527 Commits

Author	SHA1	Message	Date
Thomas Patzke	a9cf14438c	Merge branch 'master' into project-1	2019-01-14 22:36:15 +01:00
Thomas Patzke	ed1ee80f2d	Merge pull request #221 from adrienverge/fix/yamllint ... Fix yamllint config	2019-01-13 23:55:14 +01:00
Florian Roth	9a6b3b5389	Rule: PowerShell script run in AppData folders	2019-01-12 12:03:36 +01:00
Florian Roth	604d88cf1e	Rule: WMI Event Subscription	2019-01-12 12:03:36 +01:00
Florian Roth	63f96d58b4	Rule: Renamed PowerShell.exe	2019-01-12 12:03:36 +01:00
Florian Roth	b7eb79f8da	Rule: UserInitMprLogonScript persistence method	2019-01-12 12:03:36 +01:00
Florian Roth	d4a1fe786a	Rule: Dridex pattern	2019-01-12 12:03:36 +01:00
Adrien Vergé	44f18db80d	Fix YAML errors reported by yamllint ... Especially the config for ArcSight, that was invalid: tools/config/arcsight.yml 89:5 error duplication of key "product" in mapping (key-duplicates) 90:5 error duplication of key "conditions" in mapping (key-duplicates) rules/windows/builtin/win_susp_commands_recon_activity.yml 10:9 error too many spaces after colon (colons)	2019-01-10 09:51:39 +01:00
Tareq AlKhatib	8b94860ee6	Corrected class B private IP range to prevent false negatives	2019-01-04 12:50:41 +03:00
Tareq AlKhatib	925ffae9b8	Removed Outlook detection which is a subset of the Office one	2019-01-02 07:47:44 +03:00
Tareq AlKhatib	0a5e79b1e0	Fixed the RC section to use rc.exe instead of oleview.exe	2019-01-01 13:30:26 +03:00
Tareq AlKhatib	f318f328d6	Corrected reference to references as per Sigma's standard	2018-12-25 16:25:12 +03:00
Florian Roth	c8c419f205	Rule: Hacktool Rubeus	2018-12-19 09:31:22 +01:00
Thomas Patzke	75c7d65240	Merge pull request #211 from Cyb3rWard0g/master ... Field-Index Mapping File & SIGMA Rules Field names fix	2018-12-19 00:38:06 +01:00
Florian Roth	99f773dcf6	Rule: false positive reduction in rule	2018-12-17 10:02:55 +01:00
Florian Roth	172236e130	Rule: updated ATT&CK tags in MavInject rule	2018-12-12 09:17:58 +01:00
Florian Roth	188d3a83b8	Rule: docs: reference update in MavInject rule	2018-12-12 08:37:00 +01:00
Florian Roth	6206692bce	Merge pull request #212 from Neo23x0/commandline-issue ... Bugfix: wrong field for 4688 process creation events	2018-12-12 08:24:07 +01:00
Florian Roth	49eb03cda8	Rule: MavInject process injection	2018-12-12 08:18:43 +01:00
Florian Roth	b0cb0abc01	Bugfix: wrong field for 4688 process creation events	2018-12-11 16:10:15 +01:00
Florian Roth	b5d78835b6	Removed overlapping rule with sysmon_office_shell.yml	2018-12-11 13:37:47 +01:00
Roberto Rodriguez	a0486edeea	Field-Index Mapping File & SIGMA Rules Field names fix ... + Updated HELK field-index mapping file + After going through all the fields with 'fieldlist' output, I found a few rules that fixed.	2018-12-11 09:27:26 +03:00
Roberto Rodriguez	8c577a329f	Improve Rule & Updated HELK SIGMA Standardization Config ... Rule should be focusing on the 'process_command_line' field and not just on any value of any event generated by powershell.exe. SIGMA HELK standardization config updated to match latest HELK Common Information Model	2018-12-08 11:30:21 +03:00
Roberto Rodriguez	a35f945c71	Update win_disable_event_logging.yml ... Description value breaking SIGMA Elastalert Backend	2018-12-06 05:09:41 +03:00
Roberto Rodriguez	87ce07088f	Update sysmon_plugx_susp_exe_locations.yml ... Duplicate rule title: https://github.com/Neo23x0/sigma/search?q=Executable+used+by+PlugX+in+Uncommon+Location&unscoped_q=Executable+used+by+PlugX+in+Uncommon+Location This impats Elastalert integration since you cannot have two rules with the same name	2018-12-05 07:58:13 +03:00
