
9b8df865b1
Extended rule
2018-04-18 12:13:45 +02:00
yt0ng
a4fb39a336
also for http
2018-04-18 08:19:47 +02:00
yt0ng
169a4404c2
added SquiblyTwo Detection
2018-04-17 21:33:26 +02:00
Thomas Patzke
a3e02ea70f
Various rule fixes
...
* Field name: LogonProcess -> LogonProcessName
* Field name: Message -> AuditPolicyChanges
* Field name: ProcessCommandLine -> CommandLine
* Removed Type match in Kerberos RC4 encryption rule
Problematic because text representation not unified and audit failures are possibly interesting events
* Removed field 'Severity' from rules (Redundant)
* Rule decomposition of win_susp_failed_logons_single_source) because of different field names
* Field name: SubjectAccountName -> SubjectUserName
* Field name: TargetProcess -> TargetImage
* Field name: TicketEncryption -> TicketEncryptionType
* Field name: TargetFileName -> TargetFilename
2018-03-27 14:35:49 +02:00
Thomas Patzke
b1bfa64231
Removed redundant 'EventLog' conditions
2018-03-26 00:36:40 +02:00
Thomas Patzke
f68af2a5da
Added reference to Kerberos RC4 rule
2018-03-25 23:19:01 +02:00
Florian Roth
f220e61adc
Fixed second selection in rule
2018-03-21 10:47:14 +01:00
Florian Roth
70c2f973a3
Rule: Smbexec.py Service Installation
2018-03-21 10:44:37 +01:00
Florian Roth
3c968d4ec6
Fixed rule for any ControlSets
2018-03-21 10:44:37 +01:00
Florian Roth
e9fcfcba7f
Improved NetNTLM downgrade rule
2018-03-20 15:03:55 +01:00
Florian Roth
8b31767d31
Rule: PsExec usage
2018-03-15 19:54:22 +01:00
Thomas Patzke
ada1ca94ea
JPCERT rules
...
* Addition of ntdsutil.exe rule
* Added new link to existing rules
2018-03-08 00:10:19 +01:00
Thomas Patzke
8ee24bf150
WMI persistence rules derived from blog article
...
https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/#so-to-summarize
2018-03-07 23:05:10 +01:00
Thomas Patzke
84645f4e59
Simplified rule conditions with new condition constructs
2018-03-06 23:14:43 +01:00
Dominik Schaudel
cea48d9010
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module
2018-02-12 21:57:22 +01:00
Florian Roth
d6d031fc23
Rule update: Olympic destroyer detection
...
http://blog.talosintelligence.com/2018/02/olympic-destroyer.html
2018-02-12 15:35:47 +01:00
Florian Roth
0a1c600d7d
Rule: Changed msiexec web install rule
2018-02-10 15:25:08 +01:00
Florian Roth
a4e6b3003f
Rule: Msiexec web install
2018-02-09 10:13:39 +01:00
SherifEldeeb
348728bdd9
Cleaning up empty list items
2018-01-28 02:36:39 +03:00
SherifEldeeb
48441962cc
Change All "str" references to be "list"to mach schema update
2018-01-28 02:24:16 +03:00
SherifEldeeb
112a0939d7
Change "reference" to "references" to match new schema
2018-01-28 02:12:19 +03:00
Florian Roth
0f2e1c5934
Bugfix: Missing wildcard in IIS module install rule
2018-01-27 16:15:25 +01:00
Florian Roth
d93d7d8e7b
Rule: IIS nativ-code module command line installation
2018-01-27 11:13:13 +01:00
Florian Roth
aca70e57ec
Massive Title Cleanup
2018-01-27 10:57:30 +01:00
Florian Roth
379b2dd207
New recon activity rule
2017-12-11 09:31:54 +01:00
Florian Roth
8e2aef035c
Removed commands - false positive reduction
2017-12-11 09:31:54 +01:00
Florian Roth
1464ab4ab8
Renamed rule: recon activity > net recon activity - to be more specific
2017-12-11 09:31:54 +01:00
Thomas Patzke
2ec5919b9e
Fixed win_disable_event_logging by multiline description
2017-11-19 22:49:40 +01:00
Nate Guagenti
a796ff329e
Create win_disable_event_logging
2017-11-15 21:56:30 -05:00
Florian Roth
a0ac61229c
Rule: Detect plugged USB devices
2017-11-09 08:40:46 +01:00
Thomas Patzke
5035c9c490
Converted Windows 4688-only rules into 4688 and Sysmon/1 collections
2017-11-01 22:12:14 +01:00
Thomas Patzke
f3a809eb00
Improved admin logon rules and removed duplicates
2017-11-01 21:33:01 +01:00
Thomas Patzke
0055eedb83
Merge pull request #54 from juju4/CAR-2016-04-005b
...
