680 Commits

Author	SHA1	Message	Date
Tran Trung Hieu	97b690d340	Change level from Critical to High	2020-05-14 09:02:54 +07:00
Tran Trung Hieu	d0b1c98d5a	Reformat rule	2020-05-14 00:39:41 +07:00
Tran Trung Hieu	3e5b33388b	New rule to detect possible CVE-2020-1048 exploitation	2020-05-14 00:24:36 +07:00
Florian Roth	1104044f53	fix: delete duplicate rules	2020-05-11 10:55:02 +02:00
Florian Roth	f96c3a5fd4	Merge branch 'master' into rule-devel ... # Conflicts: # rules/proxy/proxy_ua_suspicious.yml # rules/windows/process_creation/win_install_reg_debugger_backdoor.yml # rules/windows/process_creation/win_susp_csc_folder.yml	2020-05-11 10:44:19 +02:00
Florian Roth	514bd8657b	Merge pull request #704 from Iveco/master ... Detect Ghost-In-The-Logs (disabling/bypassing ETW)	2020-04-14 14:11:27 +02:00
Florian Roth	3175a48bdc	Casing	2020-04-14 13:40:34 +02:00
Florian Roth	ecdec93800	Casing	2020-04-14 13:39:58 +02:00
Maxime Thiebaut	86c6891427	Add Windows Registry Persistence COM Search Order Hijacking	2020-04-14 12:59:29 +02:00
Iveco	c5211eb94a	Update sysmon_susp_service_installed.yml ... CI	2020-04-08 18:54:46 +02:00
Iveco	4520082ef7	Update sysmon_susp_procexplorer_driver_created_in_tmp_folder.yml ... CI	2020-04-08 18:54:37 +02:00
Iveco	6d85650390	Update sysmon_susp_procexplorer_driver_created_in_tmp_folder.yml ... Fixed Author	2020-04-08 18:41:33 +02:00
Iveco	fc1febdebe	Update sysmon_susp_service_installed.yml ... Fixed Author	2020-04-08 18:41:25 +02:00
Iveco	3280a1dfb0	Update sysmon_susp_procexplorer_driver_created_in_tmp_folder.yml ... Fixed CI	2020-04-08 18:23:29 +02:00
Iveco	5e724a0a54	Update sysmon_susp_service_installed.yml ... Fixed CI	2020-04-08 18:22:51 +02:00
iveco	e87f2705a7	Detect Ghost-In-The-Logs (disabling/bypassing ETW)	2020-04-08 18:01:04 +02:00
Chris O'Brien	fe5dbece3d	Date typos...more than I thought...	2020-04-02 10:00:00 +02:00
Clément Notin	18cdddb09e	Small typo	2020-03-31 15:22:00 +02:00
Florian Roth	8ea6b12eed	Merge pull request #670 from 0xThiebaut/sysmon_susp_desktop_ini ... Add "Suspicious desktop.ini Action" rule	2020-03-28 13:34:01 +01:00
Florian Roth	fe5b5a7782	Merge pull request #673 from j91321/rules-minor-fixes ... Minor fixes to several rules	2020-03-28 13:27:05 +01:00
Florian Roth	e2b90220a2	Update sysmon_susp_desktop_ini.yml	2020-03-28 13:19:10 +01:00
Iveco	55258e1799	Title capitalized	2020-03-26 17:04:08 +01:00
Iveco	68c20dca20	Fixed title length	2020-03-26 16:56:46 +01:00
iveco	ddacde9e6b	add LDAPFragger detections	2020-03-26 15:13:36 +01:00
Florian Roth	35e43db7a7	fix: converted CRLF line break to LF	2020-03-25 14:36:34 +01:00
j91321	78bfa950d7	Add WinPrvSE.exe to detection	2020-03-24 19:47:10 +01:00
Maxime Thiebaut	dce18b23b7	Add "Suspicious desktop.ini Action" rule	2020-03-19 21:43:03 +01:00
ecco	2489b8534c	sysmon registry events fix	2020-03-09 12:02:04 -04:00
Florian Roth	7e8b59abe6	Merge pull request #643 from grumo35/patch-2 ... Update sysmon_cred_dump_tools_dropped_files.yml	2020-03-07 10:39:35 +01:00
