1618 Commits

Author	SHA1	Message	Date
Florian Roth	a9d6295791	Rule: Sysmon Malware Shellcode in Verclsid Process	2017-03-04 10:38:23 +01:00
Florian Roth	15e61a9681	Rule: Certutil Decode in AppData	2017-03-02 11:28:34 +01:00
Florian Roth	b6459a00ab	Two new Sysmon rules for Office Macro/PS detection	2017-03-02 11:06:53 +01:00
Florian Roth	8559837aab	Removed Sysmon EventLog from selection > via 'logsource'	2017-03-02 11:06:20 +01:00
Florian Roth	b4f2a74371	Proposed changes to mimimkatz-inmemory aggregation	2017-03-01 10:16:43 +01:00
Florian Roth	b1446f9b87	Removed 'last' keyword from 'timeframe' fields	2017-02-28 17:52:40 +01:00
Thomas Patzke	15c6f9411b	Rule review ... * Typos * Added false positive descriptions	2017-02-24 23:44:42 +01:00
Thomas Patzke	a4611d6dc6	Added new rules ... From adsecurity.org: * https://adsecurity.org/?p=1772 * https://adsecurity.org/?p=1714	2017-02-19 22:43:27 +01:00
Florian Roth	52d04e52ac	Removed lists from log source section	2017-02-19 11:08:40 +01:00
Florian Roth	166f207dc0	Sysmon rules 'logsource' change	2017-02-19 09:19:06 +01:00
Florian Roth	cd6e24c5ff	Added "logsource" sections and new rule	2017-02-19 00:31:59 +01:00
Thomas Patzke	9a38d6543f	Fixed type of condition	2017-02-16 23:49:34 +01:00
Florian Roth	18fd63f6b7	Levels to low, medium, high, critical	2017-02-16 18:06:22 +01:00
Thomas Patzke	88270fcf2d	Rule review and cleanup ... * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result.	2017-02-15 23:53:08 +01:00
Florian Roth	a6173df0b9	LSASS Remote Thread Update	2017-02-12 16:33:09 +01:00
Florian Roth	04ea201817	New rules and cleanup	2017-02-12 15:50:39 +01:00
Florian Roth	a2adb1ddb5	Renamed rule files, new rules	2017-02-10 19:17:02 +01:00
Florian Roth	1307a45fd5	Moved rules to a separate directory	2017-02-07 00:44:40 +01:00