Roberto Rodriguez	bff7ec52db	Update av_relevant_files.yml ... Duplicate rule title: https://github.com/Neo23x0/sigma/search?q=Antivirus+Exploitation+Framework+Detection&unscoped_q=Antivirus+Exploitation+Framework+Detection This affetcs Elastalert integration	2018-12-05 07:53:53 +03:00
Roberto Rodriguez	104ee6c33b	Update win_susp_commands_recon_activity.yml ... Rule missing "by CommandLine" which marchs the query_key value of the elastalert format to NULL.	2018-12-05 05:55:36 +03:00
Roberto Rodriguez	328762ed67	Update powershell_xor_commandline.yml ... Ducplicate names again for https://github.com/Neo23x0/sigma/search?q=Suspicious+Encoded+PowerShell+Command+Line&unscoped_q=Suspicious+Encoded+PowerShell+Command+Line . This brakes elastalert integration since each rule needs to have its own unique name.	2018-12-05 05:51:41 +03:00
Roberto Rodriguez	6dc36c8749	Update win_eventlog_cleared.yml ... Experimental Rule is a duplicate of bfc7012043/rules/windows/builtin/win_susp_eventlog_cleared.yml. I renamed it experimental just in case. I believe one of them should be removed. I caught it while transforming every rule to elastalert format	2018-12-05 05:40:00 +03:00
Roberto Rodriguez	c8990962d2	Update win_rare_service_installs.yml ... same count() by ServiceFileName < 5 aded to make sigmac work with elastalert integration	2018-12-05 05:33:56 +03:00
Roberto Rodriguez	f0b23af10d	Update win_rare_schtasks_creations.yml ... Count(taskName) not being taken by elastalert integration with Sigmac	2018-12-05 05:10:08 +03:00
Thomas Patzke	900db72557	Merge branch 'master' of https://github.com/SherifEldeeb/sigma into SherifEldeeb-master	2018-12-04 23:35:23 +01:00
Florian Roth	a805d18bba	Merge pull request #198 from kpolley/consistent_filetype ... changed .yaml files to .yml for consistency	2018-12-03 09:00:14 +01:00
Florian Roth	2ebbdebe46	rule: Cobalt Strike beacon detection via Remote Threat Creation ... https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f	2018-11-30 10:25:05 +01:00
Thomas Patzke	f6ad36f530	Fixed rule	2018-11-29 00:00:18 +01:00
Kyle Polley	60538e2e12	changed .yaml files to .yml for consistency	2018-11-20 21:07:36 -08:00
Florian Roth	a31acd6571	fix: fixed procdump rule	2018-11-17 09:10:26 +01:00
Florian Roth	fd06cde641	Rule: Detect base64 encoded PowerShell shellcode ... https://twitter.com/cyb3rops/status/1063072865992523776	2018-11-17 09:10:09 +01:00
Sherif Eldeeb	23eddafb39	Replace "logsource: description" with "definition" to match the specs	2018-11-15 09:00:06 +03:00
Nate Guagenti	9bfdcba400	Update win_alert_ad_user_backdoors.yml ... add another detection rule for delegation via the attack described in harmj0y's blog: https://www.harmj0y.net/blog/redteaming/another-word-on-delegation/	2018-11-05 21:08:19 -05:00
Florian Roth	37294d023f	Suspicious svchost.exe executions	2018-10-30 09:37:40 +01:00
Florian Roth	580692aab4	Improved procdump on lsass rule	2018-10-30 09:37:40 +01:00
Thomas Patzke	ff98991c80	Fixed rule	2018-10-18 16:20:51 +02:00
Thomas Patzke	a2da73053d	Merge branch 'patch-9' of https://github.com/samsson/sigma into samsson-patch-9	2018-10-18 16:16:57 +02:00
Thomas Patzke	732de3458f	Merge pull request #186 from megan201296/patch-15 ... Update sysmon_cmstp_com_object_access.yml	2018-10-18 15:49:06 +02:00
Thomas Patzke	fdd0823e07	Merge pull request #187 from megan201296/patch-16 ... Additional MITRE ATT&CK Tagging	2018-10-18 15:38:11 +02:00
Florian Roth	fd34437575	fix: fixed date in rule	2018-10-10 15:27:58 +02:00
megan201296	fdd264d946	Update sysmon_susp_powershell_rundll32.yml	2018-10-09 19:11:47 -05:00
megan201296	440b0ddffe	Update sysmon_susp_powershell_parent_combo.yml	2018-10-09 19:11:17 -05:00
megan201296	b0983047eb	Update sysmon_powersploit_schtasks.yml	2018-10-09 19:10:37 -05:00