ecco	b9e4734087	fix sysmon registry rules with HKLM/HKU format as used since 02/2017 in sysmon	2020-03-04 12:47:42 -05:00
Florian Roth	f98ad7a8df	fix: wrong identifier	2020-03-03 11:25:02 +01:00
Florian Roth	7139bfb0cb	fix: avoiding FPs with Citrix software ... writing C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_r23phtye.jsp.ps1	2020-03-03 11:01:42 +01:00
Florian Roth	fdcba84fc8	fix: escaped backslash	2020-02-29 10:12:59 +01:00
grumo35	0d932810b5	Update sysmon_cred_dump_tools_dropped_files.yml ... Adding sysinternal's procdump utility more about this on : https://en.hackndo.com/remote-lsass-dump-passwords/	2020-02-28 15:16:18 +01:00
Florian Roth	f88225dd2a	Merge pull request #640 from Neo23x0/devel ... fix: broader exclusion for rule - OneDrive false positives	2020-02-26 18:41:52 +01:00
Florian Roth	6bbd80a8ee	fix: broader exclusion for rule - OneDrive false positives	2020-02-26 18:31:58 +01:00
Florian Roth	0ba6874645	Merge pull request #638 from Neo23x0/devel ... Several false positives with new rules	2020-02-26 09:46:02 +01:00
Florian Roth	4f3e3166d3	fixing false positives	2020-02-26 09:33:55 +01:00
Florian Roth	82d2b1e6f0	Merge branch 'master' into devel ... # Conflicts: # rules/windows/process_creation/win_susp_squirrel_lolbin.yml	2020-02-26 09:27:48 +01:00
Florian Roth	e7aff17e72	FP: OneDrive setup	2020-02-26 09:26:19 +01:00
Florian Roth	a152853ac3	Merge pull request #624 from Antonlovesdnb/master ... New rules for Macro Detections	2020-02-25 15:44:31 +01:00
Antonlovesdnb	e8b861bff4	Update sysmon_susp_winword_vbadll_load.yml	2020-02-25 09:24:29 -05:00
Antonlovesdnb	4c5d489428	Update sysmon_susp_office_kerberos_dll_load.yml	2020-02-25 09:23:52 -05:00
Antonlovesdnb	f92e2f2b18	Update sysmon_susp_office_dotnet_assembly_dll_load.yml	2020-02-25 09:23:22 -05:00
Antonlovesdnb	8141b1ae90	Update sysmon_susp_office_dsparse_dll_load.yml	2020-02-25 09:22:56 -05:00
Antonlovesdnb	45e4a585bf	Update sysmon_susp_office_dotnet_gac_dll_load.yml	2020-02-25 09:22:37 -05:00
Antonlovesdnb	c5b42aeaed	Update sysmon_susp_office_dotnet_clr_dll_load.yml	2020-02-25 09:19:03 -05:00
Antonlovesdnb	bb1eecfe14	Update sysmon_susp_office_dotnet_assembly_dll_load.yml	2020-02-25 09:17:33 -05:00
Florian Roth	950fa18418	fix: changed titles to avoid duplicates	2020-02-25 11:12:47 +01:00
Thomas Patzke	48d95f027c	Merge branch 'oscd'	2020-02-20 23:11:57 +01:00
Thomas Patzke	373424f145	Rule fixes ... Made tests pass the new CI tests. Added further allowed lower case words in rule test.	2020-02-20 23:00:16 +01:00
Antonlovesdnb	9625a94d0b	Update sysmon_susp_office_dotnet_assembly_dll_load.yml	2020-02-19 14:52:31 -05:00
Antonlovesdnb	6234f72a6c	Update sysmon_susp_office_dotnet_clr_dll_load.yml	2020-02-19 14:52:09 -05:00
Antonlovesdnb	328858279f	Update sysmon_susp_office_kerberos_dll_load.yml	2020-02-19 14:51:50 -05:00
Antonlovesdnb	1f01fe446f	Update sysmon_susp_office_dsparse_dll_load.yml	2020-02-19 14:51:22 -05:00
Antonlovesdnb	6d0805ac13	Update sysmon_susp_winword_vbadll_load.yml	2020-02-19 14:51:00 -05:00
