2680 Commits

Author	SHA1	Message	Date
Florian Roth	35ab80b39e	Merge pull request #1306 from d4rk-d4nph3/master ... Added rule for Impacket's PsExec execution	2020-12-21 18:23:41 +01:00
Florian Roth	9c8e1387a9	rule: Solarwinds SUPERNOVA web shell access	2020-12-17 09:05:08 +01:00
Bhabesh Rai	0a7e95954e	Fix for fail build	2020-12-14 12:55:08 +05:45
Bhabesh Rai	63fb31882e	Added rule for Impacket's PsExec execution	2020-12-14 12:48:26 +05:45
Florian Roth	80e1a5e7eb	Merge pull request #1292 from toffeebr33k/master ... Create 2 new rules on AWS Privilege Escalation and AWS Enumeration	2020-12-13 19:06:44 +01:00
Florian Roth	1b0aaf62c3	Merge pull request #1266 from omkar72/ryuk ... modifying couple of rules	2020-12-13 19:05:54 +01:00
Florian Roth	e2ade077ed	Merge pull request #1275 from bczyz1/patch-3 ... update win_apt_slingshot.yml	2020-12-13 19:04:47 +01:00
Florian Roth	5197f21ed1	fix: duplicate ID	2020-12-13 18:59:04 +01:00
Florian Roth	612008a4d8	fix identation	2020-12-11 18:40:17 +01:00
Tran Trung Hieu	edc79a8bb6	Detects suspicious shell spawn from MSSQL process, this might be sight of RCE or SQL Injection	2020-12-11 15:17:23 +07:00
Florian Roth	cfe60d180b	Merge pull request #1301 from d4rk-d4nph3/master ... Added rule for Fortinet CVE-2018-13379 preauth file read exploitation.	2020-12-08 11:09:51 +01:00
Florian Roth	b6d62b7a21	Merge pull request #1302 from Neo23x0/rule-devel ... TA505 Dropper, minor fix in PowerShell Rule	2020-12-08 10:40:07 +01:00
Florian Roth	2c642c64d2	Removed a value	2020-12-08 10:38:32 +01:00
Florian Roth	a87a81d8cc	Update web_fortinet_cve_2018_13379_preauth_read_exploit.yml	2020-12-08 10:33:52 +01:00
Florian Roth	640470cefd	TA505 Loader Rule	2020-12-08 10:15:30 +01:00
Bhabesh Rai	3ddf940812	Added rule for Fortinet CVE-2018-13379 preauth file read exploitation.	2020-12-08 14:46:47 +05:45
Florian Roth	540039cbc3	fix: Malicious Nishang PowerShell Commandlets FP with MDATP	2020-12-05 09:33:42 +01:00
tjgeorgen	1c6c3a36fe	include updated RDP att&ck tag	2020-12-04 11:59:23 -05:00
tjgeorgen	0eda1ab462	also update tag for folder variant	2020-12-04 11:42:05 -05:00
tjgeorgen	5208bdd65a	add new version of ATT&CK T1500 tag	2020-12-04 11:19:16 -05:00
OG	70fb078a56	Update sysmon_office_test_regadd.yml	2020-11-29 18:02:37 +05:30
OG	8e801ede32	Update win_susp_psexec_eula.yml	2020-11-29 17:45:29 +05:30
mat	b3e36281b5	fix reference field + add test for references in plural form	2020-11-27 10:17:45 +01:00
Florian Roth	c6fc9de144	New Trickbot wermgr rule	2020-11-26 09:54:27 +01:00
Florian Roth	c111ab3141	Improved Trickbot recon rule	2020-11-26 09:54:13 +01:00
Florian Roth	b31ed47ccf	Merge branch 'master' into devel	2020-11-26 09:44:56 +01:00
bczyz1	05398ae95e	change field newprocessname -> image	2020-11-23 13:43:19 +01:00
toffeebr33k	c8c4183678	Update aws_enum_listing.yml	2020-11-22 01:53:58 +08:00
toffeebr33k	3d0e1988c6	Update aws_enum_listing.yml	2020-11-22 01:41:20 +08:00
toffeebr33k	273590b151	Update aws_enum_listing.yml	2020-11-22 01:17:42 +08:00
toffeebr33k	52fca0fe3a	Update aws_enum_listing.yml	2020-11-22 01:05:56 +08:00
toffeebr33k	e764ca687a	Update aws_enum_listing.yml	2020-11-22 00:50:34 +08:00