Admin user remote login
2017-11-01 21:22:09 +01:00
Thomas Patzke
613f922976
Merge pull request #43 from juju4/master
...
New rules
2017-11-01 21:21:30 +01:00
Thomas Patzke
118e8af738
Simplified rule collection
2017-11-01 10:00:35 +01:00
Thomas Patzke
732f01878f
Sigma rule collection YAML action documents
2017-11-01 00:17:55 +01:00
Thomas Patzke
d0b2bd9875
Multiple rules per file
...
* New wrapper class SigmaCollectionParser parses all YAML documents
contained in file and handles multiple SigmaParser instantiation.
* Exemplary extended one security/4688 rule to security/4688 + sysmon/1
2017-10-31 23:06:18 +01:00
Thomas Patzke
9d96a998d7
Merge pull request #56 from juju4/CAR-2013-05-002b
...
Detects Suspicious Run Locations - MITRE CAR-2013-05-002
2017-10-30 00:27:56 +01:00
Thomas Patzke
720c992573
Dropped within keyword
...
Covered by timeframe attribute.
Fixes issue #26 .
2017-10-30 00:25:56 +01:00
Thomas Patzke
c865b0e9a8
Removed within keyword in rule
2017-10-30 00:15:01 +01:00
juju4
4b64fc1704
double quotes = escape
2017-10-29 14:42:40 -04:00
juju4
07185247cb
double quotes = escape
2017-10-29 14:32:52 -04:00
juju4
f5f20c3f75
Admin user remote login
2017-10-29 14:30:11 -04:00
juju4
19dd69140b
Detects Suspicious Run Locations - MITRE CAR-2013-05-002
2017-10-29 14:27:01 -04:00
juju4
ad27a0a117
Detects Quick execution of a series of suspicious commands - MITRE CAR-2013-04-002
2017-10-29 14:24:53 -04:00
juju4
e2213347ad
Merge remote-tracking branch 'upstream/master'
2017-09-09 11:33:18 -04:00
Florian Roth
e06cf6c43f
Service install - net user persistence
2017-08-16 15:16:57 +02:00
juju4
b109a1277e
Detects suspicious process related to rasdial.exe
2017-08-13 16:20:25 -04:00
juju4
012ed4cd7d
Detects execution of executables that can be used to bypass Applocker whitelisting
2017-08-13 16:20:01 -04:00
juju4
f861969e95
tentative rule to detect admin users remote login
2017-08-13 16:19:24 -04:00
juju4
d2ae98b0de
tentative rule to detect admin users interactive login
2017-08-13 16:18:58 -04:00
juju4
21b1c52d1e
forfiles, bash detection
2017-08-13 16:18:13 -04:00
Thomas Patzke
0217cd5b1d
Merge branch 'master' into travis-test-working
2017-08-02 23:03:03 +02:00
Thomas Patzke
f768bf3d61
Fixed parse errors
2017-08-02 22:49:15 +02:00
Thomas Patzke
6f5b9e183c
Merge branch 'master' into travis-test-working
2017-08-02 00:32:52 +02:00
Thomas Patzke
b82a6fdc51
Added wildcards to windows/builtin/win_susp_rundll32_activity.yml
2017-08-02 00:09:34 +02:00
Thomas Patzke
84418d2045
Merged builtin/win_susp_certutil_activity.yml with Sysmon rule
2017-08-02 00:04:28 +02:00
Thomas Patzke
c350a90b21
Merge branch 'master' into rules-juju4
2017-08-01 23:55:53 +02:00
juju4
5b778c9833
yamllint: quote twitter-formatted nickname
2017-07-30 11:42:25 -04:00
juju4
5b42c64fcd
Merge remote-tracking branch 'upstream/master'
2017-07-30 11:12:03 -04:00
juju4
31b033d492
suspicious rundll32 activity rules
2017-07-30 11:11:45 -04:00
juju4
3a8946a3ac
suspicious phantom dll rules
2017-07-30 11:11:17 -04:00
juju4
fbbf29fd80
suspicious cli escape character rules
2017-07-30 11:10:43 -04:00
juju4
83fa83aa43
suspicious certutil activity rules
2017-07-30 11:09:51 -04:00
juju4
f487451c45
more suspicious cli process
2017-07-30 11:09:24 -04:00
Florian Roth
d1cdb3c480
Certutil duplicate entry and "-ping" command
2017-07-23 14:51:57 -06:00
Florian Roth
cdf0894e6a
Corrected error in certutil rules (-f means force overwrite, not file)
...