Antonlovesdnb	1e461cb2d1	Update sysmon_susp_office_dotnet_gac_dll_load.yml	2020-02-19 14:50:31 -05:00
Antonlovesdnb	56ffa9ec0e	Update sysmon_registry_trust_record_modification.yml	2020-02-19 14:50:09 -05:00
Antonlovesdnb	397cdecb94	5 Rules covering various macro techniques ... - Rule to look for GAC DLL loaded by an Office Product - Rule to look for any DLL in C:\Windows\assembly loaded by an Office Product - Rule to look for clr.dll loaded by an Office Product - Rule to look for directory services parsing dll loaded by an Office Product - Rule to look for kerberos dll loaded by an Office Product	2020-02-19 14:43:13 -05:00
Antonlovesdnb	f8be92dae0	Add files via upload	2020-02-19 10:13:44 -05:00
Thomas Patzke	77c927bc14	Revert "Moved rules with enrichments into unsupported" ... This reverts commit ba83b8862a.	2020-02-15 22:52:06 +01:00
Florian Roth	bf98d286f9	Merge pull request #615 from Neo23x0/devel ... fix: dumpert rule with wrong sysmon event id	2020-02-08 20:03:28 +01:00
Florian Roth	be9b80d6ab	fix: dumpert rule with wrong sysmon event id	2020-02-07 13:14:18 +01:00
Florian Roth	1a80b180fd	Merge pull request #613 from Neo23x0/devel ... rule: dumpert process dump tool	2020-02-04 23:07:07 +01:00
Florian Roth	10490a6cee	rule: reworked dumpert rule	2020-02-04 22:56:04 +01:00
Florian Roth	1f44969afd	rule: avoiding build issues with sysmon event id 1	2020-02-04 22:50:46 +01:00
Florian Roth	535e2d149b	rule: improved dumpert rule	2020-02-04 22:46:16 +01:00
Florian Roth	8f8b977c85	rule: dumpert process dump tool	2020-02-04 22:38:06 +01:00
Thomas Patzke	d7bd90cb24	Merge branch 'master' into oscd	2020-02-03 23:13:16 +01:00
Thomas Patzke	f7394d09e0	Deduplication	2020-02-03 22:41:55 +01:00
Thomas Patzke	815c562a17	Merge branch 'master' into oscd	2020-02-02 13:40:08 +01:00
Thomas Patzke	ba83b8862a	Moved rules with enrichments into unsupported	2020-02-02 12:46:03 +01:00
Thomas Patzke	593abb1cce	OSCD QA wave 3	2020-02-02 12:41:12 +01:00
Florian Roth	aa8a0f5e1f	Merge pull request #606 from Neo23x0/devel ... refactor: moved rues from 'apt' folder in respective folders	2020-02-01 18:25:19 +01:00
Florian Roth	03ecb3b8dc	refactor: moved rues from 'apt' folder in respective folders	2020-02-01 17:59:26 +01:00
Florian Roth	8c4aadb423	Merge branch 'master' into Renamed_Files	2020-01-31 08:49:10 +01:00
Florian Roth	190afcac88	Missing ID, wrong tag	2020-01-31 07:32:28 +01:00
Florian Roth	033ab26d5e	Added date	2020-01-31 07:21:02 +01:00
Florian Roth	82cae6d63c	Merge pull request #604 from Neo23x0/devel ... New tests, colorized test output and rule cleanup	2020-01-31 07:07:13 +01:00
Florian Roth	d42e87edd7	fix: fixed casing and long rule titles	2020-01-30 17:26:09 +01:00
Florian Roth	e79e99c4aa	fix: fixed missing date fields in remaining files	2020-01-30 16:07:37 +01:00
Florian Roth	376092cfd3	Merge pull request #565 from RiccardoAncarani/master ... Add Covenant default named pipe	2020-01-29 20:28:00 +01:00
Florian Roth	d48fc9d1ff	fix: multiple false positive conditions	2020-01-28 10:11:09 +01:00
