Florian Roth
|
d101c9893a
|
Merge pull request #1623 from SigmaHQ/rule-devel
rule: mimikatz printernightmare
|
2021-07-04 14:28:44 +02:00 |
|
Florian Roth
|
400fae4dba
|
Merge pull request #1609 from cianmcgovern/graylog-fix
Escape spaces in graylog backend
|
2021-07-04 14:20:07 +02:00 |
|
Florian Roth
|
1e152bf594
|
Merge pull request #1615 from leegengyu/patch-1
Update powershell_data_compressed.yml - Outdated link
|
2021-07-04 14:19:55 +02:00 |
|
Florian Roth
|
062198550d
|
Merge pull request #1620 from leegengyu/patch-2
Update win_susp_sdelete.yml - Outdated Link and Typo
|
2021-07-04 14:19:31 +02:00 |
|
Florian Roth
|
4de3378e5a
|
Merge pull request #1621 from leegengyu/patch-3
Update sysmon_susp_pfx_file_creation.yml - Typo
|
2021-07-04 14:19:18 +02:00 |
|
Florian Roth
|
3d47fec2d8
|
Merge pull request #1622 from frack113/elastalert_issue
Change getRuleName() to get 'id-title' instead of ('id' or 'title')
|
2021-07-04 14:19:02 +02:00 |
|
Florian Roth
|
fd5b7506d1
|
refactor: changed rule contents, removed eventIDs
|
2021-07-04 14:03:28 +02:00 |
|
Florian Roth
|
62b25cadf1
|
rule: mimikatz printernightmare
|
2021-07-04 13:47:56 +02:00 |
|
frack113
|
8fd81acee4
|
Change getRuleName() to get 'id-title' instead of ('id' or 'title')
|
2021-07-04 11:56:59 +02:00 |
|
G Y
|
a60a2feb17
|
Update sysmon_susp_pfx_file_creation.yml
Fixed typo.
|
2021-07-04 10:38:53 +08:00 |
|
G Y
|
268c97f23a
|
Update win_susp_sdelete.yml
Update old links and typo.
|
2021-07-04 09:53:23 +08:00 |
|
G Y
|
c63439e74d
|
Update powershell_data_compressed.yml
Changed reference link from `.yaml` to `.md`.
|
2021-07-04 08:15:29 +08:00 |
|
Austin Songer
|
0fed527689
|
Delete aws_ec2_full_network_packet_capture_detected.yml
|
2021-07-03 13:25:12 -05:00 |
|
Austin Songer
|
297861c7ee
|
Create aws_ec2_full_network_packet_capture_detected.yml
|
2021-07-03 13:24:51 -05:00 |
|
Florian Roth
|
a02b7a2390
|
Merge pull request #1617 from SigmaHQ/rule-devel
rule: REvil Kaseya patterns
|
2021-07-03 17:32:18 +02:00 |
|
Florian Roth
|
d188932748
|
Merge pull request #1616 from frack113/update_win_renamed_powershell.yml
Tune detection in win_renamed_powershell.yml
|
2021-07-03 17:04:52 +02:00 |
|
Florian Roth
|
48621d68ff
|
Merge pull request #1613 from leegengyu/powershell_powerview_malicious_commandlets_additions
Update powershell_powerview_malicious_commandlets.yml - Addition and Miscellaneous
|
2021-07-03 17:04:29 +02:00 |
|
Florian Roth
|
1d82ac50e4
|
refactor: additional pattern, extended description
|
2021-07-03 17:03:40 +02:00 |
|
Florian Roth
|
57b816f49d
|
rule: REvil Kaseya patterns
|
2021-07-03 16:34:02 +02:00 |
|
frack113
|
02100f1a3c
|
Tune detection in win_renamed_powershell.yml
|
2021-07-03 15:18:01 +02:00 |
|
G Y
|
d247766a2e
|
Update powershell_data_compressed.yml
Corrected old link and formatting.
|
2021-07-03 20:48:03 +08:00 |
|
Florian Roth
|
e7144b34ee
|
fix: bug in syntax
|
2021-07-03 13:19:56 +02:00 |
|
Florian Roth
|
2d0cdc16fc
|
added modified date
|
2021-07-03 13:19:14 +02:00 |
|
Florian Roth
|
e41759cfb3
|
Merge pull request #1607 from austinsonger/printernightmare
PrinterNightmare CVE-2021-34527 Exploit Detection- Fixed Spell Error
|
2021-07-03 13:16:52 +02:00 |
|
Florian Roth
|
2a63927d51
|
Merge pull request #1612 from leegengyu/web_nginx_core_dump_typo
Update web_nginx_core_dump.yml - Typo
|
2021-07-03 13:15:50 +02:00 |
|
Florian Roth
|
e38a5306ba
|
Merge pull request #1614 from leegengyu/sysmon_remote_powershell_session_network_typos
Update sysmon_remote_powershell_session_network.yml - Typos
|
2021-07-03 13:14:36 +02:00 |
|
G Y
|
2e3daeac94
|
Update sysmon_remote_powershell_session_network.yml
Typo fixes and grammar correction.
