Florian Roth
d3b623e92a
Rule: suspicious pipes extended
...
https://github.com/Neo23x0/sigma/issues/253
2019-02-21 13:26:48 +01:00
Florian Roth
343a40ced7
Rule: extended exec location rule to support 4688 events
2019-02-21 13:26:48 +01:00
Florian Roth
f0a4aede24
Rule: RDP over Reverse SSH Tunnel
2019-02-16 19:36:13 +01:00
Tareq AlKhatib
cd3cdc9451
Removed unnecessary '1 of them' in condition
2019-02-13 21:26:02 +03:00
Florian Roth
8d819cfeea
Rule: fixed bug in Renamed PowerShell rule
2019-02-13 13:23:02 +01:00
Florian Roth
be26ada875
Rule: Suspicious csc.exe parents
2019-02-11 13:50:51 +01:00
Thomas Patzke
d43e67a882
Merge branch 'development' of https://github.com/yt0ng/sigma into yt0ng-development
2019-02-10 00:00:45 +01:00
Thomas Patzke
d9aceeb7eb
Merge pull request #228 from keepwatch/ssp-regkey-detection
...
SSP added to LSA configuration
2019-02-09 23:44:55 +01:00
Florian Roth
efb223b147
Merge pull request #245 from kpolley/master
...
2nd method to call downloadString or downloadFile in Powershell
2019-02-09 09:35:19 +01:00
Florian Roth
7e732a2a89
Merge pull request #232 from TareqAlKhatib/duplicate_filters
...
Duplicate filters
2019-02-09 09:23:57 +01:00
Kyle Polley
c8c06763b4
added keywords & source to sysmon_powershell_download.yml
2019-02-07 18:25:04 -08:00
keepwatch
e6217928f3
Added '/' prefix, -encode switch, better renamed certutil coverage
2019-02-06 10:45:32 -05:00
Unknown
2f66ba25f0
adjusted MITRE ATTCK tag
2019-02-06 11:27:51 +01:00
Unknown
4d048c71bb
adjusted spaces
2019-02-06 11:10:42 +01:00
Unknown
54ec01bcdd
adjusted space
2019-02-06 11:10:00 +01:00
t0x1c-1
150499d151
Detects Executables without FileVersion,Description,Product,Company likely created with py2exe
2019-02-06 10:58:37 +01:00
t0x1c-1
21f34ab8ba
suspicious behaviour
2019-02-06 10:52:41 +01:00
keepwatch
bad80ffa78
Update sysmon_ssp_added_lsa_config.yml
...
Syntax fix
2019-02-05 16:28:06 -05:00
Florian Roth
8f684ddd06
Rule: FP in WMI persistence with SCCM
2019-02-05 15:57:54 +01:00
Thomas Patzke
3ef930b094
Escaped '\*' to '\\*' where required
2019-02-03 00:24:57 +01:00
Thomas Patzke
6440bc962b
CACTUSTORCH detection
2019-02-01 23:27:53 +01:00
Florian Roth
c9ec469180
style: cosmetics - removed empty lines at file end
2019-01-29 12:54:07 +01:00
Tareq AlKhatib
7e4bb1d21a
Removed duplicate filters
2019-01-25 12:21:57 +03:00
Thomas Patzke
9ce7d18712
Merge pull request #231 from TareqAlKhatib/rule_testing_framework
...
Rule testing framework
2019-01-23 23:16:46 +01:00
Tareq AlKhatib
ecffe28933
Correct MITRE tag
2019-01-22 21:26:07 +03:00
Florian Roth
cc6e0baef1
rule: extended certutil rule to include verifyctl and allows renamed certutil
...
https://twitter.com/egre55/status/1087685529016193025
2019-01-22 16:20:06 +01:00
keepwatch
f99df33b01
SSP added to LSA configuration
2019-01-18 14:05:21 -05:00
Florian Roth
f759e8b07c
Rule: Suspicious Program Location Process Starts
2019-01-15 15:40:51 +01:00
Florian Roth
604d88cf1e
Rule: WMI Event Subscription
2019-01-12 12:03:36 +01:00
Florian Roth
63f96d58b4
Rule: Renamed PowerShell.exe
2019-01-12 12:03:36 +01:00
Florian Roth
b7eb79f8da
Rule: UserInitMprLogonScript persistence method
2019-01-12 12:03:36 +01:00
Tareq AlKhatib
8b94860ee6
Corrected class B private IP range to prevent false negatives
2019-01-04 12:50:41 +03:00
Tareq AlKhatib
925ffae9b8
Removed Outlook detection which is a subset of the Office one
2019-01-02 07:47:44 +03:00
Tareq AlKhatib
0a5e79b1e0
Fixed the RC section to use rc.exe instead of oleview.exe
2019-01-01 13:30:26 +03:00
Tareq AlKhatib
f318f328d6
Corrected reference to references as per Sigma's standard
2018-12-25 16:25:12 +03:00
Florian Roth
99f773dcf6
Rule: false positive reduction in rule
2018-12-17 10:02:55 +01:00
Florian Roth
b0cb0abc01
Bugfix: wrong field for 4688 process creation events
2018-12-11 16:10:15 +01:00
Florian Roth
b5d78835b6
Removed overlapping rule with sysmon_office_shell.yml
2018-12-11 13:37:47 +01:00
Roberto Rodriguez
8c577a329f
Improve Rule & Updated HELK SIGMA Standardization Config
...
Rule should be focusing on the 'process_command_line' field and not just on any value of any event generated by powershell.exe.
SIGMA HELK standardization config updated to match latest HELK Common Information Model
2018-12-08 11:30:21 +03:00
Roberto Rodriguez
87ce07088f
Update sysmon_plugx_susp_exe_locations.yml
...
Duplicate rule title: https://github.com/Neo23x0/sigma/search?q=Executable+used+by+PlugX+in+Uncommon+Location&unscoped_q=Executable+used+by+PlugX+in+Uncommon+Location
This impats Elastalert integration since you cannot have two rules with the same name
2018-12-05 07:58:13 +03:00
Thomas Patzke
900db72557
Merge branch 'master' of https://github.com/SherifEldeeb/sigma into SherifEldeeb-master
2018-12-04 23:35:23 +01:00
Florian Roth
a805d18bba
Merge pull request #198 from kpolley/consistent_filetype
...
changed .yaml files to .yml for consistency
2018-12-03 09:00:14 +01:00
Florian Roth
2ebbdebe46
rule: Cobalt Strike beacon detection via Remote Threat Creation
...
https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f
2018-11-30 10:25:05 +01:00
Kyle Polley
60538e2e12
changed .yaml files to .yml for consistency
2018-11-20 21:07:36 -08:00
Sherif Eldeeb
23eddafb39
Replace "logsource: description" with "definition" to match the specs
2018-11-15 09:00:06 +03:00
Thomas Patzke
732de3458f
Merge pull request #186 from megan201296/patch-15
...
Update sysmon_cmstp_com_object_access.yml
2018-10-18 15:49:06 +02:00
Thomas Patzke
fdd0823e07
Merge pull request #187 from megan201296/patch-16
...
Additional MITRE ATT&CK Tagging
2018-10-18 15:38:11 +02:00
Florian Roth
fd34437575
fix: fixed date in rule
2018-10-10 15:27:58 +02:00
megan201296
fdd264d946
Update sysmon_susp_powershell_rundll32.yml
2018-10-09 19:11:47 -05:00
megan201296
440b0ddffe
Update sysmon_susp_powershell_parent_combo.yml
2018-10-09 19:11:17 -05:00
