G Y
|
bdb77780b3
|
Update winlogbeat.yml
Change Imphash's value as current one does not exist without the Sysmon processor module under Winlogbeat.
|
2021-07-10 11:37:36 +08:00 |
|
G Y
|
cb2985df75
|
Update winlogbeat-modules-enabled.yml
Replaced mapping for Imphash (based on Winlogbeat's Sysmon processor module).
|
2021-07-10 10:51:05 +08:00 |
|
mfidel
|
ffadd110cb
|
Update splunkdm.py
|
2021-07-10 00:03:41 +02:00 |
|
mfidel
|
82f8412988
|
Update splunkdm.py
|
2021-07-10 00:02:33 +02:00 |
|
mf1d3l
|
368388a7e6
|
Add Splunk Datamodel backend
|
2021-07-09 23:18:17 +02:00 |
|
Florian Roth
|
99b0d32cec
|
Merge pull request #1666 from frack113/issue_1658
Domain Trust Discovery - 2 Duplicate Rules
|
2021-07-09 19:17:10 +02:00 |
|
frack113
|
17edaa0950
|
combines 2 rules
|
2021-07-09 16:41:03 +02:00 |
|
Florian Roth
|
aa0231e1f8
|
Merge pull request #1664 from frack113/parentofparent
Move to rules-unsupported as use special enrichment field
|
2021-07-09 10:55:22 +02:00 |
|
Florian Roth
|
28cc6d102f
|
Merge pull request #1665 from frack113/hope_last_windows_field_fix
Last fix invalid windows field name
|
2021-07-09 10:54:59 +02:00 |
|
frack113
|
a53e21eb77
|
2 more rule with custom field
|
2021-07-09 10:07:41 +02:00 |
|
frack113
|
14322393f7
|
fix more invalid windows field name
|
2021-07-09 10:02:05 +02:00 |
|
frack113
|
06a05cfad9
|
Move to rules-unsupported as use special enrichment field
|
2021-07-09 07:40:57 +02:00 |
|
Ibrahim Ali Khan
|
8bf07b3575
|
Create ala-azure-ad_auditlogs.yml
Azure AD Audit Logs mapping for Azure Log Analytics
|
2021-07-08 20:40:39 +05:00 |
|
Ibrahim Ali Khan
|
7bba239f56
|
Create ala-azure-activitylogs.yml
Azure Activity Logs mapping for Azure Log Analytics
|
2021-07-08 20:40:03 +05:00 |
|
Ibrahim Ali Khan
|
6849aba266
|
Create ecs-azure-ad_auditlogs.yml
Azure AD Audit Logs Elasticsearch ecs mapping
|
2021-07-08 20:39:05 +05:00 |
|
Ibrahim Ali Khan
|
25dd14829e
|
Create ecs-azure-activitylogs.yml
Azure Activity Logs Elasticsearch ecs mapping
|
2021-07-08 20:37:12 +05:00 |
|
Florian Roth
|
a6952540c9
|
Merge pull request #1659 from SigmaHQ/config-adjustments
refactor: THOR config adjustments
|
2021-07-08 15:37:04 +02:00 |
|
Florian Roth
|
db8cc0ee2d
|
Merge pull request #1656 from SigmaHQ/rule-devel
rule: suspicious vss ps load / PrinternightMare updates
|
2021-07-08 15:03:28 +02:00 |
|
Florian Roth
|
ec13c691ce
|
Merge pull request #1585 from BlackB0lt/patch-6
Create aws_ec2_disable_encryption.yml
|
2021-07-08 14:54:02 +02:00 |
|
Florian Roth
|
c91eda7660
|
Merge pull request #1610 from cianmcgovern/powershell-network-connection
Move ipv6 check to selection fields as filter is negated
|
2021-07-08 14:53:36 +02:00 |
|
Florian Roth
|
0518439de7
|
Merge pull request #1648 from frack113/fix_windows_fields
Fix more windows fields name
|
2021-07-08 14:53:14 +02:00 |
|
Florian Roth
|
8dd80f464a
|
Merge pull request #1657 from SigmaHQ/mdatp-mapping-ext1
Revert "feat: OriginalFileName mapping in MDATP ImageLoad events"
|
2021-07-08 14:52:52 +02:00 |
|
Florian Roth
|
5e7f1f3a36
|
refactor: THOR config adjustments
|
2021-07-08 14:51:49 +02:00 |
|
Florian Roth
|
f78b353352
|
PrinterNightmare rule updates
|
2021-07-08 14:35:51 +02:00 |
|
Florian Roth
|
2055f78780
|
refactor: make the rule more usable
|
2021-07-08 09:05:57 +02:00 |
|
Florian Roth
|
84b181d170
|
Revert "feat: OriginalFileName mapping in MDATP ImageLoad events"
This reverts commit cdc434cfc4.
