Florian Roth
|
e0f166aba2
|
rule: Serv-U exploitation
https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
|
2021-07-14 08:35:25 +02:00 |
|
Florian Roth
|
5e7f1f3a36
|
refactor: THOR config adjustments
|
2021-07-08 14:51:49 +02:00 |
|
Florian Roth
|
b055879ec5
|
Merge pull request #1655 from SigmaHQ/mdatp-mapping-ext1
feat: OriginalFileName mapping in MDATP ImageLoad events
|
2021-07-08 08:33:59 +02:00 |
|
Florian Roth
|
cdc434cfc4
|
feat: OriginalFileName mapping in MDATP ImageLoad events
|
2021-07-07 18:22:58 +02:00 |
|
Florian Roth
|
25dec8a17b
|
Merge pull request #1649 from leegengyu/patch-9
Update win_apt_apt29_thinktanks.yml - Links
|
2021-07-07 18:10:27 +02:00 |
|
Florian Roth
|
8fd5a761a2
|
Merge pull request #1651 from frack113/service_auditd
Rename linux rule with service:auditd
|
2021-07-07 18:10:14 +02:00 |
|
Florian Roth
|
c3c152d457
|
Merge pull request #1652 from SigmaHQ/rule-devel
refactor: changed cmdkey rule
|
2021-07-07 18:09:44 +02:00 |
|
Florian Roth
|
9d6f89f0f2
|
Merge pull request #1654 from frack113/redcanary_t1564
Add 2 defense-evasion T1562.001 rules
|
2021-07-07 18:09:27 +02:00 |
|
frack113
|
8a96aa7855
|
Add 2 defense-evasion T1562.001 rules
|
2021-07-07 15:43:55 +02:00 |
|
Florian Roth
|
0c7661e8bc
|
refactor: changed cmdkey rule
|
2021-07-07 14:45:03 +02:00 |
|
G Y
|
1adac5b036
|
Update win_apt_apt29_thinktanks.yml - Links
Reference links updated with grammar corrections.
|
2021-07-07 20:21:41 +08:00 |
|
frack113
|
f2cdbb5aa7
|
Rename rule service:auditd
|
2021-07-07 13:53:51 +02:00 |
|
Florian Roth
|
792f234872
|
Merge pull request #1636 from leegengyu/patch-6
powershell_data_compressed.yml - Update selection
|
2021-07-07 10:12:52 +02:00 |
|
Florian Roth
|
2e15742a37
|
Merge pull request #1637 from frack113/fix_win_rdp_reverse_tunnel.yml
win_rdp_reverse_tunnel.yml fix invalid field name
|
2021-07-07 10:12:16 +02:00 |
|
Florian Roth
|
6e00745288
|
Merge pull request #1638 from frack113/fix_win_external_device.yml
win_external_device.yml fix invalid field name
|
2021-07-07 10:12:04 +02:00 |
|
Florian Roth
|
bd0628240c
|
Merge pull request #1639 from frack113/fix_win_possible_dc_shadow.yml
fix invalid field EventID 5136
|
2021-07-07 10:11:51 +02:00 |
|
Florian Roth
|
ad36a03622
|
Merge pull request #1640 from frack113/fix_win_susp_local_anon_logon_created.yml
win_susp_local_anon_logon_created.yml fix invalid case SamAccountName
|
2021-07-07 10:11:36 +02:00 |
|
Florian Roth
|
0019018389
|
Merge pull request #1641 from frack113/upadte_winlogbeat
winlogbeat add some missing fields mapping
|
2021-07-07 10:11:22 +02:00 |
|
Florian Roth
|
1c032c84be
|
Merge pull request #1643 from austinsonger/microsoft365_impossible_travel
Microsoft365 impossible travel
|
2021-07-07 10:11:03 +02:00 |
|
Florian Roth
|
dc2377be13
|
Merge pull request #1644 from leegengyu/patch-7
Update win_admin_rdp_login.yml - Fix Field Name & Value
|
2021-07-07 10:04:02 +02:00 |
|
Florian Roth
|
0573097696
|
Merge pull request #1645 from leegengyu/patch-8
Update win_mal_service_installs.yml - Corrected logsource
|
2021-07-07 10:03:48 +02:00 |
|
Florian Roth
|
1e76fc38dc
|
Merge pull request #1647 from frack113/fix_windows_field_name
fix invalid windows fields name
|
2021-07-07 10:03:15 +02:00 |
|
frack113
|
5c9ca35bb6
|
Add the last missing
|
2021-07-07 09:10:50 +02:00 |
|
frack113
|
bb970de5b7
|
fix invalid fields name
|
2021-07-07 09:05:00 +02:00 |
|
G Y
|
6b63a309da
|
Update win_mal_service_installs.yml - Corrected logsource
Fix mistake (incorrect logsource for event ID 4697) in #1629.
