668 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Thomas Patzke	3b9ff57a38	Added merge_sigma tool ... * Tests * Restructured Makefile	2017-11-14 22:17:18 +01:00
Florian Roth	3a378f08ea	Bugfix in Adwind rule - typo in typo	2017-11-10 12:51:54 +01:00
Florian Roth	6e4e857456	Improved Adwind Sigma rule	2017-11-10 12:39:08 +01:00
Florian Roth	57d56dddb7	Improved Adwind RAT rule	2017-11-09 18:53:46 +01:00
Florian Roth	b558f5914e	Added reference to Tom Ueltschie's slides	2017-11-09 18:30:50 +01:00
Florian Roth	781db7404e	Updated Adwind RAT rule	2017-11-09 18:28:27 +01:00
Florian Roth	970f01f9f2	Renamed file for consistency	2017-11-09 15:43:32 +01:00
Florian Roth	a042105aa1	Rule: Adwind RAT / JRAT javaw.exe process starts in AppData folder	2017-11-09 15:43:32 +01:00
Thomas Patzke	273ed4b5d6	Fixed test case ... Test case used with kibana backend doesn't supports multiple indices	2017-11-09 10:47:03 +01:00
Thomas Patzke	f478cffb41	Added default index configs for usual ELK setups ... * Added test case for defaultindex with kibana backend	2017-11-09 10:05:41 +01:00
Thomas Patzke	46f1ce35a8	sigmac/kibana backend: added index fallback if none determined	2017-11-09 10:02:23 +01:00
Florian Roth	1bea284280	Added Windows Driver Framework log source to configs	2017-11-09 08:42:58 +01:00
Florian Roth	e83e3a0c07	Bugfixes in Splunk config	2017-11-09 08:41:07 +01:00
Florian Roth	a0ac61229c	Rule: Detect plugged USB devices	2017-11-09 08:40:46 +01:00
Florian Roth	fd801a61a5	Bronze Butler Daserf malware User Agents in Proxy Logs	2017-11-08 12:52:11 +01:00
Florian Roth	e5383be163	Rule: Proxy suspicious downloads from Dyndns hosts	2017-11-08 11:32:30 +01:00
Florian Roth	4540088aa9	Rule: Extended proxy suspicious TLD white list rule	2017-11-08 00:38:26 +01:00
Florian Roth	ad53cc7cc2	Rule: Sysmon Turla Commands	2017-11-08 00:33:17 +01:00
Florian Roth	acc430c4b6	Rule: Proxy download from blacklisted TLDs	2017-11-07 14:03:16 +01:00
Florian Roth	58f20d3cfb	Rule: Proxy download whitelist bugfix and improvements	2017-11-07 14:02:56 +01:00
Florian Roth	59e5b3b999	Sysmon: Named Pipe detection for APT malware	2017-11-06 14:24:42 +01:00
Florian Roth	ea840632f3	Sysmon: Named Pipe detection for Turla malware by @markus_neis	2017-11-06 14:22:09 +01:00
Florian Roth	37cea85072	Rundll32.exe suspicious network connections	2017-11-04 14:44:30 +01:00
Thomas Patzke	b03f9359ec	sigmac: Added rule filter	2017-11-02 00:02:15 +01:00
Thomas Patzke	5035c9c490	Converted Windows 4688-only rules into 4688 and Sysmon/1 collections	2017-11-01 22:12:14 +01:00
Thomas Patzke	f3a809eb00	Improved admin logon rules and removed duplicates	2017-11-01 21:33:01 +01:00
Thomas Patzke	0055eedb83	Merge pull request #54 from juju4/CAR-2016-04-005b ... Admin user remote login	2017-11-01 21:22:09 +01:00
Thomas Patzke	613f922976	Merge pull request #43 from juju4/master ... New rules	2017-11-01 21:21:30 +01:00
Thomas Patzke	e90ff2d991	Improved testing ... * Added collection test case * Test of file output	2017-11-01 21:14:11 +01:00
Thomas Patzke	118e8af738	Simplified rule collection	2017-11-01 10:00:35 +01:00
Thomas Patzke	732f01878f	Sigma rule collection YAML action documents	2017-11-01 00:17:55 +01:00
Thomas Patzke	d0b2bd9875	Multiple rules per file ... * New wrapper class SigmaCollectionParser parses all YAML documents contained in file and handles multiple SigmaParser instantiation. * Exemplary extended one security/4688 rule to security/4688 + sysmon/1	2017-10-31 23:06:18 +01:00
Thomas Patzke	5743e25931	Added logging framework	2017-10-31 22:13:20 +01:00
Thomas Patzke	9d96a998d7	Merge pull request #56 from juju4/CAR-2013-05-002b ... Detects Suspicious Run Locations - MITRE CAR-2013-05-002	2017-10-30 00:27:56 +01:00
Thomas Patzke	720c992573	Dropped within keyword ... Covered by timeframe attribute. Fixes issue #26.	2017-10-30 00:25:56 +01:00
Thomas Patzke	25ba2c81ad	Merge branch 'juju4-CAR-2013-04-002b'	2017-10-30 00:15:43 +01:00
Thomas Patzke	c865b0e9a8	Removed within keyword in rule	2017-10-30 00:15:01 +01:00
Thomas Patzke	0df60fe004	Merge branch 'CAR-2013-04-002b' of https://github.com/juju4/sigma into juju4-CAR-2013-04-002b	2017-10-30 00:13:21 +01:00
Thomas Patzke	27227855b5	Merge branch 'devel-sigmac'	2017-10-29 23:59:49 +01:00
Thomas Patzke	012cb6227f	Added proper handling of null/not null values ... Fixes issue #25	2017-10-29 23:57:39 +01:00
juju4	4b64fc1704	double quotes = escape	2017-10-29 14:42:40 -04:00
juju4	07185247cb	double quotes = escape	2017-10-29 14:32:52 -04:00
juju4	f5f20c3f75	Admin user remote login	2017-10-29 14:30:11 -04:00
juju4	19dd69140b	Detects Suspicious Run Locations - MITRE CAR-2013-05-002	2017-10-29 14:27:01 -04:00
juju4	ad27a0a117	Detects Quick execution of a series of suspicious commands - MITRE CAR-2013-04-002	2017-10-29 14:24:53 -04:00
juju4	9d968de337	Merge remote-tracking branch 'upstream/master'	2017-10-29 14:14:47 -04:00
Florian Roth	b7e8000ccb	Improved Office Shell rule > added 'schtasks.exe'	2017-10-25 23:53:45 +02:00
Florian Roth	e680da1b50	Suspicious flash player download location / BadRabbit	2017-10-25 08:40:30 +02:00
Thomas Patzke	5fa9e685b1	Splitted parts of generate to generateQuery in backend code	2017-10-25 00:03:03 +02:00
Thomas Patzke	ace1bf94ea	Merge branch 'devel-sigmac'	2017-10-24 23:49:04 +02:00