5733 Commits

Author	SHA1	Message	Date
Austin Songer	6e15618c75	Create azure_device_or_configuration_deleted.yml	2021-09-03 22:24:32 -05:00
Austin Songer	b478132769	Create azure_owner_removed_from_application_or_service_principal.yml	2021-09-03 22:23:59 -05:00
Austin Songer	c0bdc3fb1b	Create azure_device_no_longer_managed_or_compliant.yml	2021-09-03 22:23:21 -05:00
frack113	6780182c37	Merge pull request #1974 from frack113/tags_pack2 ... Add missing Tags	2021-09-03 19:13:32 +02:00
frack113	2e474628fa	Merge pull request #1987 from zakibro/master ... New Rule - Linux-Auditd-System Information Discovery	2021-09-03 19:10:28 +02:00
frack113	688df3405a	Merge pull request #1970 from frack113/red_T1564.004_1 ... Redcanary t1564.004 ADS test 1	2021-09-03 19:06:51 +02:00
frack113	77c6b74c72	Merge pull request #1985 from mvelazc0/master ... Adding Petitpotam/ADCS attack vector detections	2021-09-03 19:06:03 +02:00
mvelazco	a7a002cb7f	updating fields as per frack113 feedback	2021-09-03 10:01:54 -04:00
frack113	769451dc03	Add missing id	2021-09-03 13:42:15 +02:00
frack113	815134df7f	Cleanup	2021-09-03 13:30:10 +02:00
phantinuss	aa2e86963c	fix: rename filter	2021-09-03 13:26:34 +02:00
phantinuss	f3bdb0e43d	fix: remove unneeded selection	2021-09-03 13:26:23 +02:00
phantinuss	2de2de8433	Addition to UAC Bypasses	2021-09-03 13:26:11 +02:00
zakibro	8bd859f550	Update lnx_auditd_system_info_discovery.yml	2021-09-03 13:07:42 +02:00
ncrqnt	adc3c9e608	fixed date: switched day/month	2021-09-03 12:03:38 +02:00
Pawel Mazur	864286e206	New Rule - Linux-Auditd-System Information Discovery	2021-09-03 11:33:18 +02:00
frack113	89562273cc	Merge pull request #1984 from austinsonger/azure_app_credential_modification.yml ... azure_app_credential_modification.yml	2021-09-03 08:17:55 +02:00
frack113	88389f945d	Merge pull request #1983 from austinsonger/azure_service_principal_created.yml ... azure_service_principal_created.yml	2021-09-03 08:14:47 +02:00
frack113	d40cdec062	Merge pull request #1982 from austinsonger/azure_network_firewall_policy_modified_or_deleted.yml ... azure_network_firewall_policy_modified_or_deleted.yml	2021-09-03 08:13:30 +02:00
frack113	bd1b4c0d70	Merge pull request #1978 from rachelrice/update_aws_login ... Update AWS Update Login Profile rule	2021-09-03 08:12:28 +02:00
frack113	1fc2a39720	Merge pull request #1975 from frack113/red_T1564.004_2 ... Redcanary t1564.004 test 2	2021-09-03 08:12:08 +02:00
frack113	11e4b900e4	Update global id	2021-09-03 06:59:40 +02:00
frack113	135d0a2c61	Update global id	2021-09-03 06:50:00 +02:00
frack113	a6bb5574fb	Update global id	2021-09-03 06:35:35 +02:00
mvelazco	ba41e922d2	adding Petitpotam host detections	2021-09-03 00:12:49 -04:00
Austin Songer	775c0e8e7f	Update azure_app_credential_modification.yml	2021-09-02 21:00:21 -05:00
Austin Songer	643ec0abe3	Update azure_service_principal_created.yml	2021-09-02 21:00:02 -05:00
Austin Songer	10af7bbdb1	Create azure_app_credential_modification.yml	2021-09-02 20:53:32 -05:00
Austin Songer	d25fd420d6	Create azure_service_principal_created.yml	2021-09-02 20:48:35 -05:00
Austin Songer	1272c76ae7	Create azure_network_firewall_policy_modified_or_deleted.yml	2021-09-02 20:31:27 -05:00
frack113	d02ee1eddd	Update global ID	2021-09-02 21:16:55 +02:00
