valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 02:08:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
8d6a507ec4
SigmaHQ/rules/windows/sysmon
History
Thomas Patzke 8d6a507ec4 OSCD QA wave 1 
* Checked all rules against Mordor and EVTX samples datasets
* Added field names
* Some severity adjustments
* Fixes
2020-01-11 00:11:27 +01:00
..
sysmon_ads_executable.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_alternate_powershell_hosts_moduleload.yml UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00
sysmon_alternate_powershell_hosts_pipe.yml OSCD QA wave 1 2020-01-11 00:11:27 +01:00
sysmon_asep_reg_keys_modification.yml UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00
sysmon_cactustorch.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_cmstp_execution.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_cobaltstrike_process_injection.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_createremotethread_loadlibrary.yml UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00
sysmon_cred_dump_lsass_access.yml OSCD QA wave 1 2020-01-11 00:11:27 +01:00
sysmon_cred_dump_tools_dropped_files.yml UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00
sysmon_cred_dump_tools_named_pipes.yml UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00
sysmon_dhcp_calloutdll.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_disable_security_events_logging_adding_reg_key_minint.yml UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00
sysmon_dns_serverlevelplugindll.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_ghostpack_safetykatz.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_in_memory_assembly_execution.yml OSCD QA wave 1 2020-01-11 00:11:27 +01:00
sysmon_in_memory_powershell.yml UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00
sysmon_logon_scripts_userinitmprlogonscript.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_lsass_memdump.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_lsass_memory_dump_file_creation.yml OSCD QA wave 1 2020-01-11 00:11:27 +01:00
sysmon_mal_namedpipes.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_malware_backconnect_ports.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_malware_verclsid_shellcode.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_mimikatz_inmemory_detection.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_mimikatz_trough_winrm.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_minidumwritedump_lsass.yml OSCD QA wave 1 2020-01-11 00:11:27 +01:00
sysmon_narrator_feedback_persistance.yml UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00
sysmon_new_dll_added_to_appcertdlls_registry_key.yml UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00
sysmon_new_dll_added_to_appinit_dlls_registry_key.yml UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00
sysmon_password_dumper_lsass.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_possible_dns_rebinding.yml UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00
sysmon_possible_privilege_escalation_via_service_registry_permissions_weakness.yml UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00
sysmon_powershell_execution_moduleload.yml OSCD QA wave 1 2020-01-11 00:11:27 +01:00
sysmon_powershell_execution_pipe.yml OSCD QA wave 1 2020-01-11 00:11:27 +01:00
sysmon_powershell_exploit_scripts.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_powershell_network_connection.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_quarkspw_filedump.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_raw_disk_access_using_illegitimate_tools.yml OSCD QA wave 1 2020-01-11 00:11:27 +01:00
sysmon_rdp_registry_modification.yml OSCD QA wave 1 2020-01-11 00:11:27 +01:00
sysmon_rdp_reverse_tunnel.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_rdp_settings_hijack.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_registry_persistence_key_linking.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_regsvr32_network_activity.yml OSCD QA wave 1 2020-01-11 00:11:27 +01:00
sysmon_remote_powershell_session_network.yml UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00
sysmon_renamed_powershell.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_renamed_procdump.yml fix: fixed typo in rule for renamed procdump 2019-11-19 15:59:07 +01:00
sysmon_renamed_psexec.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_rundll32_net_connections.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_ssp_added_lsa_config.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_stickykey_like_backdoor.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_susp_download_run_key.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_susp_driver_load.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_susp_file_characteristics.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_susp_image_load.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_susp_lsass_dll_load.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_susp_powershell_rundll32.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_susp_prog_location_network_connection.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_susp_rdp.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_susp_reg_persist_explorer_run.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_susp_run_key_img_folder.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_suspicious_keyboard_layout_load.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_suspicious_outbound_kerberos_connection.yml UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00
sysmon_suspicious_remote_thread.yml OSCD QA wave 1 2020-01-11 00:11:27 +01:00
sysmon_svchost_dll_search_order_hijack.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_sysinternals_eula_accepted.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_tsclient_filewrite_startup.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_uac_bypass_eventvwr.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_uac_bypass_sdclt.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_unsigned_image_loaded_into_lsass.yml UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00
sysmon_webshell_creation_detect.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_win_binary_github_com.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_win_binary_susp_com.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_win_reg_persistence.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_wmi_event_subscription.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_wmi_module_load.yml OSCD QA wave 1 2020-01-11 00:11:27 +01:00
sysmon_wmi_persistence_commandline_event_consumer.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_wmi_persistence_script_event_consumer_write.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00
sysmon_wmi_susp_scripting.yml Added UUIDs to rules 2019-11-12 23:12:27 +01:00