|
2021-07-07 10:33:26 +08:00 |
|
G Y
|
eece2850a7
|
Update win_admin_rdp_login.yml - Fix Field Name
1. Field name changed to `TargetUserName`.
Source: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624
2. Value changed from `Admin-` to `Admin`.
|
2021-07-07 09:43:55 +08:00 |
|
Austin Songer
|
aac72668f4
|
Update microsoft365_impossible_travel_activity.yml
|
2021-07-06 16:59:28 -05:00 |
|
Austin Songer
|
af3fd2fe8e
|
Create microsoft365_impossible_travel_activity.yml
|
2021-07-06 16:55:54 -05:00 |
|
Austin Songer
|
35fa401f38
|
Merge branch 'SigmaHQ:master' into master
|
2021-07-06 16:52:12 -05:00 |
|
frack113
|
e76f30d59c
|
Add some missing fields mapping
|
2021-07-06 15:56:33 +02:00 |
|
frack113
|
9cf1d3d5f3
|
fix invalid case SamAccountName
|
2021-07-06 15:43:07 +02:00 |
|
frack113
|
bbf908835e
|
fix invalid field EventID 5136
|
2021-07-06 15:25:32 +02:00 |
|
leegengyu
|
3594b10d74
|
Insert modified date
|
2021-07-06 20:56:31 +08:00 |
|
G Y
|
c5d2a55f6d
|
powershell_data_compressed.yml - Update selection
Changed to ScriptBlockText (due to PowerShell logging-specific context).
|
2021-07-06 20:36:38 +08:00 |
|
Florian Roth
|
bcf2bf2e4d
|
Merge pull request #1635 from frack113/fix_win_susp_failed_logons_single_source_kerberos
Fix invalid field name
|
2021-07-06 14:35:06 +02:00 |
|
frack113
|
b0c9bc1d2d
|
fix invalid field name EventID 6416
|
2021-07-06 14:27:29 +02:00 |
|
frack113
|
fca3c72087
|
fix invalid field name
|
2021-07-06 14:16:01 +02:00 |
|
Florian Roth
|
ff0f1a0222
|
Merge pull request #1633 from leegengyu/art_convert_yaml_to_md
Convert ART reference links from .yaml to .md
|
2021-07-06 13:39:37 +02:00 |
|
frack113
|
12fb71b83b
|
fix invalid field name
|
2021-07-06 12:53:38 +02:00 |
|
leegengyu
|
1f19f79da9
|
Convert ART reference links from .yaml to .md
|
2021-07-06 17:56:38 +08:00 |
|
Florian Roth
|
705415c2bd
|
Merge pull request #1632 from frack113/process_creation_OriginalFileName
change OriginalFilename case
|
2021-07-06 11:45:21 +02:00 |
|
leegengyu
|
3791ab4b12
|
Updated ART reference links from .yaml to .md
|
2021-07-06 17:43:20 +08:00 |
|
leegengyu
|
69d5d9734d
|
Updated ART reference links from .yaml
|
2021-07-06 17:39:25 +08:00 |
|
leegengyu
|
5eb9547d5b
|
Updated ART reference links from .yaml to .md and sub-technique links.
|
2021-07-06 17:30:57 +08:00 |
|
leegengyu
|
7557732ca2
|
Updated ART reference links from .yaml to .md and sub-technique links.
|
2021-07-06 17:21:22 +08:00 |
|
Florian Roth
|
8beb70e970
|
Merge pull request #1631 from leegengyu/patch-5
Update mordordatasets links
|
2021-07-06 10:45:15 +02:00 |
|
Florian Roth
|
223ae079ea
|
Merge pull request #1627 from SigmaHQ/rule-devel
rule: PrinterNightmare Mimikatz update
|
2021-07-06 10:44:48 +02:00 |
|
Florian Roth
|
e31f0c8f7f
|
Merge pull request #1628 from d4rk-d4nph3/master
Added and updated Defender's tamper related rules
|
2021-07-06 10:44:33 +02:00 |
|
Florian Roth
|
17f7bbc063
|
Merge pull request #1630 from frack113/fix_childimage
childimage do not exist in sysmon schema
|
2021-07-06 10:44:00 +02:00 |
|
Florian Roth
|
86bd175bac
|
Merge pull request #1629 from leegengyu/patch-4
Update win_mal_service_installs.yml - Add service & event ID
|
2021-07-06 10:43:33 +02:00 |
|