814 Commits

Author	SHA1	Message	Date
Florian Roth	aaeb72a2b6	fix: FPs	2021-02-01 11:47:23 +01:00
Florian Roth	33fee6af8b	rule: security product uninstallation	2021-01-30 11:24:08 +01:00
Florian Roth	e533b4effb	fix: tags	2021-01-28 13:51:51 +01:00
Florian Roth	cd4491cba2	rule: disable volume snaptshots	2021-01-28 13:48:30 +01:00
Florian Roth	7d99a48bb2	rule: new Quakbot pattern	2021-01-25 12:03:30 +01:00
Florian Roth	b62c705bf0	Improved UNC2452 activity rules	2021-01-22 09:18:11 +01:00
Florian Roth	4ad70f0aaa	rule: Raccine uninstall	2021-01-21 17:59:17 +01:00
Florian Roth	c5a7558ca0	fix: fixed actor name in description	2021-01-21 09:19:51 +01:00
Florian Roth	a0b8eeac6f	fix: minor issues	2021-01-20 18:52:50 +01:00
Florian Roth	8b319e3686	rule: UNC2452 PowerShell pattern	2021-01-20 18:51:49 +01:00
Florian Roth	eedc483be4	rework: impossible rule with Sysmon	2021-01-19 14:12:40 +01:00
Florian Roth	63cc0d23c6	changes provided by FPT.EagleEye Team in ... https://github.com/Neo23x0/sigma/pull/1218/files	2021-01-09 10:38:20 +01:00
yugoslavskiy	5ec4e42569	Merge pull request #1165 from w0rk3r/oscd3 ... [OSCD] Updated win_etw_trace_evasion - Added new detections, Removed reference to deprecated rule and changed selections	2021-01-06 00:12:22 +03:00
Florian Roth	ab408750ac	Merge pull request #1314 from Neo23x0/rule-devel ... rule: Lazarus activity	2020-12-30 13:27:38 +01:00
Florian Roth	9ecaeb715f	Merge pull request #1317 from rtkdmasse/fix-missing-product-mouse-lock ... Fix missing product mouse lock	2020-12-30 13:27:20 +01:00
ZikyHD	8a6b182fee	Update win_susp_adfind.yml	2020-12-29 14:41:46 +01:00
ZikyHD	ece829bb25	Update win_susp_adfind.yml ... Typo on field name	2020-12-29 14:40:36 +01:00
Daniel Masse	bf539fd1fe	Revert "Fix bug changing the logsource service to category" ... This reverts commit 0f51e53d0e.	2020-12-23 15:50:49 -05:00
Daniel Masse	71ea5c7437	Add missing product in logsource	2020-12-23 15:45:00 -05:00
Daniel Masse	0f51e53d0e	Fix bug changing the logsource service to category	2020-12-23 15:12:31 -05:00
Florian Roth	dedc34e91a	fix: typos and description	2020-12-23 14:46:08 +01:00
Florian Roth	cdc29dfbe8	rule: Lazarus activity	2020-12-23 14:43:32 +01:00
Florian Roth	821af35557	Merge pull request #1313 from Neo23x0/rule-devel ... Rule devel	2020-12-23 13:57:11 +01:00
Florian Roth	7286d01f78	fix: typo in rule	2020-12-23 13:26:44 +01:00
Florian Roth	80aa398392	rule: Lazarus group loaders	2020-12-23 13:25:16 +01:00
Florian Roth	f20f346a6a	Merge pull request #1264 from omkar72/sdev-1 ... Adding 2 rules - Conhost & office test registry persistence	2020-12-21 18:28:59 +01:00
Florian Roth	e78d7e6aee	Merge pull request #1296 from mat-gas/fix-references ... fix "references" field + add test for references in plural form	2020-12-21 18:25:35 +01:00
Florian Roth	377454cb31	Merge pull request #1299 from tjgeorgen/patch-1 ... ATT&CK subtechnique tag updates	2020-12-21 18:24:00 +01:00
Florian Roth	1b0aaf62c3	Merge pull request #1266 from omkar72/ryuk ... modifying couple of rules	2020-12-13 19:05:54 +01:00
Florian Roth	e2ade077ed	Merge pull request #1275 from bczyz1/patch-3 ... update win_apt_slingshot.yml	2020-12-13 19:04:47 +01:00
Florian Roth	612008a4d8	fix identation	2020-12-11 18:40:17 +01:00
Tran Trung Hieu	edc79a8bb6	Detects suspicious shell spawn from MSSQL process, this might be sight of RCE or SQL Injection	2020-12-11 15:17:23 +07:00
Florian Roth	b6d62b7a21	Merge pull request #1302 from Neo23x0/rule-devel ... TA505 Dropper, minor fix in PowerShell Rule	2020-12-08 10:40:07 +01:00
Florian Roth	640470cefd	TA505 Loader Rule	2020-12-08 10:15:30 +01:00
tjgeorgen	1c6c3a36fe	include updated RDP att&ck tag	2020-12-04 11:59:23 -05:00
tjgeorgen	0eda1ab462	also update tag for folder variant	2020-12-04 11:42:05 -05:00
tjgeorgen	5208bdd65a	add new version of ATT&CK T1500 tag	2020-12-04 11:19:16 -05:00
OG	8e801ede32	Update win_susp_psexec_eula.yml	2020-11-29 17:45:29 +05:30
mat	b3e36281b5	fix reference field + add test for references in plural form	2020-11-27 10:17:45 +01:00
Florian Roth	c6fc9de144	New Trickbot wermgr rule	2020-11-26 09:54:27 +01:00
Florian Roth	c111ab3141	Improved Trickbot recon rule	2020-11-26 09:54:13 +01:00
bczyz1	05398ae95e	change field newprocessname -> image	2020-11-23 13:43:19 +01:00
bczyz1	193021eff8	Update win_apt_slingshot.yml ... fix condition	2020-11-20 09:19:03 +01:00
Florian Roth	af4d546408	Merge pull request #1282 from Neo23x0/rule-devel ... fix: FPs with notepad++ GUP rule	2020-11-10 13:39:28 +01:00
Florian Roth	2e9d7951a6	Merge pull request #1272 from bczyz1/patch-2 ... Fix typo in win_apt_lazarus_session_hijack.yml	2020-11-10 13:35:08 +01:00
Florian Roth	f6c0fb2d33	fix: FPs with notepad++ GUP rule	2020-11-09 16:34:12 +01:00
Florian Roth	c3785d6dc7	rule: FPs with WmiPrvSE rule	2020-11-05 16:44:33 +01:00
bczyz1	c554aaea8f	update win_apt_slingshot.yml ... - optimized rule - added detection of task modification (flag /change + /disable as described here https://stackoverflow.com/questions/26169582/does-anyone-know-of-a-way-to-turn-off-windows-defragmenters-default-schedule-us)	2020-11-05 15:51:22 +01:00
bczyz1	4a5b2d642e	Fix typo in win_apt_lazarus_session_hijack.yml	2020-11-03 14:46:29 +01:00
omkargudhate22	f1bb9726ca	updated mitre tag	2020-10-30 13:35:40 +05:30