154 Commits

Author	SHA1	Message	Date
Florian Roth	d1cdb3c480	Certutil duplicate entry and "-ping" command	2017-07-23 14:51:57 -06:00
Florian Roth	cdf0894e6a	Corrected error in certutil rules (-f means force overwrite, not file) ... > the -urlcache is the relevant command	2017-07-20 12:54:55 -06:00
Florian Roth	3a55b31da2	certutil file download - more generic approach	2017-07-20 12:48:47 -06:00
Florian Roth	b85d96e458	certutil detections (renamed, extended) ... see https://twitter.com/subTee/status/888102593838362624	2017-07-20 12:38:10 -06:00
Florian Roth	950a00f33e	Updated Petya rule	2017-06-28 12:52:58 +02:00
Florian Roth	ece1d7e3a8	Added perfc.dat keyword to NotPetya rule	2017-06-28 10:35:42 +02:00
Florian Roth	a3e0e37163	NotPetya Title Fixed	2017-06-28 09:12:39 +02:00
Florian Roth	8c437de970	NotPetya Sigma Rule for Sysmon Events	2017-06-28 09:09:12 +02:00
Florian Roth	8f525d2f01	Wannacry Rules Reorg and Renaming	2017-06-28 09:08:53 +02:00
Florian Roth	3f245d27f8	Eventlog cleared ID 104	2017-06-27 17:29:39 +02:00
Thomas Patzke	7fdc78c8bf	Merge pull request #36 from dim0x69/master ... rule to detect mimikatz lsadump::changentlm and lsadump::setntlm	2017-06-19 15:32:56 +02:00
Florian Roth	d1f1bd59da	Changed level of PsExec events to 'low'	2017-06-17 08:50:16 +02:00
Thomas Patzke	a4c9e24380	File renaming while deletion with SDelete	2017-06-14 16:55:32 +02:00
Thomas Patzke	8c06a5d83f	Access to wceaux.dll while WCE pass-the-hash login on source host	2017-06-14 15:59:45 +02:00
Thomas Patzke	4fcdcc3967	Added rule for PsExec	2017-06-12 23:57:06 +02:00
Florian Roth	576981820b	Moved PlugX rule & used builtin ID 4688 for another rule	2017-06-12 11:02:49 +02:00
Thomas Patzke	91b3c39c0d	Amended condition ... Changed condition according to proposed syntax for related event matching (#4)	2017-06-11 23:54:19 +02:00
dimi	ac95e372e5	clarification: if executed locally there is no connection to the samr pipe on IPC$. So this rule detects remote changes	2017-06-09 14:15:37 +02:00
dimi	a2a2366dfb	rule to detect mimikatz lsadump::changentlm and lsadump::setntlm	2017-06-09 14:05:40 +02:00
Florian Roth	371b41acd9	Improved regsvr32.exe whitelisting bypass rule ... thanks to Nick Carr https://twitter.com/ItsReallyNick/status/872409920938946560	2017-06-07 13:46:36 +02:00
Florian Roth	e5ad1b2f84	Improved regsvr32 whitelisting bypass rule	2017-06-07 12:02:55 +02:00
Florian Roth	1fd7a92e87	Regsvr32.exe anomalies (bugfix and new selection)	2017-06-07 11:43:25 +02:00
Florian Roth	5dd3d4dd57	Generic Hacktool Use Rule	2017-05-31 08:42:35 +02:00
Florian Roth	0c222134b9	Extended malware script dropper rule	2017-05-25 14:59:16 +02:00
Florian Roth	0685e297c8	Improved Suspicious Net.exe Execution Rule	2017-05-25 12:44:56 +02:00
Florian Roth	ae4cab6783	Corrected - no lists needed	2017-05-25 12:07:11 +02:00
Florian Roth	6ad5f82248	Corrected rule	2017-05-25 12:06:23 +02:00
dimi	0b8c82b75b	1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading ... 2) correct typo in dns server rule	2017-05-15 20:58:31 +02:00
Florian Roth	01e1d3a3d7	WannaCry Service Install	2017-05-15 16:06:16 +02:00
Florian Roth	75e55d647b	Fixed and added strings	2017-05-13 18:33:51 +02:00
Florian Roth	46643324a8	Wannacrypt Update	2017-05-13 10:40:41 +02:00
Florian Roth	c40c592fb5	Changed rule as "m.vbs" isn't stable	2017-05-13 08:32:30 +02:00
Florian Roth	7c56992de5	Reference in WannaCrypt rule	2017-05-12 23:02:13 +02:00
Florian Roth	d35b6c0353	Backup catalog deletion rule	2017-05-12 23:00:56 +02:00
Florian Roth	b7837d4cdb	Fixed WannaCrypt rule	2017-05-12 22:32:40 +02:00
Florian Roth	1ab3c746c1	Merge branch 'master' of https://github.com/Neo23x0/sigma	2017-05-12 21:59:43 +02:00
Florian Roth	5cdb2b013b	WannaCrypt Ransomware	2017-05-12 21:57:53 +02:00
Florian Roth	0b541b2689	Suspicious Windows Process Creations Update	2017-05-12 21:55:30 +02:00
Thomas Patzke	300dbe8f3e	Fixed condition ... AND has higher precedence than OR.	2017-05-09 23:12:02 +02:00
Florian Roth	565c51e5be	Removed "1 of" expression (no bug, but cleaner)	2017-05-09 22:58:42 +02:00
Florian Roth	a6678e199b	Microsoft Malware Protection Engine Crash - ref CVE-2017-0290	2017-05-09 22:46:57 +02:00
Florian Roth	96deef7d34	Updated sigma signature	2017-05-08 21:25:07 +02:00
Florian Roth	16ac2337a4	Suspicious DNS Server Config Error - Sysmon Rule	2017-05-08 13:39:50 +02:00
Florian Roth	75e58b8142	Bugfix and date	2017-05-08 13:10:40 +02:00
Florian Roth	263c98a2c8	Suspicious DNS Server Config Error - ServerLevelPluginDLL issue	2017-05-08 13:09:50 +02:00
Florian Roth	c7cc2a00d3	WScript/CScript Dropper	2017-05-05 17:30:46 +02:00
Florian Roth	dc4ae35be1	Schtasks frequency - minute	2017-04-28 17:03:35 +02:00
Florian Roth	a5c3f424c1	regsvr32 Anomalies	2017-04-16 12:02:29 +02:00
Florian Roth	769156a83b	Minor fix > list to single value	2017-04-16 12:01:03 +02:00
Florian Roth	8363b25888	Suspicious Control Panel DLL Load	2017-04-15 23:32:26 +02:00