 frack113
|
01dc930c17
|
Change status for old rules
|
2021-11-27 11:33:14 +01:00 |
|
|
Florian Roth
|
4a69c71b2f
|
Update lnx_shell_clear_cmd_history.yml
|
2021-11-24 09:31:12 +01:00 |
|
|
Florian Roth
|
94c61bf07a
|
Update lnx_shell_clear_cmd_history.yml
|
2021-11-24 09:29:48 +01:00 |
|
|
secjunkie
|
b76d000f26
|
Update lnx_shell_clear_cmd_history.yml
cat and ln can use zero or null
chattr does not clear but stops further logging
|
2021-11-23 23:06:23 +00:00 |
|
|
remotephone
|
be59ca0f01
|
Update macos_space_after_filename.yml
Fixing new line and updating change date
|
2021-11-20 15:54:24 -06:00 |
|
|
remotephone
|
9530d67834
|
Create macos_space_after_filename.yml
Adding coverage for macOS space after filename
|
2021-11-20 15:43:51 -06:00 |
|
|
frack113
|
1cfca93354
|
Missing status in rules (#2284)
* add missing status
|
2021-11-19 22:32:26 +01:00 |
|
|
frack113
|
0c61c444eb
|
Merge pull request #2278 from zakibro/master
Adding New Linux Auditd rule - Data Exfil with Wget
|
2021-11-19 22:30:10 +01:00 |
|
|
Pawel Mazur
|
87f64e28fd
|
Adding New Linux Auditd rule - Data Exfil with Wget
|
2021-11-18 18:03:17 +01:00 |
|
|
Florian Roth
|
a921bd5ec8
|
style: reordered rule layout
|
2021-11-17 18:59:40 +01:00 |
|
|
Florian Roth
|
645292d945
|
removed contributor, added to authors
|
2021-11-12 19:44:50 +01:00 |
|
|
Pawel Mazur
|
07a3e3e234
|
Making the Password Policy Discovery rule more resilient by adding detection for specific commands
|
2021-11-12 16:18:29 +01:00 |
|
|
frack113
|
c2ef681e86
|
fix modified
|
2021-11-11 10:26:08 +01:00 |
|
|
frack113
|
c682c12ecf
|
Add sudo service
|
2021-11-11 10:21:21 +01:00 |
|
|
frack113
|
1d38a7dfa5
|
Fix linux process_creation field case
|
2021-11-11 10:16:36 +01:00 |
|
|
frack113
|
bd3358d33c
|
Fix auditd field name
|
2021-11-11 10:13:48 +01:00 |
|
|
frack113
|
735e5eade9
|
Fix macos category
|
2021-11-11 09:52:31 +01:00 |
|
|
frack113
|
18fea95b86
|
move to macos
|
2021-11-09 13:33:58 +01:00 |
|
|
frack113
|
e8a36ace96
|
move to other
|
2021-11-09 13:32:22 +01:00 |
|
|
frack113
|
c8f488eabf
|
move to builtin
|
2021-11-09 13:27:20 +01:00 |
|
|
zakibro
|
30f13d41f5
|
Update lnx_auditd_load_module_insmod.yml
fixing missing date
|
2021-11-02 17:16:59 +01:00 |
|
|
Pawel Mazur
|
dd7817917c
|
Linux - Auditd - Loading of Kernel Module via Insmod rule
|
2021-11-02 17:04:39 +01:00 |
|
|
frack113
|
c228cde0cb
|
Move to correct directory
|
2021-10-27 14:38:51 +02:00 |
|
|
Florian Roth
|
fcecb951d5
|
Merge branch 'master' into rule-devel
|
2021-10-26 22:03:55 +02:00 |
|
|
Florian Roth
|
1983cba1f3
|
refactor: xmrig sub process indicator
|
2021-10-26 13:24:01 +02:00 |
|
|
Florian Roth
|
ab499c9c21
|
rules: crypto coin mining
|
2021-10-26 08:52:07 +02:00 |
|
|
Florian Roth
|
0b46180cd2
|
fix: moved back connect bash to correct folder