> the -urlcache is the relevant command
2017-07-20 12:54:55 -06:00
Florian Roth
3a55b31da2
certutil file download - more generic approach
2017-07-20 12:48:47 -06:00
Florian Roth
b85d96e458
certutil detections (renamed, extended)
...
see https://twitter.com/subTee/status/888102593838362624
2017-07-20 12:38:10 -06:00
Florian Roth
8f525d2f01
Wannacry Rules Reorg and Renaming
2017-06-28 09:08:53 +02:00
Florian Roth
3f245d27f8
Eventlog cleared ID 104
2017-06-27 17:29:39 +02:00
Thomas Patzke
7fdc78c8bf
Merge pull request #36 from dim0x69/master
...
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm
2017-06-19 15:32:56 +02:00
Thomas Patzke
a4c9e24380
File renaming while deletion with SDelete
2017-06-14 16:55:32 +02:00
Thomas Patzke
8c06a5d83f
Access to wceaux.dll while WCE pass-the-hash login on source host
2017-06-14 15:59:45 +02:00
Florian Roth
576981820b
Moved PlugX rule & used builtin ID 4688 for another rule
2017-06-12 11:02:49 +02:00
Thomas Patzke
91b3c39c0d
Amended condition
...
Changed condition according to proposed syntax for related event matching (#4 )
2017-06-11 23:54:19 +02:00
dimi
ac95e372e5
clarification: if executed locally there is no connection to the samr pipe on IPC$. So this rule detects remote changes
2017-06-09 14:15:37 +02:00
dimi
a2a2366dfb
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm
2017-06-09 14:05:40 +02:00
Florian Roth
5dd3d4dd57
Generic Hacktool Use Rule
2017-05-31 08:42:35 +02:00
Florian Roth
ae4cab6783
Corrected - no lists needed
2017-05-25 12:07:11 +02:00
dimi
0b8c82b75b
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading
...
2) correct typo in dns server rule
2017-05-15 20:58:31 +02:00
Florian Roth
01e1d3a3d7
WannaCry Service Install
2017-05-15 16:06:16 +02:00
Florian Roth
46643324a8
Wannacrypt Update
2017-05-13 10:40:41 +02:00
Florian Roth
d35b6c0353
Backup catalog deletion rule
2017-05-12 23:00:56 +02:00
Florian Roth
1ab3c746c1
Merge branch 'master' of https://github.com/Neo23x0/sigma
2017-05-12 21:59:43 +02:00
Florian Roth
0b541b2689
Suspicious Windows Process Creations Update
2017-05-12 21:55:30 +02:00
Thomas Patzke
300dbe8f3e
Fixed condition
...
AND has higher precedence than OR.
2017-05-09 23:12:02 +02:00
Florian Roth
565c51e5be
Removed "1 of" expression (no bug, but cleaner)
2017-05-09 22:58:42 +02:00
Florian Roth
a6678e199b
Microsoft Malware Protection Engine Crash - ref CVE-2017-0290
2017-05-09 22:46:57 +02:00