frack113	f90c7558a7	update global id	2021-09-02 21:03:25 +02:00
frack113	ac90ee0002	Update global ID	2021-09-02 20:23:23 +02:00
frack113	086a15fc45	Update global ID	2021-09-02 20:07:03 +02:00
Rachel Rice	78d3fa4795	Update AWS STS AssumeRole Misuse rule ... Update selection criteria for AWS STS AssumeRole Misuse rule for any event by an AssumedRole userIdentity. Closes SigmaHQ/sigma#1963.	2021-09-02 17:40:35 +01:00
Rachel Rice	7ccb773b20	Update AWS Update Login Profile rule ... Update selection criteria for AWS Update Login Profile rule to check for mismatch between userIdentity.arn and requestParameters.userName. Closes SigmaHQ/sigma#1966.	2021-09-02 17:37:41 +01:00
frack113	9bcefc6a93	move uuid from global	2021-09-02 16:05:05 +02:00
frack113	b731c20594	Merge pull request #1971 from phantinuss/master ... fix: prevent possible FPs	2021-09-02 15:34:46 +02:00
frack113	a048403089	Merge pull request #1973 from klingerko/cs_namedpipe_updates ... Remove duplicate and regex improvements	2021-09-02 15:25:01 +02:00
phantinuss	ab721c736c	chore: move level/falsepositives to bottom	2021-09-02 14:55:17 +02:00
klingerko	15e25f9635	update modifed date	2021-09-02 14:50:14 +02:00
phantinuss	0b373ff1e9	fix: remove 2nd selection due to FPs	2021-09-02 14:47:47 +02:00
frack113	6a1b95d947	Findstr covert by win_susp_findstr.yml	2021-09-02 14:22:59 +02:00
frack113	aaa568ff2d	print covert by win_susp_print.yml	2021-09-02 14:18:38 +02:00
phantinuss	5cb6eed52e	fix: remove single value lists	2021-09-02 14:09:03 +02:00
phantinuss	f4a5df67ae	further narrowing down of the selection, therefore removing the filter	2021-09-02 10:28:01 +02:00
frack113	90e673e5ac	fix invalid tags	2021-09-02 10:17:50 +02:00
Florian Roth	0603581111	Merge pull request #1969 from SigmaHQ/rule-devel ... More Named Pipe Rules and WMI rule refactoring	2021-09-02 10:15:00 +02:00
frack113	6f1f70ca5e	Add missing tags	2021-09-02 09:59:19 +02:00
frack113	25c6f69ea3	update references	2021-09-02 09:51:44 +02:00
frack113	5e87970c77	add powershell_store_file_in_alternate_data_stream.yml	2021-09-02 09:47:54 +02:00
frack113	5212b388c6	Merge pull request #1967 from d4rk-d4nph3/master ... Added rule for detection of Atera RMM Agent installation	2021-09-02 09:19:49 +02:00
frack113	e0cd35261c	add missing tags	2021-09-01 20:01:03 +02:00
frack113	1ba0a7c7a3	add missing tags	2021-09-01 19:38:35 +02:00
Konstantin Klinger	457da818a4	regex optimisations	2021-09-01 17:06:55 +02:00
Konstantin Klinger	e83ee55573	remove duplicate	2021-09-01 17:05:36 +02:00
Florian Roth	b0c2d7b75a	fix: tags for WMI / execution / persistence	2021-09-01 16:34:50 +02:00
Florian Roth	2f7f050ad8	fix: removed tags	2021-09-01 16:32:27 +02:00
phantinuss	0b38237dbf	fix: add relation to now obsolete rule	2021-09-01 15:38:29 +02:00
phantinuss	ae9966bdcc	fix: unifying two overlapping rules	2021-09-01 14:48:32 +02:00
phantinuss	deefcaa8ac	fix: prevent possible FPs with the respective command only used as the last parameter	2021-09-01 14:33:46 +02:00
frack113	434c3891ff	Merge pull request #1965 from frack113/add_tags ... Add tags when missing	2021-09-01 14:07:31 +02:00
Florian Roth	1aac21ba79	fix: single list item issue	2021-09-01 14:03:42 +02:00
Florian Roth	1c4f642227	Merge pull request #1699 from matsto/patch-1 ... Fixed transformation modifier for keywords	2021-09-01 14:02:10 +02:00