toffeebr33k	00504ee186	Update aws_update_login_profile.yml	2020-11-22 00:42:25 +08:00
toffeebr33k	3dd1525b98	Update aws_update_login_profile.yml	2020-11-22 00:38:41 +08:00
toffeebr33k	6b65180464	Add files via upload	2020-11-22 00:33:47 +08:00
toffeebr33k	cff82ff79a	Delete aws_update_login_profile.yml	2020-11-22 00:33:17 +08:00
toffeebr33k	7e1c918b4d	Delete aws_enum_listing.yml	2020-11-22 00:32:59 +08:00
toffeebr33k	551764b630	Add files via upload	2020-11-22 00:26:17 +08:00
toffeebr33k	3dd25ddea4	Delete aws_update_login_profile.yml	2020-11-22 00:25:54 +08:00
toffeebr33k	fba9c12bb2	Delete aws_enum_listing.yml	2020-11-22 00:25:29 +08:00
toffeebr33k	6c1f3f5969	Update aws_update_login_profile.yml	2020-11-21 23:45:10 +08:00
toffeebr33k	70e725e82e	Update aws_enum_listing.yml	2020-11-21 23:44:14 +08:00
toffeebr33k	596d1b6e4c	Update aws_update_login_profile.yml	2020-11-21 23:29:49 +08:00
toffeebr33k	a786ebd04b	Update aws_enum_listing.yml	2020-11-21 23:28:57 +08:00
toffeebr33k	1ca903b168	Update aws_enum_listing.yml	2020-11-21 23:22:07 +08:00
toffeebr33k	7f61591865	Add files via upload	2020-11-21 23:12:50 +08:00
bczyz1	193021eff8	Update win_apt_slingshot.yml ... fix condition	2020-11-20 09:19:03 +01:00
Florian Roth	af4d546408	Merge pull request #1282 from Neo23x0/rule-devel ... fix: FPs with notepad++ GUP rule	2020-11-10 13:39:28 +01:00
Florian Roth	2e9d7951a6	Merge pull request #1272 from bczyz1/patch-2 ... Fix typo in win_apt_lazarus_session_hijack.yml	2020-11-10 13:35:08 +01:00
Florian Roth	f6c0fb2d33	fix: FPs with notepad++ GUP rule	2020-11-09 16:34:12 +01:00
Florian Roth	c3785d6dc7	rule: FPs with WmiPrvSE rule	2020-11-05 16:44:33 +01:00
bczyz1	c554aaea8f	update win_apt_slingshot.yml ... - optimized rule - added detection of task modification (flag /change + /disable as described here https://stackoverflow.com/questions/26169582/does-anyone-know-of-a-way-to-turn-off-windows-defragmenters-default-schedule-us)	2020-11-05 15:51:22 +01:00
Florian Roth	908023fa66	rule: added second expression	2020-11-04 16:43:35 +01:00
bczyz1	4a5b2d642e	Fix typo in win_apt_lazarus_session_hijack.yml	2020-11-03 14:46:29 +01:00
Florian Roth	f848bb912c	rule: reworked weblogic CVE-2020-14882 rule	2020-11-03 10:39:40 +01:00
Florian Roth	dd0d1d053c	rule: WebLogic exploit CVE-2020-14882	2020-11-02 11:11:37 +01:00
omkargudhate22	f1bb9726ca	updated mitre tag	2020-10-30 13:35:40 +05:30
omkar72	86a849728d	ryuk changes	2020-10-30 13:15:11 +05:30
omkargudhate22	df07d53fea	formatting values	2020-10-25 18:23:29 +05:30
omkargudhate22	06890ba28b	update title	2020-10-25 15:10:12 +05:30
omkar72	021842eaa3	office test reg	2020-10-25 12:36:08 +05:30
omkar72	42de51cadc	conhost executions	2020-10-25 12:33:59 +05:30
Florian Roth	75637324e0	feat: cover newest emotet campaigns	2020-10-23 23:44:48 +02:00
Florian Roth	ee789a309c	fix: FP with expression	2020-10-20 13:11:10 +02:00
Florian Roth	198b292c26	rule: emotet encoded commands	2020-10-20 12:51:58 +02:00
Florian Roth	48f1be04d4	fix: ping hex ip rule	2020-10-16 10:06:24 +02:00
Jonhnathan	8f6ad7df6b	Update win_etw_trace_evasion.yml	2020-10-15 09:22:13 -03:00
Jonhnathan	043033c1b7	Update win_etw_trace_evasion.yml	2020-10-13 22:59:06 -03:00
Jonhnathan	ac1a6927ad	Update win_etw_trace_evasion.yml	2020-10-13 22:55:13 -03:00