|
2021-07-03 14:25:55 +08:00 |
|
G Y
|
7f067f7273
|
Update powershell_powerview_malicious_commandlets.yml
Added new commandlet names based on aliases seen in https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1, fixed a typo, and improved formatting.
|
2021-07-03 11:07:11 +08:00 |
|
G Y
|
544ec5861b
|
Update web_nginx_core_dump.yml
Fixed typo in description field.
|
2021-07-03 10:39:37 +08:00 |
|
Florian Roth
|
691cf066b9
|
Merge pull request #1611 from SigmaHQ/rule-devel
fix: escape character that would be interpreted as wildcard
|
2021-07-02 23:51:49 +02:00 |
|
Florian Roth
|
e25a9cd3b8
|
fix: escape character that would be interpreted as wildcard
|
2021-07-02 23:50:18 +02:00 |
|
Florian Roth
|
43735a5714
|
revert: change in other rule
|
2021-07-02 23:50:03 +02:00 |
|
Florian Roth
|
8b47946ad2
|
Merge branch 'master' into rule-devel
|
2021-07-02 23:47:58 +02:00 |
|
Cian Mc Govern
|
cbbb953d7f
|
Move ipv6 check to selection fields as filter is negated
|
2021-07-02 22:02:43 +01:00 |
|
Cian Mc Govern
|
7fca08e5bd
|
Escape spaces in graylog backend
|
2021-07-02 21:56:08 +01:00 |
|
Florian Roth
|
d3d018e600
|
fix: escape character that would be interpreted as wildcard
|
2021-07-02 22:02:46 +02:00 |
|
Florian Roth
|
dcda583810
|
Merge pull request #1606 from initiate6/master
Added new Print Spooler exploitation detection method
|
2021-07-02 19:17:47 +02:00 |
|
Florian Roth
|
e5f2b40477
|
Minor adjustments
|
2021-07-02 18:48:07 +02:00 |
|
Austin Songer
|
a69bbf59e6
|
Fixed Spell Error
|
2021-07-02 11:47:20 -05:00 |
|
INIT_6
|
defcf7f808
|
Added new Print Spooler exploitation detection method
|
2021-07-02 10:58:14 -05:00 |
|
Florian Roth
|
0cdf0a79a8
|
Merge pull request #1605 from initiate6/master
Added new possible ErrorCode
|
2021-07-02 17:57:26 +02:00 |
|
Florian Roth
|
6d0d58dfe2
|
Merge pull request #1602 from BlackB0lt/patch-11
Update and rename to av_printernightmare_cve_2021_34527.yml
|
2021-07-02 17:15:10 +02:00 |
|
Florian Roth
|
daa8b0e3b0
|
Merge pull request #1603 from frack113/sysmon_cmstp_execution_fix
fix 3 times the same name file
|
2021-07-02 17:14:41 +02:00 |
|
Florian Roth
|
7c3c0142bb
|
Merge branch 'master' into rule-devel
|
2021-07-02 16:06:12 +02:00 |
|
Florian Roth
|
a1101ee9a7
|
fix: missing file / wrong casing in branch
|
2021-07-02 16:05:59 +02:00 |
|
Florian Roth
|
06ab553d25
|
Merge pull request #1604 from SigmaHQ/rule-devel
Config: Splunk fix log sources prefix, THOR PS classic
|
2021-07-02 15:39:22 +02:00 |
|
INIT_6
|
527a3cb8cd
|
Added new possible ErrorCode
|
2021-07-02 07:27:00 -05:00 |
|
Florian Roth
|
ba94b8396c
|
config: thor - powershell classic
|
2021-07-02 14:14:48 +02:00 |
|
Florian Roth
|
03e2b9d376
|
fix: missing "WinEventLog:" in splunk-windows.yml
|
2021-07-02 14:13:12 +02:00 |
|
frack113
|
895a2f6154
|
fix 3 times the same name file
|
2021-07-02 11:01:07 +02:00 |
|