valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 02:08:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
4,055 Commits 20 Branches 25 Tags 21 MiB
d074ea110f
Commit Graph

4055 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
ecco
ebc1d38027 fix in memory powershell false positive 2020-09-06 09:25:56 -04:00
ecco
b9f7d58dbc fix ADSI rule false positive 2020-09-06 09:17:53 -04:00
grikos
961e4eef4c att&ck tags review: windows/process_creation part 6 2020-09-05 20:35:21 +03:00
Florian Roth
61e8498551
Merge pull request #995 from veritasr3x/master 
Windows Defender LOLBIN
 2020-09-04 17:06:24 +02:00
Florian Roth
22465037ac
Update win_susp_mpcmdrun_download.yml 2020-09-04 16:50:57 +02:00
Florian Roth
3283e33cbc
Update and rename win_lolbas_mpcmdrun.yml to win_susp_mpcmdrun_download.yml 2020-09-04 16:49:44 +02:00
Matthew Matchen
df532be142 Added ID field using UUID generated value 2020-09-04 16:38:52 +02:00
Matthew Matchen
2c69815b7b Removed empty ID field 2020-09-04 16:32:41 +02:00
Matthew Matchen
e0baa097a8 Initial creation 2020-09-04 16:00:23 +02:00
veritasr3x
3e8dda723b
Merge pull request #1 from Neo23x0/master 
Repo Update
 2020-09-04 15:46:10 +02:00
aw350m3
bd5026f6b9 fixed typos in tags 2020-09-03 14:29:05 +00:00
aw350m3
198e42d724 deleted extra spaces 2020-09-03 14:22:31 +00:00
aw350m3
b00047a4e8 att&ck tags review: application, apt, cloud, generic, proxy 2020-09-03 14:16:54 +00:00
Alexey Lednyov
cf011e4a00 Removed duplicate key 'modified' 2020-09-03 17:12:37 +03:00
Alexey Lednyov
1eb675f693 att&ck tags review: web, network/zeek 2020-09-03 17:06:37 +03:00
Florian Roth
4ade5bd957
Merge pull request #991 from Neo23x0/rule-devel 
Rule devel
 2020-09-03 12:15:05 +02:00
Florian Roth
720ac0d998
fix: syntax bug in rule 2020-09-03 09:18:28 +02:00
Yugoslavskiy Daniil
71fec94417 review network/cisco/aaa 2020-09-03 00:34:41 +02:00
Florian Roth
198469bed3 Merge branch 'master' into rule-devel 2020-09-02 17:40:12 +02:00
Florian Roth
423f81c912
Update win_mouse_lock.yml 2020-09-02 14:49:37 +02:00
Florian Roth
73bc514f60 fix: 1 of them / one selection 2020-09-02 12:34:35 +02:00
Florian Roth
7ddb63ec1b fix: FPs with McAfee and CyberReason 2020-09-02 12:30:34 +02:00
Yugoslavskiy Daniil
11e0f794d9 review windows/process_creation part 4 2020-09-02 02:34:34 +02:00
aw350m3
7c6c5263ab fix duplication of key modified in win_malware_emotet.yml 2020-09-01 17:09:54 +00:00
aw350m3
8ed3eb1494 att&ck tags review: windows/process_creation part 3 2020-09-01 17:02:59 +00:00
grikos
65d201b1e4 att&ck tags review: windows/process_creation part 7 2020-08-30 19:17:38 +03:00
Yugoslavskiy Daniil
e04b896cbc fix tags 2020-08-29 21:34:20 +02:00
grikos
a95c4347d9 fixed typo in tag 2020-08-29 20:19:46 +03:00
grikos
6092bfcec1 att&ck tags review: windows/process_creation part 9 2020-08-29 19:22:09 +03:00
grikos
6eadfccc68 Merge branch 'master' of https://github.com/oscd-initiative/sigma 2020-08-29 12:30:45 +03:00
aw350m3
ae99a2b207 Removed extra space that broke tests 2020-08-29 04:46:12 +00:00
aw350m3
4ed3db8d23 Merge branch 'master' of github.com:oscd-initiative/sigma 2020-08-29 04:39:45 +00:00
aw350m3
da766a245f att&ck tags review: windows/process_creation part 2 2020-08-29 04:39:30 +00:00
Yugoslavskiy Daniil
cd12ab8a77 Merge branch 'master' of https://github.com/oscd-initiative/sigma 2020-08-29 02:03:39 +02:00
Yugoslavskiy Daniil
5b70cfd3f7 review windows/sysmon 2020-08-29 02:03:28 +02:00
yugoslavskiy
21a8667720
Merge pull request #1 from zinint/master 
Linux rules reviewed
 2020-08-29 01:55:24 +02:00
yugoslavskiy
a3ec8729c6
Merge pull request #2 from grikos/attack_tags_review_process_creation_8 
attack_tags_review_process_creation_8
 2020-08-29 01:55:09 +02:00
grikos
3783b34832 Merge branch 'master' of https://github.com/grikos/sigma 2020-08-28 17:17:11 +03:00
grikos
293662810e att&ck tags review: windows/process_creation part 8 2020-08-28 17:14:26 +03:00
vh
a2fec9f3b9 Fix sysmon backend 2020-08-28 12:26:40 +03:00
Alexey Lednyov
880b10cce1 att&ck tags review: windows/process_creation part 1, network 2020-08-27 20:43:47 +03:00
Florian Roth
7d3a6293f5 rule: Snatch ransomware 2020-08-26 09:42:34 +02:00
aw350m3
eb6b9be5a2 added missing ATT&CK v6.3 IDs with comments and removed unnecessary "modified" attributes 2020-08-25 23:51:22 +00:00
Thomas Patzke
bae09e9447 Sigmatools release 0.18.1 2020-08-26 00:06:25 +02:00
grikos
ac0e42d0e2
Merge pull request #2 from aw350m33d/master 
sync master
 2020-08-25 23:07:48 +03:00
Thomas Patzke
b742e4ef08
Merge pull request #990 from neu5ron/es_backend 
ES and Readme from SOC Prime
 2020-08-25 21:34:55 +02:00
Nate Guagenti
f21b3c50c6 control whether to use an analyzed field or different type if a query/value contains a wildcard. 
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com>
 2020-08-25 13:13:18 -04:00
Nate Guagenti
a7ffb96b6b elasticsearch regex escape of '.' for case insensitivity backend options 
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com>
 2020-08-25 13:10:25 -04:00
Nate Guagenti
474e04dfe3 add new options to readme for elasticbackend 
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com>
 2020-08-25 13:00:22 -04:00
Nate Guagenti
76910eaee4 fix sub field name usage if there are 3 or more fields.. 
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com>
 2020-08-25 12:56:57 -04:00