frack113	2dbbaf0180	fix missing char in date	2021-09-01 14:00:55 +02:00
Florian Roth	505140d273	rule: extended WMI suspicious scripts rule	2021-09-01 13:57:48 +02:00
Florian Roth	e787420be1	rule: WMI filter content encoded executable	2021-09-01 13:57:36 +02:00
Florian Roth	8761927e8c	rule: susp scrcons.exe creating named pipe	2021-09-01 13:57:17 +02:00
frack113	e71fce6f11	fix errors	2021-09-01 13:55:14 +02:00
Florian Roth	affc929c3b	LiquidSnake named pipe	2021-09-01 13:54:47 +02:00
frack113	80dbfa7af5	add process_creation_alternate_data_streams.yml	2021-09-01 13:52:09 +02:00
Florian Roth	c8b3036949	Merge pull request #1968 from SigmaHQ/rule-devel ... docs: note to improved sysmon config	2021-09-01 13:21:28 +02:00
Florian Roth	f102b2d9a1	docs: note to improved sysmon config	2021-09-01 13:07:18 +02:00
Florian Roth	8bba246205	refactor: better way to write it	2021-09-01 12:57:34 +02:00
frack113	2cb5f5e4c6	add missing tags	2021-09-01 12:54:21 +02:00
Florian Roth	c146bc44c7	Merge branch 'master' into patch-1	2021-09-01 12:48:51 +02:00
Bhabesh Rai	6859b6c38f	Added rule for detection of Atera RMM Agent installation	2021-09-01 15:24:47 +05:45
frack113	af599e4877	Merge pull request #1958 from phantinuss/master ... Bulk of new rules, mainly UAC Bypasses	2021-09-01 10:53:02 +02:00
frack113	892c58270a	Update tags	2021-09-01 10:33:57 +02:00
frack113	4b8ffbc183	Update tags	2021-09-01 10:30:43 +02:00
phantinuss	9ffdced740	fix: implement suggestions from PR discussion	2021-09-01 10:21:37 +02:00
frack113	240c5584ff	update tags	2021-09-01 09:56:46 +02:00
frack113	6f3fc7036e	Update tags	2021-09-01 09:45:31 +02:00
frack113	3ed7d6e330	Merge pull request #1959 from frack113/update_ps ... Update PowerShell rules	2021-09-01 08:06:31 +02:00
frack113	b8a1f4c63b	Merge pull request #1961 from SigmaHQ/rule-devel ... SideWalk User-Agent used by Sparkling Goblin	2021-09-01 08:06:15 +02:00
Florian Roth	9b20060275	SideWalk UA	2021-08-31 17:14:19 +02:00
frack113	cff572b752	Update sysmon_dns_over_https_enabled.yml	2021-08-31 17:11:04 +02:00
phantinuss	add1ad40f8	additional UAC bypass rule	2021-08-31 16:23:32 +02:00
phantinuss	59d8e0b866	add System IntegrityLevel to uac bypass rules, the level is not used most of the time, but might	2021-08-31 16:18:05 +02:00
Austin Songer	9dc8d38565	Create sysmon_dns_over_https_enabled.yml	2021-08-31 09:14:14 -05:00
phantinuss	6eb7245673	fix: remove user sid, match any sid instead	2021-08-31 15:58:57 +02:00
frack113	eb434732a7	move rule not only powershell	2021-08-31 13:48:07 +02:00
frack113	18cdc36d73	Fix EventID 4103 detection	2021-08-31 13:44:54 +02:00
phantinuss	3a9e10d081	bulk of new rules to match working UACMe UAC bypasses	2021-08-31 12:51:21 +02:00
phantinuss	ea77d9161e	add another possible sdclt uac bypass registry path	2021-08-31 12:51:21 +02:00
phantinuss	50b8ca5110	add more COM interfaces and sharpen rule logic	2021-08-31 12:51:21 +02:00
phantinuss	3155f7172d	detection for proxyshell MSF module	2021-08-31 12:51:16 +02:00
frack113	b25fbbea54	Merge pull request #1957 from d4rk-d4nph3/master ... Added new malwarebytes reference for Cab File Expansion rule	2021-08-31 09:54:47 +02:00
Bhabesh Rai	911c45201a	Added -F option support	2021-08-31 13:02:53 +05:45
frack113	89e21c69ef	fix detection	2021-08-31 09:07:54 +02:00