frack113
|
acf2bfbd27
|
Update sigma_uuid verify
Make a better verify code
|
2021-09-05 10:43:42 +02:00 |
|
zakibro
|
5042ba65ac
|
Update lnx_auditd_audio_capture.yml
Added more references about arecord.
|
2021-09-05 09:28:53 +02:00 |
|
frack113
|
254b43f17f
|
Merge pull request #1994 from austinsonger/sysmon_mal_cobaltstrike_re.yml
Update sysmon_mal_cobaltstrike_re.yml
|
2021-09-05 09:20:22 +02:00 |
|
Austin Songer
|
fa5554660c
|
Update sysmon_mal_cobaltstrike_re.yml
|
2021-09-04 17:33:05 -05:00 |
|
Pawel Mazur
|
caf78b5ea1
|
New Rule - Linux-Audio-Capture
|
2021-09-04 22:10:34 +02:00 |
|
frack113
|
2d9e09ecc3
|
Merge pull request #1991 from austinsonger/Azure-Rules
Azure rules
|
2021-09-04 08:43:00 +02:00 |
|
Austin Songer
|
e7c5827776
|
Update azure_service_principal_removed.yml
|
2021-09-03 22:43:11 -05:00 |
|
Austin Songer
|
0612ea7f6e
|
Update azure_device_no_longer_managed_or_compliant.yml
|
2021-09-03 22:42:26 -05:00 |
|
Austin Songer
|
c420a17e05
|
Update azure_service_principal_removed.yml
|
2021-09-03 22:29:21 -05:00 |
|
Austin Songer
|
fda1e3362e
|
Update azure_owner_removed_from_application_or_service_principal.yml
|
2021-09-03 22:29:12 -05:00 |
|
Austin Songer
|
9d26116d27
|
Update azure_device_no_longer_managed_or_compliant.yml
|
2021-09-03 22:29:02 -05:00 |
|
Austin Songer
|
8fe7bfc452
|
Update azure_application_deleted.yml
|
2021-09-03 22:28:53 -05:00 |
|
Austin Songer
|
c021ae9e7c
|
Update and rename azure_device_or_configuration_deleted.yml to azure_device_or_configuration_modified_or_deleted.yml
|
2021-09-03 22:28:35 -05:00 |
|
Austin Songer
|
6744fb7f2e
|
Create azure_application_deleted.yml
|
2021-09-03 22:25:34 -05:00 |
|
Austin Songer
|
70ac0104cf
|
Create azure_service_principal_removed.yml
|
2021-09-03 22:25:01 -05:00 |
|
Austin Songer
|
6e15618c75
|
Create azure_device_or_configuration_deleted.yml
|
2021-09-03 22:24:32 -05:00 |
|
Austin Songer
|
b478132769
|
Create azure_owner_removed_from_application_or_service_principal.yml
|
2021-09-03 22:23:59 -05:00 |
|
Austin Songer
|
c0bdc3fb1b
|
Create azure_device_no_longer_managed_or_compliant.yml
|
2021-09-03 22:23:21 -05:00 |
|
frack113
|
6780182c37
|
Merge pull request #1974 from frack113/tags_pack2
Add missing Tags
|
2021-09-03 19:13:32 +02:00 |
|
frack113
|
2e474628fa
|
Merge pull request #1987 from zakibro/master
New Rule - Linux-Auditd-System Information Discovery
|
2021-09-03 19:10:28 +02:00 |
|
frack113
|
688df3405a
|
Merge pull request #1970 from frack113/red_T1564.004_1
Redcanary t1564.004 ADS test 1
|
2021-09-03 19:06:51 +02:00 |
|
frack113
|
77c6b74c72
|
Merge pull request #1985 from mvelazc0/master
Adding Petitpotam/ADCS attack vector detections
|
2021-09-03 19:06:03 +02:00 |
|
mvelazco
|
a7a002cb7f
|
updating fields as per frack113 feedback
|
2021-09-03 10:01:54 -04:00 |
|
frack113
|
6d1ab0a4c6
|
Merge pull request #1990 from phantinuss/pr2
Additional UAC Bypasses (2)
