Florian Roth
|
19171f5bed
|
Merge pull request #1315 from rtkdmasse/split-up-cmstp-rule
Split up cmstp rule into 3 separate rules and remove duplicates
|
2021-01-09 10:30:33 +01:00 |
|
Daniel Masse
|
fedda17231
|
Update the azure image_load rule to be a generic sysmon rule
|
2020-12-23 16:29:49 -05:00 |
|
Daniel Masse
|
e4c052154d
|
Remove unneeded file
|
2020-12-23 14:30:24 -05:00 |
|
mat
|
b3e36281b5
|
fix reference field + add test for references in plural form
|
2020-11-27 10:17:45 +01:00 |
|
e6e6e
|
7ae76b8d99
|
Revert "att&ck tags review: windows/process_creation part 5"
This reverts commit e94c47e74e.
|
2020-09-07 01:28:08 +04:00 |
|
e6e6e
|
e94c47e74e
|
att&ck tags review: windows/process_creation part 5
added missing ATT&CK v6.3 IDs with comments and removed unnecessary "modified" attributes
|
2020-09-07 01:19:41 +04:00 |
|
Yugoslavskiy Daniil
|
5b70cfd3f7
|
review windows/sysmon
|
2020-08-29 02:03:28 +02:00 |
|
Florian Roth
|
2e29c07e83
|
Merge pull request #928 from duzvik/master
Create sysmon_abusing_azure_browser_sso.yml
|
2020-08-12 17:15:27 +02:00 |
|
Florian Roth
|
61a05ee054
|
reordered fields, changed indentation
|
2020-08-12 16:44:37 +02:00 |
|
Florian Roth
|
951c6fee8b
|
Update sysmon_password_dumper_lsass.yml
|
2020-07-23 14:31:21 +02:00 |
|
duzvik
|
a9b860d749
|
Update sysmon_abusing_azure_browser_sso.yml
|
2020-07-15 14:24:49 +03:00 |
|
duzvik
|
d24e15cc27
|
Update sysmon_abusing_azure_browser_sso.yml
|
2020-07-15 14:12:58 +03:00 |
|
duzvik
|
c5dfffdac0
|
Create sysmon_abusing_azure_browser_sso.yml
|
2020-07-15 14:02:34 +03:00 |
|
Florian Roth
|
99ac4f1f3d
|
fix: FPs with RedMimicry rule
|
2020-07-07 10:11:58 +02:00 |
|
Florian Roth
|
5f04fcccf5
|
fix: broken links
|
2020-07-03 11:22:06 +02:00 |
|
Florian Roth
|
9c0f9f398f
|
refactor: sysmon rule cleanup > generlization
|
2020-07-01 10:58:39 +02:00 |
|
Florian Roth
|
4231fe2efc
|
fix: remove duplicate rules in sysmon (generic rule cleanup)
|
2020-07-01 10:23:30 +02:00 |
|
Florian Roth
|
154181c6c8
|
fix: renamed files and lien break change
|
2020-07-01 09:48:48 +02:00 |
|
Florian Roth
|
d70b63b78c
|
rule: RedMimicry rules (modified)
|
2020-07-01 09:17:31 +02:00 |
|
Florian Roth
|
c3ffa0b9d3
|
fix: duplicate IDs
|
2020-06-24 17:04:04 +02:00 |
|
Florian Roth
|
b675c4c706
|
Merge branch 'master' into rule-devel
|
2020-06-19 09:24:26 +02:00 |
|
Florian Roth
|
4b0c80885f
|
Merge pull request #810 from EccoTheFlintstone/fp
add WMI module load false positives
|
2020-06-18 12:50:40 +02:00 |
|
Florian Roth
|
32ecb81630
|
Merge pull request #845 from ikiril01/att&ck_subtechniques_v2
ATT&CK subtechniques v2
|
2020-06-18 09:10:09 +02:00 |
|
Ivan Kirillov
|
b343df2225
|
Further subtechnique updates
|
2020-06-17 11:31:40 -06:00 |
|
ecco
|
99bfa14ae0
|
add 1 more FP
|
2020-06-17 12:49:27 -04:00 |
|
Florian Roth
|
0022705373
|
fix: filter not functional
since `UsrLogon.cmd` does appear only in `C:\Windows\system32\cmd.exe /c UsrLogon.cmd` command line
|
2020-06-17 16:09:44 +02:00 |
|
Ivan Kirillov
|
5c0bb0e94f
|
Fixed indentation
|
2020-06-16 15:01:13 -06:00 |
|
Ivan Kirillov
|
0fbfcc6ba9
|
Initial round of subtechnique updates
|
2020-06-16 14:46:08 -06:00 |
|
Florian Roth
|
869162a5da
|
Merge pull request #840 from rtkbkish/remove-wrong-sysmon-id
Rule lists extra Sysmon ID (11). Should just match registry events (1…
|
2020-06-15 20:19:27 +02:00 |
|
Florian Roth
|
3482e048fb
|
Merge pull request #841 from rtkbkish/fix-rule-match
Rule needs endwith, not exact match.
