932 Commits

Author	SHA1	Message	Date
yugoslavskiy	b755d4fb68	Update and rename win_system_owner_user_discovery.yml to win_local_system_owner_account_discovery.yml	2019-11-05 02:31:20 +03:00
yugoslavskiy	9831897b6b	Update win_xsl_script_processing.yml	2019-11-05 01:32:29 +03:00
yugoslavskiy	ce55f80fb6	Update win_xsl_script_processing.yml	2019-11-05 01:31:55 +03:00
zinint	cd1cd48619	Delete win_app_windows_discovery.yml	2019-11-05 01:18:26 +03:00
zinint	a3ec56da07	Update win_xsl_script_processing.yml	2019-11-05 00:02:19 +03:00
zinint	fd6875485b	Add files via upload	2019-11-05 00:00:14 +03:00
zinint	cd43354c04	Delete sysmon_xsl_script_processing.yml	2019-11-04 23:47:23 +03:00
zinint	2679baddcd	Delete powershell_network_sniffing.yml	2019-11-04 23:46:43 +03:00
yugoslavskiy	e81f4f0ea6	Update sysmon_xsl_script_processing.yml	2019-11-04 23:42:47 +03:00
yugoslavskiy	b565398bc5	Update win_network_sniffing.yml	2019-11-04 23:02:03 +03:00
yugoslavskiy	e38116fce2	Update and rename win_data_compressed.yml to win_data_compressed_with_rar.yml	2019-11-04 22:55:32 +03:00
yugoslavskiy	f880fa82b5	Rename process_creation_change_default_file_association.yml to win_change_default_file_association.yml	2019-11-04 22:48:13 +03:00
yugoslavskiy	cbf01aa51e	Update and rename win_change_default_file_association.yml to process_creation_change_default_file_association.yml	2019-11-04 22:46:55 +03:00
zinint	60bf34e220	T1042	2019-10-30 23:30:56 +03:00
zinint	12ef86fcbe	t1040	2019-10-30 23:18:37 +03:00
zinint	b3b203e5b1	t1040	2019-10-30 23:15:19 +03:00
zinint	c243c4e210	T1035	2019-10-29 20:58:52 +03:00
zinint	87c8326133	T1033	2019-10-27 23:49:07 +03:00
zinint	55eaae1cea	Rename win_app_windows_descovery.yml to win_app_windows_discovery.yml	2019-10-27 23:15:10 +03:00
zinint	93b867024c	T1012	2019-10-27 23:13:03 +03:00
zinint	6e94e798be	t1010	2019-10-25 16:12:51 +03:00
zinint	aef5fa3c2b	Rename powershell_winlogon_helper_dll.yaml to powershell_winlogon_helper_dll.yml	2019-10-24 16:37:38 +03:00
zinint	5a98fdbbbd	ART t1004	2019-10-24 16:33:29 +03:00
zinint	317e9d3df9	PS Data Compressed attack.t1002 ... PS Data Compressed attack.t1002	2019-10-24 15:43:46 +03:00
zinint	7c5dc0ca01	Update win_data_compressed.yml	2019-10-24 15:34:13 +03:00
zinint	49f9b797a7	Update sysmon_xsl_script_processing.yml	2019-10-22 15:20:15 +03:00
zinint	a8bd2c8e78	Update win_data_compressed.yml	2019-10-22 14:57:53 +03:00
zinint	74d1fef8b8	Update win_data_compressed.yml	2019-10-22 14:53:43 +03:00
zinint	cc6d4b05ac	OSCD Task 7 : ART T1002 Exfiltration With Rar ... OSCD Task 7 : ART T1002 Compress Data for Exfiltration With Rar	2019-10-22 14:00:52 +03:00
zinint	daf1034621	Update win_possible_applocker_bypass.yml	2019-10-22 00:54:29 +03:00
zinint	789782ef59	Update sysmon_xsl_script_processing.yml	2019-10-22 00:08:46 +03:00
zinint	56f807cb44	Update sysmon_xsl_script_processing.yml	2019-10-22 00:06:54 +03:00
zinint	0d8eff0d86	Update sysmon_xsl_script_processing.yml	2019-10-22 00:06:10 +03:00
zinint	a1d72f20c8	Update sysmon_xsl_script_processing.yml	2019-10-21 23:51:39 +03:00
zinint	5248f83fb3	Update sysmon_xsl_script_processing.yml	2019-10-21 23:46:11 +03:00
zinint	a685c9c3be	Update sysmon_xsl_script_processing.yml	2019-10-21 23:39:33 +03:00
zinint	784d7138ca	OSCD Task 7 ART T1220 ... OSCD Task 7 ART T1220 rule add	2019-10-21 22:22:55 +03:00
Florian Roth	deb3ecf404	fix: relevant fields in lsass dll load rule	2019-10-16 19:09:20 +02:00
Florian Roth	ab292a4029	rule: simplified Emotet rule	2019-10-16 15:29:42 +02:00
Florian Roth	c396526f40	rule: LSASS DLL load via undocumented Registry key ... https://twitter.com/SBousseaden/status/1183745981189427200	2019-10-16 13:18:44 +02:00
Florian Roth	5d143f4f22	rule: emotet rule references extended	2019-10-16 13:18:44 +02:00
Florian Roth	d46154da5c	rule: extending Emotet rule	2019-10-16 10:22:48 +02:00
Florian Roth	4ea469d138	rule: suspicious compression tool parameters	2019-10-15 16:38:53 +02:00
Florian Roth	e870c86fb0	rule: keyboad layout preloads extended with '	2019-10-15 15:11:00 +02:00
Florian Roth	52fef7ae10	Merge pull request #468 from 2d4d/lsass_without_exe ... remove .exe from lsass	2019-10-14 18:03:13 +02:00
Florian Roth	8db1cac910	fix: made rule compatible with event id 4688	2019-10-14 18:01:24 +02:00
Florian Roth	0e2284a176	rule: modified the default	2019-10-14 17:50:48 +02:00
Florian Roth	312311494d	rule: suspicious code page switch using chcp	2019-10-14 17:45:25 +02:00
2d4d	cf5d7f11ad	remove .exe from lsass	2019-10-14 17:26:33 +02:00
Florian Roth	7ee3974428	rule: suspicious keyboard layout load	2019-10-14 16:25:27 +02:00