Bhabesh Rai
|
e5f95cac0c
|
Added rule for Moriya rootkit
|
2021-05-06 17:29:20 +05:45 |
|
Bhabesh Rai
|
4529fbd1f3
|
Fixed too many spaces after hyphen error
|
2021-05-05 12:48:29 +05:45 |
|
Bhabesh Rai
|
1352f0b0a6
|
Added rule for Pingback backdoor
|
2021-05-05 12:37:50 +05:45 |
|
Bhabesh Rai
|
dd391cd0b9
|
Added rule for Lazarus activity of Apr 2021
|
2021-04-20 20:05:51 +05:45 |
|
Bhabesh Rai
|
a58c5ed7cc
|
Added rule for CVE-2021-21978 in VMware View Planner
|
2021-03-10 18:05:15 +05:45 |
|
Florian Roth
|
8c95f90075
|
Update web_vsphere_cve_2021_21972_unauth_rce_exploit.yml
|
2021-03-03 09:08:24 +01:00 |
|
Bhabesh Rai
|
56eed19fba
|
Added rules for successful exploitation fo CVE-2021-26857/8 in Exchannge
|
2021-03-03 12:46:50 +05:45 |
|
Bhabesh Rai
|
e1dff01cea
|
Added sigma rule for vSphere RCE CVE-2021-21972
|
2021-02-24 23:48:08 +05:45 |
|
Bhabesh Rai
|
a8d33171d7
|
Fixed c-uri
|
2021-02-02 10:23:47 +05:45 |
|
Florian Roth
|
2c48d2b0bb
|
fix: missing global action and sections
|
2021-02-01 20:00:06 +01:00 |
|
Bhabesh Rai
|
63e2f4bbce
|
Added rule for Sudo CVE-2021-3156 Exploitation Attempt
|
2021-02-01 23:08:45 +05:45 |
|
Bhabesh Rai
|
465ab713b0
|
Added rule for TerraMaster TOS CVE-2020-28188
|
2021-01-25 13:01:27 +05:45 |
|
Bhabesh Rai
|
dac229a8bb
|
Added rule for Oracle WebLogic Exploit CVE-2021-2109
|
2021-01-20 14:28:18 +05:45 |
|
Bhabesh Rai
|
93c7931037
|
Added Stealthy Office Persistence via VSTO
|
2021-01-10 17:54:17 +05:45 |
|
Florian Roth
|
c571285fd8
|
Merge pull request #1329 from Neo23x0/rule-devel
Rule devel
|
2021-01-09 11:32:36 +01:00 |
|
Florian Roth
|
63cc0d23c6
|
changes provided by FPT.EagleEye Team in
https://github.com/Neo23x0/sigma/pull/1218/files
|
2021-01-09 10:38:20 +01:00 |
|
Florian Roth
|
19171f5bed
|
Merge pull request #1315 from rtkdmasse/split-up-cmstp-rule
Split up cmstp rule into 3 separate rules and remove duplicates
|
2021-01-09 10:30:33 +01:00 |
|
Florian Roth
|
947925d81f
|
Merge pull request #1318 from rtkdmasse/azure-sysmon-image_load-generic
Update the azure image_load rule to be a generic sysmon rule
|
2021-01-09 10:29:52 +01:00 |
|
Florian Roth
|
04f7766d7a
|
Merge pull request #1319 from hieuttmmo/master
Detect Emotet DLL loading by looking rundll32.exe
|
2021-01-09 10:29:24 +01:00 |
|
Florian Roth
|
1a8bb9c991
|
Merge pull request #1327 from 2d4d/master
more AV event and suspicious commands
|
2021-01-09 10:28:30 +01:00 |
|
Arnim Rupp
|
d5de3fe5f9
|
more AV event and suspicious commands
some of the AV events are duplicates to win_av_relevant_match.yml, should we clean that up or include the strings in both?