|
2021-10-26 08:51:54 +02:00 |
|
|
frack113
|
f8574fcd81
|
Add cve tags
|
2021-10-25 18:40:50 +02:00 |
|
|
frack113
|
8595478b36
|
Merge pull request #2149 from OTRF/feature/Sysmon-For-Linux-Rules
OTR - Migrating rules to Sysmon for Linux schema :)
|
2021-10-21 19:10:32 +02:00 |
|
|
frack113
|
963f32063f
|
Merge pull request #2148 from SigmaHQ/rule-devel
First Linux Process Creation and Network Connection rules (Sysmon for Linux)
|
2021-10-21 19:10:08 +02:00 |
|
|
Florian Roth
|
ae22f2ae7e
|
rule: Linux Bash reverse shell indicators
|
2021-10-16 14:21:55 +02:00 |
|
|
frack113
|
114e44ce6b
|
move file
|
2021-10-16 11:11:19 +02:00 |
|
|
Roberto Rodriguez
|
2b3e40e721
|
Rule for Cron activity - file creation
|
2021-10-16 02:33:01 -04:00 |
|
|
Roberto Rodriguez
|
2c0e89ccc8
|
added indentation to lists per request
|
2021-10-15 16:24:26 -04:00 |
|
|
Roberto Rodriguez
|
7b11987155
|
Fixed format indentation to fix block error
|
2021-10-15 16:12:51 -04:00 |
|
|
Roberto Rodriguez
|
d391eccd32
|
split commandline arguments in a few rules
|
2021-10-15 16:10:42 -04:00 |
|
|
Roberto Rodriguez
|
eed86077ab
|
updated rules schema and added Clipboard Collection with Xclip Tool
|
2021-10-15 15:59:11 -04:00 |
|
|
Roberto Rodriguez
|
04ff9ae692
|
Updated at command rule to use Image field
|
2021-10-15 15:46:59 -04:00 |
|
|
Roberto Rodriguez
|
aa0a5b8204
|
commands to clear or remove the syslog rule
|
2021-10-15 15:43:42 -04:00 |
|
|
Roberto Rodriguez
|
f8cb0883d5
|
OMI SCX Execute RunAsProvider rules
|
2021-10-15 15:38:09 -04:00 |
|
|
Roberto Rodriguez
|
ca99394e46
|
detect overwriting and deletion of files via dd
|
2021-10-15 15:28:15 -04:00 |
|
|
Florian Roth
|
8ee9d2f5b4
|
docs: changes in description
|
2021-10-15 15:12:44 +02:00 |
|
|
Florian Roth
|
231b54e526
|
rule: first Linux process_creation rule
|
2021-10-15 14:39:32 +02:00 |
|
|
Florian Roth
|
6c4e24d0de
|
rule: coin miner param --cpu-priority
|
2021-10-09 10:28:16 +02:00 |
|
|
frack113
|
e666b7e1db
|
Merge pull request #2116 from zakibro/master
New Rule - Linux - Auditd - Clipboard Collection of Image Data with X…
|
2021-10-02 11:06:24 +02:00 |
|
|
zakibro
|
c2a26923c6
|
Update lnx_auditd_clipboard_image_collection.yml
|
2021-10-02 09:59:37 +02:00 |
|
|
zakibro
|
d40b42fc2c
|
Update lnx_auditd_clipboard_image_collection.yml
fixing a typo
|
2021-10-01 18:54:12 +02:00 |
|
|
Pawel Mazur
|
e67770d7ea
|
New Rule - Linux - Auditd - Clipboard Collection of Image Data with Xclip Tool
|
2021-10-01 18:43:03 +02:00 |
|
|
Austin Songer
|
00513ff2c5
|
Create macos_suspicious_macos_firmware_activity.yml
|
2021-09-30 18:47:15 -05:00 |
|
|
frack113
|
6bce0f967a
|
Merge pull request #2079 from zakibro/master
New Rule - Linux - Auditd - Clipboard Collection
|
2021-09-27 08:34:30 +02:00 |
|