Florian Roth
7b8b1db241
rule: proxy ua unknown zero day implant
2019-09-24 18:24:48 +02:00
ecco
a644b938a0
fix PtH rule : field name in event 4624 is SubjectUserSid with null SID value (S-1-0-0)
2019-09-23 05:44:26 -04:00
ecco
6a7f7e0f76
add microsoft reference for events fields names
2019-09-23 05:21:30 -04:00
ecco
d48b63a235
ruler rule field name fix for eventID 4776
2019-09-23 05:17:35 -04:00
ecco
c2868f6e03
remove TAB from cli escape as it's currently unsupported in sigmac
2019-09-23 04:46:10 -04:00
Thomas Patzke
9630635e25
Merge branch 'herrBez-addt push origin master-datefield-xpack-watcher'
2019-09-12 00:20:28 +02:00
Thomas Patzke
19f431b6d2
Changed xpack-watcher dateField default to previous value
2019-09-12 00:19:58 +02:00
ecco
0c96777f6a
sysmon rules cleanup and move to process_creation
2019-09-11 10:24:43 -04:00
ecco
4c5eab88b6
add GroupSid to other configs
2019-09-11 04:53:30 -04:00
herrBez
8f612f743c
Use config dateField in xpack watcher to determine
...
datefield name as in elasticsearch dsl backend
2019-09-11 09:38:03 +02:00
Florian Roth
038900e2fe
fix: renamed powershell rule
2019-09-06 17:33:56 +02:00
Galapag0s
ccdda5e82b
Update lnx_shell_priv_esc_prep.yml
2019-09-06 11:29:42 -04:00
Galapag0s
23021aa110
Added Sticky Bits
...
Attackers may look to exploit binaries with the sticky bits enabled. By being able to run a binary as a different user or group, they may be able to run separate commands as an elevated user.
2019-09-06 11:25:48 -04:00
ecco
b410710338
move wevtutil / fsutil events from ransomware to dedicated rules
2019-09-06 10:57:03 -04:00
ecco
5ae46ac56d
rule: user added to local administrator: handle non english systems by using group sid instead of name
2019-09-06 06:21:42 -04:00
ecco
fe93d84015
fix FP : field null value can be '-'
2019-09-06 05:14:58 -04:00
Florian Roth
7f1b6eb311
fix: duplicate rule
2019-09-06 10:30:47 +02:00
Florian Roth
fcbae16cc8
rule: image debugger
2019-09-06 10:28:20 +02:00
Florian Roth
2ec1f710f3
Merge pull request #441 from EccoTheFlintstone/powershell_rules
...
powershell false positives
2019-09-06 10:19:45 +02:00
ecco
01956f1312
powershell false positives
2019-09-06 03:54:19 -04:00
Thomas Patzke
c80cb418cd
Improved QRadar regular expression support
2019-09-05 15:35:26 +02:00
Thomas Patzke
30b6db8299
Fixed ES backend keyword field mapping wildcard match pattern
2019-09-05 12:55:10 +02:00
Thomas Patzke
3b1cbe529e
Elasticsearch keyword field name blacklisting with wildcards
2019-09-05 12:38:32 +02:00
Thomas Patzke
afe6668fbd
Merge pull request #438 from duzvik/master
...
Escaped '\*' to '\*' where required
2019-09-05 10:57:25 +02:00
Thomas Patzke
2a60c71b9d
Merge pull request #437 from svent/qradar_regex_modifier
...
QRadar backend: add support for re type modifiers
2019-09-05 10:30:18 +02:00
Thomas Patzke
f9f5558ae1
Merge pull request #392 from TareqAlKhatib/shim
...
Fixed commandline to detect any shim install from any location
2019-09-05 10:28:50 +02:00
Thomas Patzke
de5e2045f0
Merge pull request #428 from stevengoossensB/master
...
AQL field selection from signatures
2019-09-05 10:28:02 +02:00
Thomas Patzke
37e179b6a7
Merge pull request #390 from juju4/devel-sumo2
...
sumologic backend: fix index and full mapping coverage
2019-09-05 10:27:19 +02:00
ecco
bdf8f99fdb
fix typo
2019-09-04 11:31:00 -04:00
Florian Roth
7bef822da7
rule: minor improvement to susp ps enc cmd
2019-09-04 16:31:49 +02:00
Denys Iuzvyk
774be4d008
Escaped '\*' to '\*' where required
2019-09-04 14:05:58 +03:00
svent
467c8f694c
QRadar backend: add support for re type modifiers
2019-09-03 22:55:48 +02:00
ecco
fc89804f34
rule: impacket framework lateralization detection
2019-09-03 10:28:59 -04:00
Florian Roth
03d45d57de
rule: emissary panda activity
2019-09-03 15:35:33 +02:00
Florian Roth
3a29835221
Merge pull request #433 from EccoTheFlintstone/master
...
add comcvcs.dll memdump method
2019-09-02 14:13:24 +02:00
ecco
8cad0c638e
add comcvcs.dll memdump method
2019-09-02 07:49:19 -04:00
Florian Roth
dca5a7a248
Merge pull request #432 from EccoTheFlintstone/master
...
add/modify powershell Empire rules
2019-09-02 11:40:36 +02:00
ecco
5f30e52739
add/modify powershell Empire rules
2019-09-02 05:04:44 -04:00
Florian Roth
ace0cc36c6
rule: improved csc rule
2019-08-31 08:44:09 +02:00
Florian Roth
7cc26e30b4
docs: renamed file name
2019-08-30 12:04:20 +02:00
Florian Roth
f8785e722f
docs: changed title and description of rule
2019-08-30 12:03:42 +02:00
Florian Roth
ba46d6b4de
docs: added reference to rule
2019-08-30 11:55:02 +02:00
Florian Roth
398ef9c6aa
rules: teardown implant, apt28 ua
2019-08-30 11:53:55 +02:00
Florian Roth
fe8f040863
Merge pull request #429 from weev3/master
...
Control Panel Item, MITRE_ID=T1196
2019-08-27 14:24:56 +02:00
Florian Roth
ca2019b57f
fix: typo in MITRE tag
2019-08-27 12:32:56 +02:00
Florian Roth
6b7cd94197
Changes
2019-08-27 12:23:42 +02:00
weev3
d42a51372d
Control Panel Item, MITRE_ID=T1196
2019-08-27 14:55:55 +06:30
Steven Goossens
cb088e4911
Remove quotes from around the fields to make the query semantically correct
2019-08-26 12:43:26 +00:00
Steven Goossens
ad19f05e2c
Include mapped names rather then signature names
2019-08-26 12:06:20 +00:00
Steven Goossens
37caccd52e
Includes the trial condition so generic query is generated whenever the fields are not defined
2019-08-26 11:48:40 +00:00