|
2021-09-03 14:00:51 +02:00 |
|
frack113
|
769451dc03
|
Add missing id
|
2021-09-03 13:42:15 +02:00 |
|
frack113
|
815134df7f
|
Cleanup
|
2021-09-03 13:30:10 +02:00 |
|
phantinuss
|
aa2e86963c
|
fix: rename filter
|
2021-09-03 13:26:34 +02:00 |
|
phantinuss
|
f3bdb0e43d
|
fix: remove unneeded selection
|
2021-09-03 13:26:23 +02:00 |
|
phantinuss
|
2de2de8433
|
Addition to UAC Bypasses
|
2021-09-03 13:26:11 +02:00 |
|
zakibro
|
8bd859f550
|
Update lnx_auditd_system_info_discovery.yml
|
2021-09-03 13:07:42 +02:00 |
|
frack113
|
8b170ff562
|
Merge pull request #1988 from ncrqnt/fix-rule-dates
fixed rule date to match specification
|
2021-09-03 13:03:19 +02:00 |
|
ncrqnt
|
adc3c9e608
|
fixed date: switched day/month
|
2021-09-03 12:03:38 +02:00 |
|
Pawel Mazur
|
864286e206
|
New Rule - Linux-Auditd-System Information Discovery
|
2021-09-03 11:33:18 +02:00 |
|
frack113
|
89562273cc
|
Merge pull request #1984 from austinsonger/azure_app_credential_modification.yml
azure_app_credential_modification.yml
|
2021-09-03 08:17:55 +02:00 |
|
frack113
|
88389f945d
|
Merge pull request #1983 from austinsonger/azure_service_principal_created.yml
azure_service_principal_created.yml
|
2021-09-03 08:14:47 +02:00 |
|
frack113
|
d40cdec062
|
Merge pull request #1982 from austinsonger/azure_network_firewall_policy_modified_or_deleted.yml
azure_network_firewall_policy_modified_or_deleted.yml
|
2021-09-03 08:13:30 +02:00 |
|
frack113
|
bd1b4c0d70
|
Merge pull request #1978 from rachelrice/update_aws_login
Update AWS Update Login Profile rule
|
2021-09-03 08:12:28 +02:00 |
|
frack113
|
1fc2a39720
|
Merge pull request #1975 from frack113/red_T1564.004_2
Redcanary t1564.004 test 2
|
2021-09-03 08:12:08 +02:00 |
|
frack113
|
b0f8275f72
|
Merge pull request #1977 from rachelrice/update_aws_assumerole
Update AWS STS AssumeRole Misuse rule
|
2021-09-03 08:11:52 +02:00 |
|
frack113
|
11e4b900e4
|
Update global id
|
2021-09-03 06:59:40 +02:00 |
|
frack113
|
135d0a2c61
|
Update global id
|
2021-09-03 06:50:00 +02:00 |
|
frack113
|
a6bb5574fb
|
Update global id
|
2021-09-03 06:35:35 +02:00 |
|
mvelazco
|
ba41e922d2
|
adding Petitpotam host detections
|
2021-09-03 00:12:49 -04:00 |
|
Austin Songer
|
775c0e8e7f
|
Update azure_app_credential_modification.yml
|
2021-09-02 21:00:21 -05:00 |
|
Austin Songer
|
643ec0abe3
|
Update azure_service_principal_created.yml
|
2021-09-02 21:00:02 -05:00 |
|
Austin Songer
|
10af7bbdb1
|
Create azure_app_credential_modification.yml
|
2021-09-02 20:53:32 -05:00 |
|
Austin Songer
|
d25fd420d6
|
Create azure_service_principal_created.yml
|
2021-09-02 20:48:35 -05:00 |
|
Austin Songer
|
1272c76ae7
|
Create azure_network_firewall_policy_modified_or_deleted.yml
|
2021-09-02 20:31:27 -05:00 |
|
frack113
|
d02ee1eddd
|
Update global ID
|
2021-09-02 21:16:55 +02:00 |
|
frack113
|
f90c7558a7
|
update global id
|
2021-09-02 21:03:25 +02:00 |
|