7778 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
frack113	ac90ee0002	Update global ID	2021-09-02 20:23:23 +02:00
frack113	086a15fc45	Update global ID	2021-09-02 20:07:03 +02:00
Rachel Rice	78d3fa4795	Update AWS STS AssumeRole Misuse rule ... Update selection criteria for AWS STS AssumeRole Misuse rule for any event by an AssumedRole userIdentity. Closes SigmaHQ/sigma#1963.	2021-09-02 17:40:35 +01:00
Rachel Rice	7ccb773b20	Update AWS Update Login Profile rule ... Update selection criteria for AWS Update Login Profile rule to check for mismatch between userIdentity.arn and requestParameters.userName. Closes SigmaHQ/sigma#1966.	2021-09-02 17:37:41 +01:00
frack113	9bcefc6a93	move uuid from global	2021-09-02 16:05:05 +02:00
frack113	b731c20594	Merge pull request #1971 from phantinuss/master ... fix: prevent possible FPs	2021-09-02 15:34:46 +02:00
frack113	a048403089	Merge pull request #1973 from klingerko/cs_namedpipe_updates ... Remove duplicate and regex improvements	2021-09-02 15:25:01 +02:00
phantinuss	ab721c736c	chore: move level/falsepositives to bottom	2021-09-02 14:55:17 +02:00
klingerko	15e25f9635	update modifed date	2021-09-02 14:50:14 +02:00
phantinuss	0b373ff1e9	fix: remove 2nd selection due to FPs	2021-09-02 14:47:47 +02:00
frack113	6a1b95d947	Findstr covert by win_susp_findstr.yml	2021-09-02 14:22:59 +02:00
frack113	aaa568ff2d	print covert by win_susp_print.yml	2021-09-02 14:18:38 +02:00
phantinuss	5cb6eed52e	fix: remove single value lists	2021-09-02 14:09:03 +02:00
phantinuss	f4a5df67ae	further narrowing down of the selection, therefore removing the filter	2021-09-02 10:28:01 +02:00
frack113	90e673e5ac	fix invalid tags	2021-09-02 10:17:50 +02:00
Florian Roth	0603581111	Merge pull request #1969 from SigmaHQ/rule-devel ... More Named Pipe Rules and WMI rule refactoring	2021-09-02 10:15:00 +02:00
frack113	6f1f70ca5e	Add missing tags	2021-09-02 09:59:19 +02:00
frack113	25c6f69ea3	update references	2021-09-02 09:51:44 +02:00
frack113	5e87970c77	add powershell_store_file_in_alternate_data_stream.yml	2021-09-02 09:47:54 +02:00
frack113	5212b388c6	Merge pull request #1967 from d4rk-d4nph3/master ... Added rule for detection of Atera RMM Agent installation	2021-09-02 09:19:49 +02:00
Thomas Patzke	51bc036dbf	Merge pull request #1921 from roysjosh/azure-sentinel-arm-output ... Azure Sentinel support	2021-09-01 22:26:42 +02:00
Thomas Patzke	3d6ad1bc0f	Merge pull request #1944 from ncrqnt/elastic-subtechniques ... [Elastic] Add support for authors and subtechniques	2021-09-01 22:25:10 +02:00
Thomas Patzke	6d3f7069e6	Merge pull request #1962 from neu5ron/qoutes_and_wildcards ... Elasticsearch Backend fix small corner cases of quotes and wildcards	2021-09-01 22:08:40 +02:00
frack113	e0cd35261c	add missing tags	2021-09-01 20:01:03 +02:00
frack113	1ba0a7c7a3	add missing tags	2021-09-01 19:38:35 +02:00
Konstantin Klinger	457da818a4	regex optimisations	2021-09-01 17:06:55 +02:00
Konstantin Klinger	e83ee55573	remove duplicate	2021-09-01 17:05:36 +02:00
Florian Roth	b0c2d7b75a	fix: tags for WMI / execution / persistence	2021-09-01 16:34:50 +02:00
Florian Roth	2f7f050ad8	fix: removed tags	2021-09-01 16:32:27 +02:00
phantinuss	0b38237dbf	fix: add relation to now obsolete rule	2021-09-01 15:38:29 +02:00
phantinuss	ae9966bdcc	fix: unifying two overlapping rules	2021-09-01 14:48:32 +02:00
phantinuss	deefcaa8ac	fix: prevent possible FPs with the respective command only used as the last parameter	2021-09-01 14:33:46 +02:00
frack113	434c3891ff	Merge pull request #1965 from frack113/add_tags ... Add tags when missing	2021-09-01 14:07:31 +02:00
Florian Roth	1aac21ba79	fix: single list item issue	2021-09-01 14:03:42 +02:00
Florian Roth	1c4f642227	Merge pull request #1699 from matsto/patch-1 ... Fixed transformation modifier for keywords	2021-09-01 14:02:10 +02:00
frack113	2dbbaf0180	fix missing char in date	2021-09-01 14:00:55 +02:00
Florian Roth	505140d273	rule: extended WMI suspicious scripts rule	2021-09-01 13:57:48 +02:00
Florian Roth	e787420be1	rule: WMI filter content encoded executable	2021-09-01 13:57:36 +02:00
Florian Roth	8761927e8c	rule: susp scrcons.exe creating named pipe	2021-09-01 13:57:17 +02:00
frack113	e71fce6f11	fix errors	2021-09-01 13:55:14 +02:00
Florian Roth	affc929c3b	LiquidSnake named pipe	2021-09-01 13:54:47 +02:00
frack113	80dbfa7af5	add process_creation_alternate_data_streams.yml	2021-09-01 13:52:09 +02:00
Florian Roth	c8b3036949	Merge pull request #1968 from SigmaHQ/rule-devel ... docs: note to improved sysmon config	2021-09-01 13:21:28 +02:00
Florian Roth	f102b2d9a1	docs: note to improved sysmon config	2021-09-01 13:07:18 +02:00
Florian Roth	8bba246205	refactor: better way to write it	2021-09-01 12:57:34 +02:00
frack113	2cb5f5e4c6	add missing tags	2021-09-01 12:54:21 +02:00
Florian Roth	c146bc44c7	Merge branch 'master' into patch-1	2021-09-01 12:48:51 +02:00
Bhabesh Rai	6859b6c38f	Added rule for detection of Atera RMM Agent installation	2021-09-01 15:24:47 +05:45
frack113	af599e4877	Merge pull request #1958 from phantinuss/master ... Bulk of new rules, mainly UAC Bypasses	2021-09-01 10:53:02 +02:00
frack113	892c58270a	Update tags	2021-09-01 10:33:57 +02:00