Tim Burrell (MSTIC)	c24bbdcf81	Sigma queries for ... -- terminating threads in a svchost process (InvokePhantom uses this technique to disable windows event logging) -- GALLIUM threat intel IOCs in recent MSTIC blog/release.	2020-01-24 15:31:06 +01:00
msec1203	4f29556a01	Update win_susp_winword_wmidll_load.yml ... Update x2	2020-01-24 15:31:06 +01:00
msec1203	48a071ad4e	Update win_susp_winword_wmidll_load.yml ... Fix to error on incorrect mitre tags used.	2020-01-24 15:31:06 +01:00
msec1203	4260d01ff0	Initial Upload ... Submit Sigma Rule For Detecting Word Loading WMI DLL's.	2020-01-24 15:31:06 +01:00
Thomas Patzke	9bb50f3d60	OSCD QA wave 2 ... * Improved rules * Added filtering * Adjusted severity	2020-01-17 15:46:28 +01:00
Thomas Patzke	ae6fcefbcd	Removed ATT&CK technique ids from titles and added tags	2020-01-11 00:33:50 +01:00
Thomas Patzke	8d6a507ec4	OSCD QA wave 1 ... * Checked all rules against Mordor and EVTX samples datasets * Added field names * Some severity adjustments * Fixes	2020-01-11 00:11:27 +01:00
Thomas Patzke	b34bf98c61	Fixed rule: added condition	2020-01-07 15:20:16 +01:00
Florian Roth	fd28a64591	rule: WCE	2019-12-31 09:27:38 +01:00
msec1203	dbdf6680e0	Update win_susp_winword_wmidll_load.yml ... Update x2	2019-12-30 18:49:39 +09:00
msec1203	a45f877712	Update win_susp_winword_wmidll_load.yml ... Fix to error on incorrect mitre tags used.	2019-12-30 18:41:16 +09:00
msec1203	845d67f1f3	Initial Upload ... Submit Sigma Rule For Detecting Word Loading WMI DLL's.	2019-12-29 23:14:29 +09:00
Thomas Patzke	924e1feb54	UUIDs + moved unsupported logic ... * Added UUIDs to all contributed rules * Moved unsupported logic directory out of rules/ because this breaks CI testing.	2019-12-19 23:56:36 +01:00
Thomas Patzke	694d666539	Merge branch 'master' into oscd	2019-12-19 23:15:15 +01:00
Riccardo Ancarani	8b70cb6761	Add Covenant default named pipe ... Covenant (https://github.com/cobbr/Covenant) can use named pipes for peer to peer communication. The default named pipe name is "\gruntsvc". References: https://posts.specterops.io/designing-peer-to-peer-command-and-control-ad2c61740456	2019-12-18 15:19:47 +00:00
Yugoslavskiy Daniil	d19df2e4f7	fix issues with wrong tagging	2019-12-15 00:17:22 +01:00
yugoslavskiy	9fba097421	add sysmon_in_memory_powershell.yml by Tom Kern	2019-12-01 23:26:00 +01:00
Florian Roth	98aa4d4ecb	fix: fixed typo in rule for renamed procdump	2019-11-19 15:59:07 +01:00
yugoslavskiy	efc404fbae	resolve conflicts with rule IDs; restored and deprecated sysmon_mimikatz_detection_lsass.yml	2019-11-19 02:11:19 +01:00
Florian Roth	2c855be9d3	fix: casing fix in renamed procdump rule	2019-11-18 15:57:14 +01:00
Florian Roth	93f890b31d	rule: renamed procdump	2019-11-18 15:27:04 +01:00
yugoslavskiy	ac21810d7a	Merge pull request #516 from yugoslavskiy/oscd_task_#2_credentials_dumping ... oscd task #2 completed	2019-11-14 01:03:27 +03:00
yugoslavskiy	01ed5a7135	Update sysmon_unsigned_image_loaded_into_lsass.yml	2019-11-14 00:58:39 +03:00