|
2021-07-08 08:55:33 +02:00 |
|
Florian Roth
|
b055879ec5
|
Merge pull request #1655 from SigmaHQ/mdatp-mapping-ext1
feat: OriginalFileName mapping in MDATP ImageLoad events
|
2021-07-08 08:33:59 +02:00 |
|
Florian Roth
|
79338b2dbd
|
fix: title
|
2021-07-08 08:33:46 +02:00 |
|
Thomas Patzke
|
8e010ec60c
|
Added rule
From https://www.binarydefense.com/analysis-of-hancitor-when-boring-begets-beacon
which weren't already covered by other rules and can be expressed
in Sigma.
|
2021-07-08 07:59:40 +02:00 |
|
Thomas Patzke
|
103a8f8052
|
Removed EventID from generic DNS query rule
|
2021-07-08 07:41:11 +02:00 |
|
Thomas Patzke
|
09c8d42c03
|
Deleted Sysmon config which doesn't makes sense
|
2021-07-08 07:31:49 +02:00 |
|
Florian Roth
|
cdc434cfc4
|
feat: OriginalFileName mapping in MDATP ImageLoad events
|
2021-07-07 18:22:58 +02:00 |
|
Florian Roth
|
96ea35fd92
|
rule: suspicious vss ps load
|
2021-07-07 18:21:57 +02:00 |
|
Florian Roth
|
25dec8a17b
|
Merge pull request #1649 from leegengyu/patch-9
Update win_apt_apt29_thinktanks.yml - Links
|
2021-07-07 18:10:27 +02:00 |
|
Florian Roth
|
8fd5a761a2
|
Merge pull request #1651 from frack113/service_auditd
Rename linux rule with service:auditd
|
2021-07-07 18:10:14 +02:00 |
|
Florian Roth
|
c3c152d457
|
Merge pull request #1652 from SigmaHQ/rule-devel
refactor: changed cmdkey rule
|
2021-07-07 18:09:44 +02:00 |
|
Florian Roth
|
9d6f89f0f2
|
Merge pull request #1654 from frack113/redcanary_t1564
Add 2 defense-evasion T1562.001 rules
|
2021-07-07 18:09:27 +02:00 |
|
frack113
|
8a96aa7855
|
Add 2 defense-evasion T1562.001 rules
|
2021-07-07 15:43:55 +02:00 |
|
Florian Roth
|
0c7661e8bc
|
refactor: changed cmdkey rule
|
2021-07-07 14:45:03 +02:00 |
|
G Y
|
1adac5b036
|
Update win_apt_apt29_thinktanks.yml - Links
Reference links updated with grammar corrections.
|
2021-07-07 20:21:41 +08:00 |
|
frack113
|
f2cdbb5aa7
|
Rename rule service:auditd
|
2021-07-07 13:53:51 +02:00 |
|
frack113
|
4e3b275056
|
Fix more windows fields name
|
2021-07-07 12:28:00 +02:00 |
|
Florian Roth
|
792f234872
|
Merge pull request #1636 from leegengyu/patch-6
powershell_data_compressed.yml - Update selection
|
2021-07-07 10:12:52 +02:00 |
|
Florian Roth
|
2e15742a37
|
Merge pull request #1637 from frack113/fix_win_rdp_reverse_tunnel.yml
win_rdp_reverse_tunnel.yml fix invalid field name
|
2021-07-07 10:12:16 +02:00 |
|
Florian Roth
|
6e00745288
|
Merge pull request #1638 from frack113/fix_win_external_device.yml
win_external_device.yml fix invalid field name
|
2021-07-07 10:12:04 +02:00 |
|
Florian Roth
|
bd0628240c
|
Merge pull request #1639 from frack113/fix_win_possible_dc_shadow.yml
fix invalid field EventID 5136
|
2021-07-07 10:11:51 +02:00 |
|
Florian Roth
|
ad36a03622
|
Merge pull request #1640 from frack113/fix_win_susp_local_anon_logon_created.yml
win_susp_local_anon_logon_created.yml fix invalid case SamAccountName
|
2021-07-07 10:11:36 +02:00 |
|
Florian Roth
|
0019018389
|
Merge pull request #1641 from frack113/upadte_winlogbeat
winlogbeat add some missing fields mapping
|
2021-07-07 10:11:22 +02:00 |
|
Florian Roth
|
1c032c84be
|
Merge pull request #1643 from austinsonger/microsoft365_impossible_travel
Microsoft365 impossible travel
|
2021-07-07 10:11:03 +02:00 |
|
Florian Roth
|
dc2377be13
|
Merge pull request #1644 from leegengyu/patch-7
Update win_admin_rdp_login.yml - Fix Field Name & Value
|
2021-07-07 10:04:02 +02:00 |
|