|
2020-06-15 20:19:12 +02:00 |
|
Brad Kish
|
dfae2a6df6
|
Rule needs endwith, not exact match.
Fix ImageLoaded filter to match with endswith, rather than exact match.
|
2020-06-15 13:54:02 -04:00 |
|
Brad Kish
|
a9c6fa904f
|
Rule lists extra Sysmon ID (11). Should just match registry events (12-14)
Remove extraneous event ID 11. It will never match.
|
2020-06-15 13:52:12 -04:00 |
|
Brad Kish
|
422b2bffd7
|
Fix rules with incorrect escaping of wildcars
A backslash before a wildcard needs to be escaped with another backslash.
|
2020-06-15 13:38:18 -04:00 |
|
Florian Roth
|
97c45f9d46
|
Merge pull request #812 from tliffick/master
added new rules for malware
|
2020-06-10 17:37:19 +02:00 |
|
Florian Roth
|
f553fb2e33
|
Cosmetics
|
2020-06-10 16:35:14 +02:00 |
|
Florian Roth
|
48e4e31713
|
Merge pull request #826 from NVISO-BE/sysmon_susp_fax_dll
Fax Service DLL search order hijacking detection
|
2020-06-10 16:33:12 +02:00 |
|
Florian Roth
|
1a9da23611
|
Merge pull request #825 from NVISO-BE/sysmon_office_persistence
Office persistence by addin detection
|
2020-06-10 16:32:50 +02:00 |
|
Remco Hofman
|
8adaa2d672
|
Fixed bad indentation
|
2020-06-10 15:02:41 +02:00 |
|
Remco Hofman
|
83a6e25bcb
|
Fax Service DLL search order hijacking
|
2020-06-10 15:01:07 +02:00 |
|
Remco Hofman
|
cb8e478ac1
|
Sigma rule to detect Office persistence via addin.
|
2020-06-10 14:52:13 +02:00 |
|
Florian Roth
|
5c835cf1f2
|
Merge pull request #813 from ozirus/patch-1
Create sysmon_apt_muddywater_dnstunnel.yml
|
2020-06-09 18:44:45 +02:00 |
|
Florian Roth
|
7a334a8d8a
|
fix: missed line
|
2020-06-09 17:30:54 +02:00 |
|
Florian Roth
|
04913a4b95
|
Aligned indentation
|
2020-06-09 17:20:25 +02:00 |
|
Florian Roth
|
6e349030d9
|
rule: suspicious camera and mic access
|
2020-06-08 10:18:44 +02:00 |
|
Florian Roth
|
0c2f2fe6df
|
Merge pull request #816 from Neo23x0/rule-devel
merged Cyb3rWarD0g's rules
|
2020-06-06 16:27:59 +02:00 |
|
Florian Roth
|
d3e261862d
|
merged Cyb3rWarD0g's rules
|
2020-06-06 15:42:22 +02:00 |
|
Florian Roth
|
72deaa98f5
|
Merge pull request #815 from Neo23x0/rule-devel
Rule devel
|
2020-06-06 14:19:37 +02:00 |
|
Florian Roth
|
3697186281
|
fix: fixed title
|
2020-06-06 14:04:40 +02:00 |
|
Florian Roth
|
246a95557b
|
fix: description over multiple lines
|
2020-06-06 13:56:48 +02:00 |
|
Florian Roth
|
d54209dcc5
|
rule: ETW disabled
|
2020-06-06 13:56:19 +02:00 |
|