0744107fbb
Deleted EventID part
2020-06-04 18:19:08 +03:00
1c677aa172
Fix title as in guideline
...
Fix title error as in guideline and other cosmetic changes
2020-06-04 18:13:32 +03:00
bafd6bde5f
Convert to process_creation
...
Convert to process_creation
2020-06-04 14:45:10 +03:00
09afae1e66
Create sysmon_apt_muddywater_dnstunnel.yml
...
Detecting DNS tunnel activity from MuddyWater as in https://www.virustotal.com/gui/file/5ad401c3a568bd87dd13f8a9ddc4e450ece61cd9ce4d1b23f68ce0b1f3c190b7/
2020-06-04 14:27:19 +03:00
84dd8c39c4
Move null values out from list in rules
2020-06-03 13:57:22 +02:00
4ed512011a
All Rules use 'TargetFilename' instead of 'TargetFileName'.
...
This commit fixes the incorrect spelling.
2020-06-03 09:00:59 +02:00
e20b58c421
Merge pull request #806 from SanWieb/sysmon_creation_system_file
...
Fixed wrong field & Improve rule
2020-05-29 17:32:27 +02:00
a00f7f19a1
Add tagg Endswith
...
Prevent the trigger of {}.exe.log
2020-05-29 16:25:54 +02:00
38afd8b5de
Fixed wrong field
2020-05-28 21:52:17 +02:00
ec313b6c8a
Merge pull request #801 from SanWieb/sysmon_creation_system_file
...
Rule: sysmon_creation_system_file
2020-05-27 08:49:20 +02:00
d44fc43c54
Add extension
2020-05-26 19:10:11 +02:00
f6ec724d51
Rule: sysmon_creation_system_file
2020-05-26 18:53:54 +02:00
c1f4787566
Merge pull request #797 from NVISO-BE/sysmon_cve-2020-1048
...
Changes to sysmon_cve-2020-1048
2020-05-26 13:21:04 +02:00
48c5f2ed09
Update to sysmon_cve-2020-1048
...
Added .com executables to detection
Second TargetObject should have been Details
2020-05-26 11:20:21 +02:00
7037e77569
add more FP
2020-05-25 04:50:22 -04:00
b8ee736f44
Remove AppData folder as suspicious folder
...
A lot of software is using the AppData folder for startup keys. Some examples:
- Microsoft Teams (\AppData\Local\Microsoft\Teams)
- Resilio (\AppData\Roaming\Resilio Sync\)
- Discord ( (\AppData\Local\Discord\)
- Spotify ( (\AppData\Roaming\Spotify\)
Too many to whitelist them all
2020-05-24 15:16:07 +02:00
f970d28f10
add more false positives
2020-05-23 15:06:15 -04:00
67faf4bd41
fix FP + remove powershell rule redundant with sysmon_in_memory_powershell.yml
2020-05-23 10:56:23 -04:00
10ca3006f5
move rule where needed
2020-05-23 10:07:55 -04:00
d9bc09c38c
fix test
2020-05-23 10:02:58 -04:00
78a7852a43
renamed dbghelp rule with new ID and comment and removed a false positive
2020-05-23 09:16:40 -04:00
75ba5f989c
add 1 more FP to wmi load
2020-05-23 07:44:45 -04:00
9a7f462d79
move renamed bnaries rule to process creation (they made a lot of false positives in sysmon as there was no event id specified in the rule)
2020-05-23 07:17:56 -04:00
cfde0625f5
fix false positive matching on every powershell process not run by SYSTEM account
2020-05-23 07:05:09 -04:00
12e1aeaf9f
Merge pull request #788 from Neo23x0/rule-devel
...
refactor: split up rule for CVE-2020-1048 into 2 rules
2020-05-23 09:54:43 +02:00
34006d0794
refactor: simplified and extended expression in CVE-2020-1048 rule
2020-05-23 09:16:19 +02:00
57c8e63acd
refactore: split up rule for CVE-2020-1048 into 2 rules
2020-05-23 09:09:58 +02:00
ec17c2ab56
filter on createkey only when needed
2020-05-22 10:37:00 -04:00
0dd089db47
various rules cleaning
2020-05-18 20:29:53 -04:00
1aa97fe577
flake 8
2020-05-18 10:03:18 -04:00
088800cd18
fix rule due to sigmac bug?
2020-05-18 09:39:48 -04:00
e89613aee0
add some false positives checks
2020-05-18 07:19:06 -04:00
25d3a5a893
Remove "condition" from global rule.
...
The condition field in this rule was in the global section which overwrote the condition in sub-rules and generated FPs. For example, once Sigma read the rule, the bottom sub-rule's "condition" was overwritten with "1 of them".
2020-05-17 12:44:57 -07:00
a46e357874
Merge branch 'master' into rule-devel
2020-05-16 08:59:34 +02:00
d5e7d4e302
fix: missing condition in CVE-2020-1048 rule
2020-05-16 08:59:05 +02:00
0575fa8d81
fix CVE 2020-1048 rule
2020-05-15 07:25:05 -04:00
cc26b26377
Merge branch 'master' into rule-devel
...
# Conflicts:
# rules/windows/sysmon/sysmon_cve-2020-1048.yml
2020-05-15 12:09:47 +02:00
8e7caf0e4d
rule: CVE-2020-1048
2020-05-15 12:08:31 +02:00
5854cc4677
fix: small bug in new CVE-2020-1048 rule
2020-05-15 11:37:46 +02:00
e53a97fa2f
Update condition to filter out printer port
2020-05-14 18:22:49 +07:00
443bf09d27
Add author
2020-05-14 18:10:16 +07:00
e74970cea0
Suspicious network connection from notepad.exe
2020-05-14 18:08:30 +07:00
97b690d340
Change level from Critical to High
2020-05-14 09:02:54 +07:00
d0b1c98d5a
Reformat rule
2020-05-14 00:39:41 +07:00
3e5b33388b
New rule to detect possible CVE-2020-1048 exploitation
2020-05-14 00:24:36 +07:00
1104044f53
fix: delete duplicate rules
2020-05-11 10:55:02 +02:00
f96c3a5fd4
Merge branch 'master' into rule-devel
...
# Conflicts:
# rules/proxy/proxy_ua_suspicious.yml
# rules/windows/process_creation/win_install_reg_debugger_backdoor.yml
# rules/windows/process_creation/win_susp_csc_folder.yml
2020-05-11 10:44:19 +02:00
514bd8657b
Merge pull request #704 from Iveco/master
...
Detect Ghost-In-The-Logs (disabling/bypassing ETW)
2020-04-14 14:11:27 +02:00
3175a48bdc
Casing
2020-04-14 13:40:34 +02:00
ecdec93800
Casing
2020-04-14 13:39:58 +02:00
Furkan ÇALIŞKAN