yugoslavskiy	20a5c9498c	Update sysmon_raw_disk_access_using_illegitimate_tools.yml	2019-11-14 00:58:00 +03:00
yugoslavskiy	4b8873b706	Update sysmon_lsass_memory_dump_file_creation.yml	2019-11-14 00:55:20 +03:00
yugoslavskiy	f0cce60a2c	Update sysmon_cred_dump_tools_dropped_files.yml	2019-11-14 00:53:25 +03:00
yugoslavskiy	cd69111522	Merge branch 'oscd' into master	2019-11-14 00:36:34 +03:00
yugoslavskiy	3cd1abd0a1	Update sysmon_suspicious_remote_thread.yml	2019-11-14 00:34:09 +03:00
yugoslavskiy	1e75979a2a	Update sysmon_minidumwritedump_lsass.yml	2019-11-14 00:32:06 +03:00
yugoslavskiy	c8ee6e9631	Merge pull request #504 from yugoslavskiy/oscd_ilyas_ochkov ... [OSCD] Ilyas Ochkov contribution	2019-11-14 00:22:48 +03:00
yugoslavskiy	b47748399d	Update sysmon_new_dll_added_to_appcertdlls_registry_key.yml	2019-11-14 00:19:30 +03:00
yugoslavskiy	1fe7f55d47	Update sysmon_suspicious_outbound_kerberos_connection.yml	2019-11-14 00:10:05 +03:00
yugoslavskiy	07ad11f3ae	Update sysmon_possible_dns_rebinding.yml	2019-11-14 00:08:50 +03:00
yugoslavskiy	ded75d033a	Update sysmon_new_dll_added_to_appinit_dlls_registry_key.yml	2019-11-13 23:47:24 +03:00
yugoslavskiy	0cb1d4fdbd	Update sysmon_new_dll_added_to_appcertdlls_registry_key.yml	2019-11-13 23:44:03 +03:00
yugoslavskiy	bba360212a	Update sysmon_new_dll_added_to_appcertdlls_registry_key.yml	2019-11-13 23:43:45 +03:00
yugoslavskiy	e6e308ef51	Update sysmon_disable_security_events_logging_adding_reg_key_minint.yml	2019-11-13 23:40:29 +03:00
Thomas Patzke	0592cbb67a	Added UUIDs to rules	2019-11-12 23:12:27 +01:00
Thomas Patzke	5f6a4225ec	Unified line terminators of rules to Unix	2019-11-12 23:05:36 +01:00
Thomas Patzke	d42cc78509	Converted rules Sysmon/1 parts to generic process_creation	2019-11-12 21:06:24 +01:00
Thomas Patzke	0065e2420f	Merge branch 'oscd-qa'	2019-11-12 20:54:11 +01:00
Florian Roth	b7c3f8da91	refactor: cleanup, single element lists, renamed files, level adjustments	2019-11-12 12:55:05 +01:00
yugoslavskiy	385ebac502	Merge pull request #497 from Heirhabarov/master ... OSCD Task 1 - Privilege Escalation	2019-11-11 01:33:28 +03:00
yugoslavskiy	8adc51d4aa	Update sysmon_possible_privilege_escalation_via_service_registry_permissions_weakness.yml	2019-11-11 01:30:19 +03:00
yugoslavskiy	69a99bc2c3	Merge pull request #493 from alx1m1k/oscd ... [OSCD] rules from Jet CSIRT team	2019-11-10 23:11:24 +03:00
yugoslavskiy	1f5a31f0e7	fix logsource for remote_powershell_session_process.yml	2019-11-10 23:10:24 +03:00
yugoslavskiy	fcde35d6ab	Update sysmon_regsvr32_network_activity.yml	2019-11-10 22:51:53 +03:00
yugoslavskiy	0beeaadb6f	Update sysmon_narrator_feedback_persistance.yml	2019-11-10 22:47:48 +03:00
yugoslavskiy	5756df1922	rename file	2019-11-10 21:56:34 +03:00
yugoslavskiy	e5e44e2ade	Merge pull request #488 from stvetro/oscd ... [OSCD][ART] Task 7: T1060, T1031	2019-11-10 21:39:32 +03:00
yugoslavskiy	f2f1628506	Update and rename sysmon_runkey_from_powershell.yml to sysmon_asep_regirstry_modification.yml	2019-11-10 21:36:21 +03:00
yugoslavskiy	0db5436778	add tieto dns exfil rules	2019-11-10 20:27:21 +03:00
