Austin Songer
e7c5827776
Update azure_service_principal_removed.yml
2021-09-03 22:43:11 -05:00
Austin Songer
0612ea7f6e
Update azure_device_no_longer_managed_or_compliant.yml
2021-09-03 22:42:26 -05:00
Austin Songer
c420a17e05
Update azure_service_principal_removed.yml
2021-09-03 22:29:21 -05:00
Austin Songer
fda1e3362e
Update azure_owner_removed_from_application_or_service_principal.yml
2021-09-03 22:29:12 -05:00
Austin Songer
9d26116d27
Update azure_device_no_longer_managed_or_compliant.yml
2021-09-03 22:29:02 -05:00
Austin Songer
8fe7bfc452
Update azure_application_deleted.yml
2021-09-03 22:28:53 -05:00
Austin Songer
c021ae9e7c
Update and rename azure_device_or_configuration_deleted.yml to azure_device_or_configuration_modified_or_deleted.yml
2021-09-03 22:28:35 -05:00
Austin Songer
6744fb7f2e
Create azure_application_deleted.yml
2021-09-03 22:25:34 -05:00
Austin Songer
70ac0104cf
Create azure_service_principal_removed.yml
2021-09-03 22:25:01 -05:00
Austin Songer
6e15618c75
Create azure_device_or_configuration_deleted.yml
2021-09-03 22:24:32 -05:00
Austin Songer
b478132769
Create azure_owner_removed_from_application_or_service_principal.yml
2021-09-03 22:23:59 -05:00
Austin Songer
c0bdc3fb1b
Create azure_device_no_longer_managed_or_compliant.yml
2021-09-03 22:23:21 -05:00
frack113
6780182c37
Merge pull request #1974 from frack113/tags_pack2
...
Add missing Tags
2021-09-03 19:13:32 +02:00
frack113
2e474628fa
Merge pull request #1987 from zakibro/master
...
New Rule - Linux-Auditd-System Information Discovery
2021-09-03 19:10:28 +02:00
frack113
688df3405a
Merge pull request #1970 from frack113/red_T1564.004_1
...
Redcanary t1564.004 ADS test 1
2021-09-03 19:06:51 +02:00
frack113
77c6b74c72
Merge pull request #1985 from mvelazc0/master
...
Adding Petitpotam/ADCS attack vector detections
2021-09-03 19:06:03 +02:00
mvelazco
a7a002cb7f
updating fields as per frack113 feedback
2021-09-03 10:01:54 -04:00
frack113
769451dc03
Add missing id
2021-09-03 13:42:15 +02:00
frack113
815134df7f
Cleanup
2021-09-03 13:30:10 +02:00
phantinuss
aa2e86963c
fix: rename filter
2021-09-03 13:26:34 +02:00
phantinuss
f3bdb0e43d
fix: remove unneeded selection
2021-09-03 13:26:23 +02:00
phantinuss
2de2de8433
Addition to UAC Bypasses
2021-09-03 13:26:11 +02:00
zakibro
8bd859f550
Update lnx_auditd_system_info_discovery.yml
2021-09-03 13:07:42 +02:00
ncrqnt
adc3c9e608
fixed date: switched day/month
2021-09-03 12:03:38 +02:00
Pawel Mazur
864286e206
New Rule - Linux-Auditd-System Information Discovery
2021-09-03 11:33:18 +02:00
frack113
89562273cc
Merge pull request #1984 from austinsonger/azure_app_credential_modification.yml
...
azure_app_credential_modification.yml
2021-09-03 08:17:55 +02:00
frack113
88389f945d
Merge pull request #1983 from austinsonger/azure_service_principal_created.yml
...
azure_service_principal_created.yml
2021-09-03 08:14:47 +02:00
frack113
d40cdec062
Merge pull request #1982 from austinsonger/azure_network_firewall_policy_modified_or_deleted.yml
...
azure_network_firewall_policy_modified_or_deleted.yml
2021-09-03 08:13:30 +02:00
frack113
bd1b4c0d70
Merge pull request #1978 from rachelrice/update_aws_login
...
Update AWS Update Login Profile rule
2021-09-03 08:12:28 +02:00
frack113
1fc2a39720
Merge pull request #1975 from frack113/red_T1564.004_2
...
Redcanary t1564.004 test 2
2021-09-03 08:12:08 +02:00
mvelazco
ba41e922d2
adding Petitpotam host detections
2021-09-03 00:12:49 -04:00
Austin Songer
775c0e8e7f
Update azure_app_credential_modification.yml
2021-09-02 21:00:21 -05:00
Austin Songer
643ec0abe3
Update azure_service_principal_created.yml
2021-09-02 21:00:02 -05:00
Austin Songer
10af7bbdb1
Create azure_app_credential_modification.yml
2021-09-02 20:53:32 -05:00
Austin Songer
d25fd420d6
Create azure_service_principal_created.yml
2021-09-02 20:48:35 -05:00
Austin Songer
1272c76ae7
Create azure_network_firewall_policy_modified_or_deleted.yml
2021-09-02 20:31:27 -05:00
Rachel Rice
78d3fa4795
Update AWS STS AssumeRole Misuse rule
...
Update selection criteria for AWS STS AssumeRole Misuse rule for any event by an AssumedRole userIdentity.
Closes SigmaHQ/sigma#1963 .
2021-09-02 17:40:35 +01:00
Rachel Rice
7ccb773b20
Update AWS Update Login Profile rule
...
Update selection criteria for AWS Update Login Profile rule to check for mismatch between userIdentity.arn and requestParameters.userName.
Closes SigmaHQ/sigma#1966 .
2021-09-02 17:37:41 +01:00
frack113
b731c20594
Merge pull request #1971 from phantinuss/master
...
fix: prevent possible FPs
2021-09-02 15:34:46 +02:00
frack113
a048403089
Merge pull request #1973 from klingerko/cs_namedpipe_updates
...
Remove duplicate and regex improvements
2021-09-02 15:25:01 +02:00
phantinuss
ab721c736c
chore: move level/falsepositives to bottom
2021-09-02 14:55:17 +02:00
klingerko
15e25f9635
update modifed date
2021-09-02 14:50:14 +02:00
phantinuss
0b373ff1e9
fix: remove 2nd selection due to FPs
2021-09-02 14:47:47 +02:00
frack113
6a1b95d947
Findstr covert by win_susp_findstr.yml
2021-09-02 14:22:59 +02:00
frack113
aaa568ff2d
print covert by win_susp_print.yml
2021-09-02 14:18:38 +02:00
phantinuss
5cb6eed52e
fix: remove single value lists
2021-09-02 14:09:03 +02:00
phantinuss
f4a5df67ae
further narrowing down of the selection, therefore removing the filter
2021-09-02 10:28:01 +02:00
frack113
90e673e5ac
fix invalid tags
2021-09-02 10:17:50 +02:00
Florian Roth
0603581111
Merge pull request #1969 from SigmaHQ/rule-devel
...
More Named Pipe Rules and WMI rule refactoring
2021-09-02 10:15:00 +02:00
frack113
6f1f70ca5e
Add missing tags
2021-09-02 09:59:19 +02:00
