Florian Roth
df715386b6
rule: suspicious esentutl use
2020-05-23 18:27:36 +02:00
Florian Roth
d1a5471d21
rule: Strong Pity loader UA
2020-05-23 17:38:10 +02:00
Florian Roth
34006d0794
refactor: simplified and extended expression in CVE-2020-1048 rule
2020-05-23 09:16:19 +02:00
Florian Roth
57c8e63acd
refactore: split up rule for CVE-2020-1048 into 2 rules
2020-05-23 09:09:58 +02:00
Florian Roth
91c4c4ecc5
refactor: slightly improved Greenbug rule
2020-05-21 13:38:11 +02:00
Florian Roth
9a3b6c1c77
docs: added MITRE ATT&CK group tag
2020-05-21 09:44:11 +02:00
Florian Roth
344eb713c5
rule: Greenbug campaign
2020-05-21 09:39:57 +02:00
Florian Roth
8154ca355a
Merge pull request #768 from maximelb/master
...
Remove "condition" from global rule in CVE-2020-1048.
2020-05-18 12:52:49 +02:00
Maxime Lamothe-Brassard
25d3a5a893
Remove "condition" from global rule.
...
The condition field in this rule was in the global section which overwrote the condition in sub-rules and generated FPs. For example, once Sigma read the rule, the bottom sub-rule's "condition" was overwritten with "1 of them".
2020-05-17 12:44:57 -07:00
Florian Roth
a46e357874
Merge branch 'master' into rule-devel
2020-05-16 08:59:34 +02:00
Florian Roth
d5e7d4e302
fix: missing condition in CVE-2020-1048 rule
2020-05-16 08:59:05 +02:00
ecco
fd386fe8eb
standardize rules with Image and CommandLine instead of NewProcessName and ProcessCommandLine
2020-05-15 12:35:32 -04:00
Florian Roth
7b713fbe7f
rule: OpenSSHd rule adjusted
2020-05-15 17:19:32 +02:00
ecco
0575fa8d81
fix CVE 2020-1048 rule
2020-05-15 07:25:05 -04:00
Florian Roth
cc26b26377
Merge branch 'master' into rule-devel
...
# Conflicts:
# rules/windows/sysmon/sysmon_cve-2020-1048.yml
2020-05-15 12:09:47 +02:00
Florian Roth
8e7caf0e4d
rule: CVE-2020-1048
2020-05-15 12:08:31 +02:00
Florian Roth
8e082283f0
Merge pull request #754 from Neo23x0/rule-devel
...
Rule devel
2020-05-15 12:07:04 +02:00
Florian Roth
5854cc4677
fix: small bug in new CVE-2020-1048 rule
2020-05-15 11:37:46 +02:00
Florian Roth
2282432b6f
Merge pull request #753 from hieuttmmo/master
...
New Sigma rule to detect possible CVE-2020-1048 exploitation and Suspicious network connection from Notepad
2020-05-15 11:35:12 +02:00
ecco
54cf535dbc
remove false positives with cmd as child of services.exe (not specifically related to meterpreter/cobaltstrike)
2020-05-15 04:45:25 -04:00
Florian Roth
ab950fb89d
fix: removed rules missing in master
2020-05-14 15:53:09 +02:00
Tran Trung Hieu
e53a97fa2f
Update condition to filter out printer port
2020-05-14 18:22:49 +07:00
Tran Trung Hieu
443bf09d27
Add author
2020-05-14 18:10:16 +07:00
Tran Trung Hieu
e74970cea0
Suspicious network connection from notepad.exe
2020-05-14 18:08:30 +07:00
Tran Trung Hieu
97b690d340
Change level from Critical to High
2020-05-14 09:02:54 +07:00
Florian Roth
7652813c2c
Merge pull request #752 from zaphodef/fix/win_susp_script_execution_false_negatives
...
Widen the search as it gives too many false negatives
2020-05-13 21:02:12 +02:00
Tran Trung Hieu
d0b1c98d5a
Reformat rule
2020-05-14 00:39:41 +07:00
Tran Trung Hieu
3e5b33388b
New rule to detect possible CVE-2020-1048 exploitation
2020-05-14 00:24:36 +07:00
zaphod
78a5c743f2
Widen the search as it gives too many false negatives
2020-05-13 16:20:23 +02:00
Florian Roth
78a8266a1b
Merge pull request #749 from teddy-ROxPin/patch-6
...
Create win_advanced_ip_scanner.yml
2020-05-13 14:09:12 +02:00
Florian Roth
220a14f31c
fix: typo in contains
2020-05-13 12:38:54 +02:00
Florian Roth
a1856c5743
Update win_advanced_ip_scanner.yml
2020-05-13 11:56:25 +02:00
zaphod
a9ef7ef382
Fix a bad CommandLine search
2020-05-13 11:32:05 +02:00
teddy_ROxPin
bb17fd74ee
Create win_advanced_ip_scanner.yml
...
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
2020-05-12 21:43:01 -06:00
Florian Roth
e01734fda1
rule: proxy UA hidden cobra
2020-05-12 17:43:54 +02:00
Florian Roth
1104044f53
fix: delete duplicate rules
2020-05-11 10:55:02 +02:00
Florian Roth
2b18b66c16
Merge branch 'master' into rule-devel
2020-05-11 10:50:10 +02:00
Florian Roth
4366a95024
rule: Maze ransomware
2020-05-11 10:46:26 +02:00
Florian Roth
f96c3a5fd4
Merge branch 'master' into rule-devel
...
# Conflicts:
# rules/proxy/proxy_ua_suspicious.yml
# rules/windows/process_creation/win_install_reg_debugger_backdoor.yml
# rules/windows/process_creation/win_susp_csc_folder.yml
2020-05-11 10:44:19 +02:00
Florian Roth
09d1b00459
Changed level to ciritcal
2020-05-11 10:40:23 +02:00
tliffick
c98be55d21
Update mal_azorult_reg.yml
2020-05-08 21:31:33 -04:00
tliffick
61f061333b
Registry entry for Azorult malware
...
Detects registry keys used by Azorult malware
2020-05-08 21:26:24 -04:00
Florian Roth
fd7968d4f8
Merge pull request #734 from NVISO-BE/win_susp_failed_logon_source
...
New rule: Failed Logon From Public IP
2020-05-08 16:24:12 +02:00
Florian Roth
64a5ad0d07
Merge pull request #735 from nl5887/master
...
fix incorrect use of action global
2020-05-08 12:20:33 +02:00
Thomas Patzke
3b96b5e497
Merge pull request #723 from neu5ron/socprime_add_zeek_and_corelight
...
sigmacs for Zeek and Corelight(Zeek)
2020-05-06 23:22:14 +02:00
Remco Verhoef
2d38cb7b52
fix incorrect use of global
2020-05-06 23:00:45 +02:00
Remco Verhoef
40539a0c0e
fix incorrect use of action global
2020-05-06 22:53:02 +02:00
Remco Hofman
123a23adae
win_susp_failed_logon_source rule
2020-05-06 22:24:02 +02:00
Florian Roth
473c31232e
add additional reference
2020-05-05 19:25:33 +02:00
Rettila
0e1fa5c135
Update win_possible_dc_shadow.yml
2020-05-05 18:14:32 +02:00