yugoslavskiy	bdac415fea	Merge pull request #486 from yugoslavskiy/tieto_oscd ... [OSCD] Tieto DNS exfiltration rules	2019-11-10 19:36:02 +03:00
yugoslavskiy	4fa928866f	oscd task #6 done. ... add 25 new rules: - win_ad_replication_non_machine_account.yml - win_dpapi_domain_backupkey_extraction.yml - win_protected_storage_service_access.yml - win_dpapi_domain_masterkey_backup_attempt.yml - win_sam_registry_hive_handle_request.yml - win_sam_registry_hive_dump_via_reg_utility.yml - win_lsass_access_non_system_account.yml - win_ad_object_writedac_access.yml - powershell_alternate_powershell_hosts.yml - sysmon_remote_powershell_session_network.yml - win_remote_powershell_session.yml - win_scm_database_handle_failure.yml - win_scm_database_privileged_operation.yml - sysmon_wmi_module_load.yml - sysmon_remote_powershell_session_process.yml - sysmon_rdp_registry_modification.yml - sysmon_powershell_execution_pipe.yml - sysmon_alternate_powershell_hosts_pipe.yml - sysmon_powershell_execution_moduleload.yml - sysmon_createremotethread_loadlibrary.yml - sysmon_alternate_powershell_hosts_moduleload.yml - powershell_remote_powershell_session.yml - win_non_interactive_powershell.yml - win_syskey_registry_access.yml - win_wmiprvse_spawning_process.yml improve 1 rule: - rules/windows/builtin/win_account_backdoor_dcsync_rights.yml	2019-11-10 18:43:41 +03:00
yugoslavskiy	c0ac9b8fb9	fix conflict	2019-11-10 17:31:33 +03:00
yugoslavskiy	127335a0ec	Merge pull request #482 from yugoslavskiy/master ... [OSCD][The ThreatHunter-Playbook] Task 6: DONE	2019-11-10 17:27:54 +03:00
yugoslavskiy	a59d4fdd33	Merge branch 'master' of https://github.com/Neo23x0/sigma into oscd	2019-11-10 14:47:27 +03:00
Florian Roth	038f205f0f	fix: FPs with UserInitMprLogonScript rule	2019-11-09 23:32:53 +01:00
Florian Roth	fbe138ed90	rule: reduced level of rule to medium due to FPs	2019-11-09 23:24:31 +01:00
yugoslavskiy	b176339da8	Merge pull request #479 from alexpetrov12/master ... add rule	2019-11-08 02:16:22 +03:00
yugoslavskiy	98f32e9098	Delete sysmon_mimikatz_сreds_dump.yml ... merged with rules/windows/sysmon/sysmon_cred_dump_lsass_access.yml	2019-11-08 02:06:31 +03:00
yugoslavskiy	6d61401b12	Delete sysmon_сreds_dump.yml ... merged with rules/windows/sysmon/sysmon_cred_dump_lsass_access.yml	2019-11-08 02:06:20 +03:00
yugoslavskiy	6b98c37910	Update and rename sysmon_mimikatz_detection_lsass.yml to sysmon_cred_dump_lsass_access.yml	2019-11-08 02:05:34 +03:00
yugoslavskiy	562e07de38	Delete cobalt_execute_assembly.yml ... merged with existing [sysmon_cobaltstrike_process_injection.yml](https://github.com/Neo23x0/sigma/blob/oscd/rules/windows/sysmon/sysmon_cobaltstrike_process_injection.yml)	2019-11-08 01:42:42 +03:00
yugoslavskiy	52d099a6e3	improve sysmon_cobaltstrike_process_injection.yml	2019-11-08 01:41:26 +03:00
yugoslavskiy	8164e1e096	Update sysmon_mimikatz_detection_lsass.yml	2019-11-07 04:50:22 +03:00
yugoslavskiy	7affc09c19	Update sysmon_mimikatz_detection_lsass.yml	2019-11-07 04:33:40 +03:00