21c363cec9
Merge pull request #3102 from securepeacock/patch-25
...
Create proc_creation_lnx_nohup.yml
2022-06-07 10:47:34 +02:00
cc67d69360
Merge pull request #3100 from hazedav/dd-endswith
...
fix(rule): lnx_dd_file_overwrite /bin symlinks
2022-06-07 10:45:56 +02:00
9d4822b400
Update proc_creation_lnx_nohup.yml
2022-06-07 10:35:08 +02:00
e7b47c9069
Create proc_creation_lnx_nohup.yml
2022-06-06 23:22:50 -04:00
bc26970596
fix(rule): lnx_dd_file_overwrite /bin symlinks
...
This rule is subject to false negatives for *nix distros which
alias /bin to /usr/bin. By using endswith we can catch dd usage
for either /bin or /usr/bin.
2022-06-06 09:27:27 -05:00
1641eddaeb
Create proc_creation_lnx_susp_chmod_directories.yml
2022-06-03 19:24:02 -04:00
c2c1a2dcb7
Merge pull request #3090 from frack113/refractor_condition
...
Refactor condition
2022-06-03 17:02:31 +02:00
8de0027ca3
refactor condition
2022-06-03 15:35:24 +02:00
8bdd2562fb
fix: avoid regex, not actually needed
2022-06-03 14:55:09 +02:00
1cb985487c
windows and linux python pty spawning
2022-06-03 12:17:33 +02:00
984b0e553c
chore: reduce rule level
2022-06-03 12:17:33 +02:00
777b123ad0
Update proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
2022-06-03 08:38:24 +01:00
b2b070b516
Quick Update
2022-06-03 08:31:53 +01:00
66e0c405c8
Update proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
2022-06-03 08:09:14 +01:00
bb41bb6905
Update proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
2022-06-03 01:25:59 +01:00
8f947693ec
Update proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
2022-06-03 01:24:09 +01:00
0a0418615c
Create proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
2022-06-03 01:13:40 +01:00
b9a0c7e437
Mitre Update
2022-05-26 18:39:42 +02:00
112b715dd6
chore: test rules: reactivate single value list check
2022-05-10 17:13:04 +02:00
b4fdb13e8a
chore: test rules: check for unused selections
2022-05-10 11:07:40 +02:00
9beafefe52
rules: suspicious linux patterns
2022-03-14 12:01:52 +01:00
8bb3379b68
Normalization of rule names
2022-02-22 11:16:31 +01:00
c8fa678a9b
rule: add tag execution to new bpftrace rule
2022-02-11 14:14:22 +01:00
66b9d35ee9
rule: add new bpftrace unsafe option rule
2022-02-11 12:08:53 +01:00
885f70b0f3
Update lnx_doas_execution.yml
2022-01-20 13:08:39 +01:00
f195160baa
Update lnx_doas_execution.yml
2022-01-20 10:58:47 +07:00
8b94046efa
Update lnx_doas_execution.yml
2022-01-20 10:11:24 +07:00
4f56e0d92e
Update lnx_doas_execution.yml
2022-01-20 09:48:24 +07:00
eb4731b370
Create lnx_doas_execution.yml
2022-01-20 09:46:17 +07:00
4631d0c482
remove invalid tag
2022-01-19 18:23:30 +01:00
f7e670d55e
Simple Quote
2022-01-11 13:40:53 +01:00
e055ec1d52
refactor: change all " of them" expressions
2022-01-11 10:59:57 +01:00
01dc930c17
Change status for old rules
2021-11-27 11:33:14 +01:00
1cfca93354
Missing status in rules ( #2284 )
...
* add missing status
2021-11-19 22:32:26 +01:00
a921bd5ec8
style: reordered rule layout
2021-11-17 18:59:40 +01:00
1d38a7dfa5
Fix linux process_creation field case
2021-11-11 10:16:36 +01:00
c228cde0cb
Move to correct directory
2021-10-27 14:38:51 +02:00
fcecb951d5
Merge branch 'master' into rule-devel
2021-10-26 22:03:55 +02:00
1983cba1f3
refactor: xmrig sub process indicator
2021-10-26 13:24:01 +02:00
ab499c9c21
rules: crypto coin mining
2021-10-26 08:52:07 +02:00
0b46180cd2
fix: moved back connect bash to correct folder
2021-10-26 08:51:54 +02:00
8595478b36
Merge pull request #2149 from OTRF/feature/Sysmon-For-Linux-Rules
...
OTR - Migrating rules to Sysmon for Linux schema :)
2021-10-21 19:10:32 +02:00
963f32063f
Merge pull request #2148 from SigmaHQ/rule-devel
...
First Linux Process Creation and Network Connection rules (Sysmon for Linux)
2021-10-21 19:10:08 +02:00
ae22f2ae7e
rule: Linux Bash reverse shell indicators
2021-10-16 14:21:55 +02:00
114e44ce6b
move file
2021-10-16 11:11:19 +02:00
2c0e89ccc8
added indentation to lists per request
2021-10-15 16:24:26 -04:00
7b11987155
Fixed format indentation to fix block error
2021-10-15 16:12:51 -04:00
d391eccd32
split commandline arguments in a few rules
2021-10-15 16:10:42 -04:00
eed86077ab
updated rules schema and added Clipboard Collection with Xclip Tool
2021-10-15 15:59:11 -04:00
04ff9ae692
Updated at command rule to use Image field
2021-10-15 15:46:59 -04:00
Florian Roth