Jonhnathan	e3446b873a	Correct duplicated selection	2020-10-13 22:54:30 -03:00
Jonhnathan	b1c9871b74	Add Additional detections for other techniques	2020-10-13 22:51:48 -03:00
Jonhnathan	a01c08f617	Removed reference to deprecated rule and improve logic	2020-10-13 17:45:35 -03:00
Jonhnathan	4c75d22d93	Revert "Create win_susp_replace_lolbin.yml" ... This reverts commit e6a6549676.	2020-10-13 17:40:10 -03:00
Jonhnathan	1455d414bc	Revert "Changed the rule to download only and not the copy" ... This reverts commit 1324bc1ad1.	2020-10-13 17:40:07 -03:00
Florian Roth	3affdd12e0	fix: rule title casing	2020-10-12 09:51:35 +02:00
Florian Roth	0d0cda0f86	docs: improved false positive notes	2020-10-12 09:18:42 +02:00
Florian Roth	e7c6794ecd	rule: suspicious wmic process call create + rundll32	2020-10-12 09:18:30 +02:00
Florian Roth	2e732eb01f	Merge branch 'master' into rule-devel	2020-10-12 09:13:24 +02:00
Jonhnathan	1324bc1ad1	Changed the rule to download only and not the copy	2020-10-07 16:18:21 -03:00
Jonhnathan	e6a6549676	Create win_susp_replace_lolbin.yml ... Item 77 of #1014	2020-10-07 10:37:15 -03:00
Florian Roth	c56cd2dfff	Merge pull request #1024 from omkar72/master ... Com hijack shell folder	2020-10-02 09:24:16 +02:00
omkargudhate22	4487d9cc7e	added event type & changed technique	2020-10-02 09:22:14 +05:30
Florian Roth	d3ee1aba66	docs: MITRE ATT&CK(R) trademark references removed or adjusted ... https://github.com/Neo23x0/sigma/issues/1028	2020-09-30 08:53:52 +02:00
Florian Roth	c17ca6d5fe	Merge pull request #1018 from savvyspoon/wcry-dns ... WannaCry Killswitch domain DNS query	2020-09-29 09:27:21 +02:00
omkargudhate22	68a992d903	updated name	2020-09-27 21:57:19 +05:30
omkargudhate22	e7c8197e34	Updated fields & renamed	2020-09-27 21:52:59 +05:30
omkargudhate22	ebe3dce1d7	Update sysmon_comhijack_uac_bypass.yml	2020-09-27 21:44:41 +05:30
omkar72	3f148e6c7c	COM hijack of shell folder to execute arbitrary application & UAC bypass using sdclt.	2020-09-27 21:19:04 +05:30
Florian Roth	d7d9c0e772	Merge pull request #1021 from hieuttmmo/master ... Sigma rule to detect AdFind.exe execution	2020-09-27 09:50:41 +02:00
Florian Roth	8020fe3c40	false positive condition	2020-09-26 17:03:29 +02:00
Florian Roth	60795f7050	Update win_susp_adfind.yml ... Fear that a simple adfind.exe causes too many false positives	2020-09-26 17:02:39 +02:00
Florian Roth	dbdd758365	Duplicate Rule ... we already have a rule for that	2020-09-26 17:01:32 +02:00
Tran Trung Hieu	d4dd0600ad	Fix logsource service to process_creation	2020-09-26 21:45:23 +07:00
Tran Trung Hieu	c756fc8576	Detect Suspicious AdFind Execution	2020-09-26 21:34:06 +07:00
Mike Wade	f76f80db80	Killswitch domain	2020-09-16 20:32:31 -06:00
Mike Wade	7b1ef9ea64	fixing test runner issues	2020-09-15 15:45:33 -06:00
Mike Wade	6ed36b0e41	fixed issues with tabs and duplicate tags	2020-09-15 08:52:00 -06:00
Florian Roth	2cd9b794e6	Merge pull request #1007 from d4rk-d4nph3/master ... Windows Defender AMSI Trigger Detected	2020-09-15 15:45:00 +02:00
Remco Hofman	6cadfa5b2b	Added win_vul_cve_2020_1472 rule	2020-09-15 15:13:53 +02:00
Mike Wade	1ddba05eb2	Second round	2020-09-15 07:02:30 -06:00