87 Commits

Author	SHA1	Message	Date
Liam Sennitt	aca36c88cc	add tags to apt slingshot rule	2019-03-13 09:50:39 +00:00
Liam Sennitt	aac632bb41	add tags on apt equationgroup dll_u load rule	2019-03-13 09:48:27 +00:00
Liam Sennitt	5ffc027f22	fix tags in apt carbonpaper turla rule	2019-03-13 09:43:18 +00:00
Liam Sennitt	25b680bfec	fix and add tags to apt bear activity gtr19 rule	2019-03-13 09:40:28 +00:00
Liam Sennitt	3b193fb691	add tags to apt babyshark rule	2019-03-13 09:32:10 +00:00
Liam Sennitt	aee0d1dd67	fix tags on apt29 tor rule	2019-03-13 09:25:28 +00:00
Liam Sennitt	5dc229b590	add tags to apt29 thinktanks rule	2019-03-13 09:22:41 +00:00
Florian Roth	bd38cff042	Merge pull request #272 from LiamSennitt/master ... fix tagging in turla png dropper service rule	2019-03-11 23:48:18 +01:00
Tareq AlKhatib	075df83118	Converted to use the new process_creation data source	2019-03-09 20:57:59 +03:00
Tareq AlKhatib	879017818f	More conversions to the new process_creation logsource	2019-03-05 09:46:53 +03:00
Tareq AlKhatib	b2952b9f78	Fixing failed CI build - take 2	2019-03-04 16:51:39 +03:00
Tareq AlKhatib	c8be6e649b	Fixing failed CI build	2019-03-04 16:44:30 +03:00
Tareq AlKhatib	45458121c6	Updated to use the new process_creation logsource	2019-03-04 16:13:27 +03:00
Tareq AlKhatib	58c61430a2	updated to use process_creation	2019-03-02 21:05:15 +03:00
Liam Sennitt	bef5f03015	fix tagging in turla png dropper service rule	2019-03-02 09:01:00 +00:00
Thomas Patzke	56a1ed1eac	Merge branch 'project-1'	2019-03-02 00:26:10 +01:00
Thomas Patzke	7602309138	Increased indentation to 4 ... * Converted (to generic sigma) rules * Converter outputs by default with indentation 4	2019-03-02 00:14:20 +01:00
Florian Roth	af6a1ff26a	Extended rule, modified timestamp	2019-03-01 13:36:54 +01:00
Liam Sennitt	2345cbf7bd	fix bug in chafer activity rule #269	2019-03-01 10:23:02 +00:00
Thomas Patzke	6bdb4ab78a	Merge cleanup	2019-02-27 22:05:27 +01:00
Florian Roth	e7f5cbc22a	Rule: BabyShark activity	2019-02-24 14:04:44 +01:00
Florian Roth	a60b53a7df	fix: bugfix in BEAR activity rule	2019-02-24 14:04:44 +01:00
Florian Roth	8ae37f5d64	BEAR activity - CrowdStrike GTR 2019 ... https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/	2019-02-21 09:54:01 +01:00
Florian Roth	3a994d0d63	fix: bugfix in Judgement Panda rule	2019-02-21 09:50:49 +01:00
Florian Roth	5935eaa572	fix: added MITRE ATT&CK tags to APT rule	2019-02-21 09:27:59 +01:00
Florian Roth	aca470961a	fix: bugfix in Judgement Panda rule	2019-02-21 09:20:52 +01:00
Florian Roth	c474bfcae5	Judgement Panda - Crowdstrike GTR 2019 ... https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/	2019-02-21 09:20:52 +01:00
Florian Roth	7e732a2a89	Merge pull request #232 from TareqAlKhatib/duplicate_filters ... Duplicate filters	2019-02-09 09:23:57 +01:00
Thomas Patzke	3ef930b094	Escaped '\*' to '\\*' where required	2019-02-03 00:24:57 +01:00
Tareq AlKhatib	7e4bb1d21a	Removed duplicate filters	2019-01-25 12:21:57 +03:00
Florian Roth	b0cb0abc01	Bugfix: wrong field for 4688 process creation events	2018-12-11 16:10:15 +01:00
Florian Roth	2e5a739c6c	fix: fixed author string (cannot be list according to sigma specs)	2018-12-05 11:59:10 +01:00
Florian Roth	9b15b64a9a	fix: fixed author string (cannot be list according to sigma specs)	2018-12-05 11:44:20 +01:00
Thomas Patzke	900db72557	Merge branch 'master' of https://github.com/SherifEldeeb/sigma into SherifEldeeb-master	2018-12-04 23:35:23 +01:00
Florian Roth	3861dd5912	Rule: APT29 campaign against US think tanks ... https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/	2018-12-04 17:04:03 +01:00
AL	9f1df6164b	adding new rules detecting recently active APTs	2018-12-03 09:42:29 +02:00
Florian Roth	7ba1fe4309	Turla PNG Dropper Service Name	2018-11-23 08:46:20 +01:00
Florian Roth	ec83ab5e13	APT28 Zebrocy rule ... https://app.any.run/tasks/54acca9a-394e-4384-a0c8-91a96d36c81d	2018-11-22 19:14:07 +01:00
Sherif Eldeeb	23eddafb39	Replace "logsource: description" with "definition" to match the specs	2018-11-15 09:00:06 +03:00
Thomas Patzke	8308cd6c1a	Rule fix	2018-08-26 22:35:35 +02:00
Thomas Patzke	0e986cae4d	Fixed log source and field names	2018-08-04 22:58:19 +02:00
David Spautz	f039f95f4d	Add tags to APT rules	2018-07-25 09:50:01 +02:00
Florian Roth	56172ae174	Corrected CrackMapExec rule	2018-04-09 08:40:03 +02:00
root	69671733a8	added NCSC CrackMapExecWin Description in apt_dragonfly.yml	2018-04-08 17:10:00 +02:00
Florian Roth	c10da5b734	Improved Chafer activity rule	2018-03-23 10:50:40 +01:00
Florian Roth	a797a281ac	Rule: Chafer / OilRig activity Mar 18 ... https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/	2018-03-23 08:59:16 +01:00
Florian Roth	d9d27fec74	Improved EquationGroup dll load rule	2018-03-11 01:22:04 +01:00
Florian Roth	74c2f91a7d	Extended the Slingshot APT rule	2018-03-10 16:44:18 +01:00
Florian Roth	66d52cfeef	Rule: Defrag deactivation	2018-03-10 15:49:50 +01:00
Florian Roth	ef75f2a248	Minor adjustment in: EquationGroup dll_u load	2018-03-10 12:24:49 +01:00