195 Commits

Author	SHA1	Message	Date
Roberto Rodriguez	c8990962d2	Update win_rare_service_installs.yml ... same count() by ServiceFileName < 5 aded to make sigmac work with elastalert integration	2018-12-05 05:33:56 +03:00
Roberto Rodriguez	f0b23af10d	Update win_rare_schtasks_creations.yml ... Count(taskName) not being taken by elastalert integration with Sigmac	2018-12-05 05:10:08 +03:00
Thomas Patzke	900db72557	Merge branch 'master' of https://github.com/SherifEldeeb/sigma into SherifEldeeb-master	2018-12-04 23:35:23 +01:00
Thomas Patzke	f6ad36f530	Fixed rule	2018-11-29 00:00:18 +01:00
Florian Roth	a31acd6571	fix: fixed procdump rule	2018-11-17 09:10:26 +01:00
Florian Roth	fd06cde641	Rule: Detect base64 encoded PowerShell shellcode ... https://twitter.com/cyb3rops/status/1063072865992523776	2018-11-17 09:10:09 +01:00
Sherif Eldeeb	23eddafb39	Replace "logsource: description" with "definition" to match the specs	2018-11-15 09:00:06 +03:00
Nate Guagenti	9bfdcba400	Update win_alert_ad_user_backdoors.yml ... add another detection rule for delegation via the attack described in harmj0y's blog: https://www.harmj0y.net/blog/redteaming/another-word-on-delegation/	2018-11-05 21:08:19 -05:00
Florian Roth	37294d023f	Suspicious svchost.exe executions	2018-10-30 09:37:40 +01:00
Florian Roth	580692aab4	Improved procdump on lsass rule	2018-10-30 09:37:40 +01:00
Florian Roth	85f0ddd188	Delete win_alert_LSASS_access.yml	2018-10-02 16:48:09 +02:00
Karneades	cc82207882	Add group by to win multiple suspicious cli rule ... * For the detection it's important that these cli tools are started on the same machine for alerting.	2018-09-23 19:38:23 +02:00
Thomas Patzke	81515b530c	ATT&CK tagging QA	2018-09-20 12:44:44 +02:00
Florian Roth	82916f0cff	Merge pull request #159 from t0x1c-1/t0x1c-devel ... Suspicious SYSVOL Domain Group Policy Access	2018-09-08 15:56:54 +02:00
Florian Roth	6f5a73b2e2	style: renamed rule files to all lower case	2018-09-08 10:27:19 +02:00
John Lambert	7ce5b3515b	Create win_susp_powershell_hidden_b64_cmd.yml ... Look in process creation events for powershell commands with base64 encoded content containing suspicious keywords. Require hidden flag to reduce FP.	2018-09-07 20:23:11 -07:00
Florian Roth	3c240be8a8	fix: more duplicate 'tag' keys in rules	2018-09-04 16:15:02 +02:00
Florian Roth	9c878bef79	fix: duplicate 'tag' key in rule	2018-09-04 16:05:21 +02:00
t0x1c-1	afadda8c04	Suspicious SYSVOL Domain Group Policy Access	2018-09-04 15:52:25 +02:00
Florian Roth	d94c1d2046	fix: duplicate 'tag' key in rule	2018-09-04 14:56:55 +02:00
Florian Roth	9cb78558d3	Rule: excluded false positives in rule	2018-09-03 12:02:42 +02:00
Florian Roth	b57f3ded64	Rule: GRR false positives	2018-09-03 11:50:34 +02:00
Florian Roth	2a0fcf6bea	Rule: PowerShell encoded command JAB	2018-09-03 10:08:29 +02:00
Thomas Patzke	ee15b451b4	Fixed log source name	2018-08-27 23:45:30 +02:00
Unknown	2f256aa1ef	Adding LSASS Access Detected via Attack Surface Reduction	2018-08-27 10:38:45 +02:00
Florian Roth	5b3175d1d6	Rule: Suspicious procdump use on lsass process	2018-08-26 19:53:57 +02:00
Florian Roth	f47a5c2206	fix: Author list to string	2018-08-23 09:40:28 +02:00
Florian Roth	6ee31f6cd1	Update win_susp_commands_recon_activity.yml ... Merged recon commands from @yt0ng's rule	2018-08-22 17:00:00 +02:00
Florian Roth	92dc08a304	rule: Added recon command	2018-08-15 12:33:03 +02:00
Florian Roth	acfdb591d0	fiox: Typo in description fixed	2018-07-29 16:22:39 +02:00
Florian Roth	1f845aa1d9	fix: Changed suspicious process creation rule to avoid FPs	2018-07-29 16:22:09 +02:00
Thomas Patzke	0d8bc922a3	Merge branch 'master' into master	2018-07-24 08:23:37 +02:00
David Spautz	e275d44462	Add tags to windows builtin rules	2018-07-24 07:50:32 +02:00
James Dickenson	c4edc26267	windows builtin mitre attack tags	2018-07-23 21:34:20 -07:00
megan201296	a169723005	fixed typo	2018-07-13 13:53:21 -05:00
Thomas Patzke	2dc5295abf	Removed redundant attribute from rule	2018-07-10 22:50:02 +02:00
Florian Roth	dea019f89d	fix: some threat levels adjusted	2018-07-07 13:00:23 -06:00
Florian Roth	c3bf968462	High FP Rule	2018-06-29 16:01:46 +02:00
Florian Roth	c26c3ee426	Trying to fix rule	2018-06-28 16:39:47 +02:00
Florian Roth	9e0abc5f0b	Adjusted rules to the new specs reg "not null" usage	2018-06-28 09:30:31 +02:00
scherma	19ba5df207	False positive circumstance	2018-06-27 21:14:38 +01:00
Florian Roth	86e6518764	Changed (any) statements to (not null) to comply with the newest specs	2018-06-27 20:57:58 +02:00
Florian Roth	a61052fc0a	Rule fixes	2018-06-27 18:47:52 +02:00
Florian Roth	9705366060	Adjusted some rules	2018-06-27 16:54:44 +02:00
Florian Roth	28a7e64212	Rule: Sysprep on AppData folder	2018-06-22 14:02:55 +02:00
Thomas Patzke	7d1b801858	Merge branch 'devel-sigmac-wdatp'	2018-06-22 00:43:23 +02:00
Thomas Patzke	df6ad82770	Removed redundant attribute from rule ... EventID 4657 already implies the modification.	2018-06-21 23:59:55 +02:00
Florian Roth	946c946366	Rule: NTLM logon	2018-06-13 00:08:46 +02:00
Florian Roth	e23cdafb85	Rule: Fixed missing description	2018-06-13 00:08:46 +02:00
Florian Roth	9c817a493b	Rule: DCSync	2018-06-03 16:00:57 +02:00