|
2021-01-07 17:54:19 +01:00 |
|
Florian Roth
|
30dcc28a1f
|
Cisco ASA FTD Exploit CVE-2020-3452
|
2021-01-07 13:17:58 +01:00 |
|
yugoslavskiy
|
5ec4e42569
|
Merge pull request #1165 from w0rk3r/oscd3
[OSCD] Updated win_etw_trace_evasion - Added new detections, Removed reference to deprecated rule and changed selections
|
2021-01-06 00:12:22 +03:00 |
|
Florian Roth
|
ab408750ac
|
Merge pull request #1314 from Neo23x0/rule-devel
rule: Lazarus activity
|
2020-12-30 13:27:38 +01:00 |
|
Florian Roth
|
9ecaeb715f
|
Merge pull request #1317 from rtkdmasse/fix-missing-product-mouse-lock
Fix missing product mouse lock
|
2020-12-30 13:27:20 +01:00 |
|
ZikyHD
|
8a6b182fee
|
Update win_susp_adfind.yml
|
2020-12-29 14:41:46 +01:00 |
|
ZikyHD
|
ece829bb25
|
Update win_susp_adfind.yml
Typo on field name
|
2020-12-29 14:40:36 +01:00 |
|
Florian Roth
|
0a83f91386
|
Merge pull request #1321 from d4rk-d4nph3/master
Fixed typo in file format
|
2020-12-28 09:13:48 +01:00 |
|
Bhabesh Rai
|
bf77c8266a
|
Fixed typo in file format
|
2020-12-28 11:46:02 +05:45 |
|
Florian Roth
|
896fc21911
|
Merge pull request #1320 from d4rk-d4nph3/master
Added rule for CVE-2020-10148 SolarWinds Orion API Authentication Bypass
|
2020-12-27 20:37:36 +01:00 |
|
Florian Roth
|
a6212a4490
|
style: some minor style changes
|
2020-12-27 20:06:19 +01:00 |
|
Bhabesh Rai
|
1cfad987b0
|
Added rule for CVE-2020-10148 SolarWinds Orion API Authentication Bypass
|
2020-12-27 17:34:49 +05:45 |
|
Florian Roth
|
43033ab874
|
Update win_susp_emotet_rudll32_execution.yml
|
2020-12-25 09:05:55 +01:00 |
|
Tran Trung Hieu
|
d551b88d5c
|
Edit title convention
|
2020-12-25 14:21:26 +07:00 |
|
Tran Trung Hieu
|
4297e68704
|
Detect Emotet DLL loading by looking rundll32.exe
|
2020-12-25 14:09:40 +07:00 |
|
Daniel Masse
|
fedda17231
|
Update the azure image_load rule to be a generic sysmon rule
|
2020-12-23 16:29:49 -05:00 |
|
Daniel Masse
|
bf539fd1fe
|
Revert "Fix bug changing the logsource service to category"
This reverts commit 0f51e53d0e.
|
2020-12-23 15:50:49 -05:00 |
|
Daniel Masse
|
71ea5c7437
|
Add missing product in logsource
|
2020-12-23 15:45:00 -05:00 |
|
Daniel Masse
|
0f51e53d0e
|
Fix bug changing the logsource service to category
|
2020-12-23 15:12:31 -05:00 |
|
Daniel Masse
|
e4c052154d
|
Remove unneeded file
|
2020-12-23 14:30:24 -05:00 |
|
Daniel Masse
|
d2edf715f2
|
Split up cmstp rule into 3 separate rules and remove duplicates
|
2020-12-23 12:17:39 -05:00 |
|
Florian Roth
|
dedc34e91a
|
fix: typos and description
|
2020-12-23 14:46:08 +01:00 |
|
Florian Roth
|
cdc29dfbe8
|
rule: Lazarus activity
|
2020-12-23 14:43:32 +01:00 |
|
Florian Roth
|
821af35557
|
Merge pull request #1313 from Neo23x0/rule-devel
Rule devel
|
2020-12-23 13:57:11 +01:00 |
|
Florian Roth
|
7286d01f78
|
fix: typo in rule
|
2020-12-23 13:26:44 +01:00 |
|
Florian Roth
|
80aa398392
|
rule: Lazarus group loaders
|
2020-12-23 13:25:16 +01:00 |
|
Florian Roth
|
e67d17a967
|
rule: improved solarwinds webshell rule
|
2020-12-22 10:36:34 +01:00 |
|
Florian Roth
|
f20f346a6a
|
Merge pull request #1264 from omkar72/sdev-1
Adding 2 rules - Conhost & office test registry persistence
|
2020-12-21 18:28:59 +01:00 |
|
Florian Roth
|
e78d7e6aee
|
Merge pull request #1296 from mat-gas/fix-references
fix "references" field + add test for references in plural form
|
2020-12-21 18:25:35 +01:00 |
|
Florian Roth
|
377454cb31
|
Merge pull request #1299 from tjgeorgen/patch-1
ATT&CK subtechnique tag updates
|
2020-12-21 18:24:00 +01:00 |
|