valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
4,056 Commits 20 Branches 25 Tags 21 MiB
e764ca687a
Commit Graph

4056 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Florian Roth
ca758bb99b New images 2017-02-19 10:24:24 +01:00
Florian Roth
166f207dc0 Sysmon rules 'logsource' change 2017-02-19 09:19:06 +01:00
Florian Roth
cd6e24c5ff Added "logsource" sections and new rule 2017-02-19 00:31:59 +01:00
Thomas Patzke
0543ef7e75 sigmac: Condition Tokenizer 2017-02-16 23:58:44 +01:00
Thomas Patzke
ec1c5e142b Merge branch 'master' into devel-sigmac 2017-02-16 23:52:03 +01:00
Thomas Patzke
9a38d6543f Fixed type of condition 2017-02-16 23:49:34 +01:00
Thomas Patzke
367596060d Merge branch 'master' into devel-sigmac 2017-02-16 22:14:48 +01:00
Florian Roth
18fd63f6b7 Levels to low, medium, high, critical 2017-02-16 18:06:22 +01:00
Thomas Patzke
ce43dce7ef Parsing of detections 
Transformation of detections into internal data structures. Parsing must
be changed later to on-demand parsing because condition can change
default behavior of lists.
 2017-02-16 00:40:08 +01:00
Florian Roth
77930b5173 Merge pull request #3 from Neo23x0/devel 
Rule review and cleanup
 2017-02-16 00:07:46 +01:00
Thomas Patzke
3821e59db1 Merge branch 'devel' into devel-sigmac 2017-02-15 23:57:33 +01:00
Thomas Patzke
88270fcf2d Rule review and cleanup 
* removed unnecessary one element lists from definitions
* converted some lists of one element maps to maps because the resulting
  OR linkage would cause wrong result.
 2017-02-15 23:53:08 +01:00
Thomas Patzke
980ed9c5c7 Moved YAML parsing in SigmaParser class 2017-02-13 23:31:42 +01:00
Thomas Patzke
1498d787e7 Added Sigma converter skeleton 
* YAML parsing
* argument parsing
* empty backend classes
 2017-02-13 23:28:53 +01:00
Florian Roth
193436c7fc Set theme jekyll-theme-slate 2017-02-13 14:42:42 +01:00
Florian Roth
c8c1a0f2b0 New Screenshot Section in README 2017-02-12 17:10:48 +01:00
Florian Roth
09def1fe2e New Screenshot - Suspicious Failed Logons from Single Source Workstation 2017-02-12 17:09:24 +01:00
Florian Roth
d54c094af0 New screenshot - Webshell detection with Sysmon 2017-02-12 16:43:13 +01:00
Florian Roth
a6173df0b9 LSASS Remote Thread Update 2017-02-12 16:33:09 +01:00
Florian Roth
d0999ce8da Screenshot Update 2017-02-12 16:32:52 +01:00
Florian Roth
406ee52398 Changed second screenshot 2017-02-12 15:54:05 +01:00
Florian Roth
04ea201817 New rules and cleanup 2017-02-12 15:50:39 +01:00
Florian Roth
0988aa3496 Screenshots - Rule Examples 2017-02-12 15:50:12 +01:00
Florian Roth
a2adb1ddb5 Renamed rule files, new rules 2017-02-10 19:17:02 +01:00
Thomas Patzke
97847a29de Moved network rules into rules directory 2017-02-08 12:43:50 +01:00
Thomas Patzke
a7c1409fc6 Added 'Network Scan' rule (#1) 
* Added possibility for multiple OR-linked conditions
 2017-02-08 12:41:32 +01:00
Florian Roth
1307a45fd5 Moved rules to a separate directory 2017-02-07 00:44:40 +01:00
Florian Roth
ee6cad91fb Update README.md 2017-02-07 00:24:37 +01:00
Florian Roth
a69c7e3cf7 Update README.md 2017-02-07 00:24:10 +01:00
Florian Roth
411cc8b7af Wiki title image 2017-02-06 20:04:51 +01:00
Florian Roth
03c0ea7aa2 README Update 2017-02-06 20:03:57 +01:00
Florian Roth
810758a9f5 Rew rule examples: RC4 Kerberos, JAVA remote debugging process 2017-02-06 20:03:42 +01:00
Thomas Patzke
e7d62f8fbe Added 'multiple_suspicious_response_codes_single_source' web rule 2017-01-11 20:47:44 +01:00
Thomas Patzke
97511f7c1e Replicated 'susp_failed_logons_single_source' to Linux. 2017-01-11 20:47:28 +01:00
Thomas Patzke
775323deef Added experimental web 'shell_spawn' rule 2017-01-11 20:47:21 +01:00
Thomas Patzke
b202822ef2 Added status classification to specification 2017-01-11 20:45:57 +01:00
Thomas Patzke
1ad5d2555a Update of specification 2017-01-11 20:45:37 +01:00
Thomas Patzke
d31614af9c Consistency between format description and examples 
- description/comment -> title/description
- addition of reference
 2017-01-11 20:45:01 +01:00
Thomas Patzke
68cc0770e8 The poor VI(M) users with their swp's! 2017-01-11 20:44:47 +01:00
Thomas Patzke
c2f3ee25a8 Fixed single quote balance 2017-01-11 20:44:36 +01:00
Thomas Patzke
6125875d2d Simplification of aggregation comparison expression 
Parenthesis around aggregation expression should be optional. Parser
would handle this through operator precedence.
 2017-01-11 20:43:34 +01:00
Florian Roth
ffda754d53 Remove implicit selection number, first Sysmon example 2017-01-10 15:05:19 +01:00
Florian Roth
bb02bf93d4 Update README.md 2017-01-08 17:40:40 +01:00
Florian Roth
8ee9c37811 README Update Specs 1 2017-01-07 22:39:06 +01:00
Florian Roth
b446fb39f7 Updated examples 2016-12-27 23:09:41 +01:00
Florian Roth
5f0a227053 Example Updates 2016-12-27 14:49:59 +01:00
Florian Roth
d0beeaa8ed Update README.md 2016-12-26 11:14:15 +01:00
Florian Roth
f589e93e29 Image Update 2016-12-26 02:29:18 +01:00
Florian Roth
796f4b260f Description image update 2016-12-26 02:25:18 +01:00
Florian Roth
aab4d81bae Update README.md 2016-12-26 02:23:34 +01:00