Florian Roth
d8af435827
rule: RUN key pointing to suspicious folders
2019-10-01 16:08:31 +02:00
Florian Roth
c44f940fb6
rule: suspicious RUN key created by exe in temp/download folders
2019-10-01 16:08:13 +02:00
Florian Roth
52df9e9f44
rule: execution in Outlook temp folder
2019-10-01 16:07:43 +02:00
Florian Roth
9a7ef0e3c2
fix: fixed rule warning
2019-09-30 19:38:40 +02:00
Florian Roth
2fbd35053e
rule: improved formbook detection rule
2019-09-30 19:01:40 +02:00
Florian Roth
38831a05ae
rule: formbook malware process creation
2019-09-30 18:57:58 +02:00
Florian Roth
05ca684962
rule: improved emotet rule
2019-09-30 17:17:23 +02:00
Florian Roth
66cbdbfff5
rule: emotet process creation
2019-09-30 15:53:29 +02:00
Thomas Patzke
d4f89ebc1c
Aggregation on keyword field in es-dsl backend
...
* Fixes #452
* Further fixed reference to count in restriction of results
2019-09-29 23:18:17 +02:00
Florian Roth
93227e1eec
Merge pull request #436 from EccoTheFlintstone/master
...
rule: impacket framework lateralization detection
2019-09-28 11:37:07 +02:00
Florian Roth
ad59c90b29
Capitalization in Title
2019-09-28 10:30:16 +02:00
Florian Roth
0eb5fd75e1
Merge pull request #446 from EccoTheFlintstone/eventclear
...
move wevtutil / fsutil events from ransomware to dedicated rules
2019-09-28 10:29:03 +02:00
Florian Roth
de3a843bea
Merge pull request #457 from EccoTheFlintstone/sysmon_eventid3
...
sysmon eventid 3: filter on outgoing connections (initiated: true) to…
2019-09-28 10:16:02 +02:00
Florian Roth
29c5a9dc8e
Merge pull request #458 from EccoTheFlintstone/psexec
...
fix: PsExec false positives
2019-09-28 10:15:23 +02:00
Florian Roth
d44f89454e
Merge pull request #462 from EccoTheFlintstone/taskmgr
...
Sysmon rules cleanup and move to process_creation
2019-09-28 09:54:26 +02:00
ecco
5a15687c6c
fix rule: task manager as parent: task manager can be run with higher privileges (show processes from all users --> UAC) and its parent is still the old taskmgr
2019-09-27 11:06:21 -04:00
ecco
7a1d48cccd
fix: PsExec false positives
2019-09-26 04:50:43 -04:00
Florian Roth
36bcd1c54e
Merge pull request #443 from EccoTheFlintstone/aduserbck
...
fix FP : field null value can be '-'
2019-09-25 17:43:22 +02:00
Florian Roth
3d333290a9
Merge pull request #445 from EccoTheFlintstone/localadmin
...
rule: user added to local administrator: handle non english systems b…
2019-09-25 17:29:41 +02:00
Florian Roth
8063484b0d
Merge pull request #447 from Galapag0s/patch-1
...
Added Sticky Bits
2019-09-25 17:28:48 +02:00
Florian Roth
e77657db2f
Merge pull request #451 from EccoTheFlintstone/sysmon_clean
...
sysmon rules cleanup and move to process_creation
2019-09-25 17:28:23 +02:00
Florian Roth
365a46e27e
Merge pull request #454 from EccoTheFlintstone/no_tab
...
remove TAB from cli escape as it's currently unsupported in sigmac
2019-09-25 17:27:56 +02:00
Florian Roth
596140543d
Merge pull request #455 from EccoTheFlintstone/ruler_fix
...
Ruler fix
2019-09-25 17:26:55 +02:00
Florian Roth
ca5b11c622
Merge pull request #456 from EccoTheFlintstone/pth
...
fix PtH rule : field name in event 4624 is SubjectUserSid with null S…
2019-09-25 17:26:22 +02:00
ecco
4c54e8322a
sysmon eventid 3: filter on outgoing connections (initiated: true) to avoid false positives
2019-09-25 11:11:22 -04:00
Florian Roth
7b8b1db241
rule: proxy ua unknown zero day implant
2019-09-24 18:24:48 +02:00
ecco
a644b938a0
fix PtH rule : field name in event 4624 is SubjectUserSid with null SID value (S-1-0-0)
2019-09-23 05:44:26 -04:00
ecco
6a7f7e0f76
add microsoft reference for events fields names
2019-09-23 05:21:30 -04:00
ecco
d48b63a235
ruler rule field name fix for eventID 4776
2019-09-23 05:17:35 -04:00
ecco
c2868f6e03
remove TAB from cli escape as it's currently unsupported in sigmac
2019-09-23 04:46:10 -04:00
Thomas Patzke
9630635e25
Merge branch 'herrBez-addt push origin master-datefield-xpack-watcher'
2019-09-12 00:20:28 +02:00
Thomas Patzke
19f431b6d2
Changed xpack-watcher dateField default to previous value
2019-09-12 00:19:58 +02:00
ecco
0c96777f6a
sysmon rules cleanup and move to process_creation
2019-09-11 10:24:43 -04:00
ecco
4c5eab88b6
add GroupSid to other configs
2019-09-11 04:53:30 -04:00
herrBez
8f612f743c
Use config dateField in xpack watcher to determine
...
datefield name as in elasticsearch dsl backend
2019-09-11 09:38:03 +02:00
Florian Roth
038900e2fe
fix: renamed powershell rule
2019-09-06 17:33:56 +02:00
Galapag0s
ccdda5e82b
Update lnx_shell_priv_esc_prep.yml
2019-09-06 11:29:42 -04:00
Galapag0s
23021aa110
Added Sticky Bits
...
Attackers may look to exploit binaries with the sticky bits enabled. By being able to run a binary as a different user or group, they may be able to run separate commands as an elevated user.
2019-09-06 11:25:48 -04:00
ecco
b410710338
move wevtutil / fsutil events from ransomware to dedicated rules
2019-09-06 10:57:03 -04:00
ecco
5ae46ac56d
rule: user added to local administrator: handle non english systems by using group sid instead of name
2019-09-06 06:21:42 -04:00
ecco
fe93d84015
fix FP : field null value can be '-'
2019-09-06 05:14:58 -04:00
Florian Roth
7f1b6eb311
fix: duplicate rule
2019-09-06 10:30:47 +02:00
Florian Roth
fcbae16cc8
rule: image debugger
2019-09-06 10:28:20 +02:00
Florian Roth
2ec1f710f3
Merge pull request #441 from EccoTheFlintstone/powershell_rules
...
powershell false positives
2019-09-06 10:19:45 +02:00
ecco
01956f1312
powershell false positives
2019-09-06 03:54:19 -04:00
Thomas Patzke
c80cb418cd
Improved QRadar regular expression support
2019-09-05 15:35:26 +02:00
Thomas Patzke
30b6db8299
Fixed ES backend keyword field mapping wildcard match pattern
2019-09-05 12:55:10 +02:00
Thomas Patzke
3b1cbe529e
Elasticsearch keyword field name blacklisting with wildcards
2019-09-05 12:38:32 +02:00
Thomas Patzke
afe6668fbd
Merge pull request #438 from duzvik/master
...
Escaped '\*' to '\*' where required
2019-09-05 10:57:25 +02:00
Thomas Patzke
2a60c71b9d
Merge pull request #437 from svent/qradar_regex_modifier
...
QRadar backend: add support for re type modifiers
2019-09-05 10:30:18 +02:00
