 Nasreddine Bencherchali
|
083d30c19d
|
fix: title and add python filter
|
2023-01-02 15:02:28 +01:00 |
|
|
Nasreddine Bencherchali
|
e23a63a60e
|
fix: typo in field name
|
2023-01-02 14:52:35 +01:00 |
|
|
Nasreddine Bencherchali
|
3749416a30
|
Merge branch 'SigmaHQ:master' into nasbench-rule-devel
|
2023-01-02 14:50:27 +01:00 |
|
|
Nasreddine Bencherchali
|
a99b5082e1
|
feat: updates and enhancements
|
2023-01-02 14:49:45 +01:00 |
|
|
frack113
|
0aad498425
|
Last lolbin (#3845)
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-12-31 19:53:44 +01:00 |
|
|
Nasreddine Bencherchali
|
f67cd766d0
|
Merge pull request #3846 from fukusuket/fix-invalid-regex-escape
fix: remove incorrect backslash escape(in `|re` block)
|
2022-12-31 18:35:36 +01:00 |
|
|
fukusuket
|
04ecbbded9
|
fix: typo modified
|
2022-12-31 21:57:05 +09:00 |
|
|
fukusuket
|
9298295c15
|
fix: remove invalid backslash escape
|
2022-12-31 21:35:07 +09:00 |
|
|
signalblur
|
73f56c2f0e
|
Hidden Linux Binary Execution (#3108)
Co-authored-by: Florian Roth <venom14@gmail.com>
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
|
2022-12-31 08:27:32 +01:00 |
|
|
Nasreddine Bencherchali
|
7dab38b19f
|
fix: add missing modified date
|
2022-12-30 20:56:21 +01:00 |
|
|
fukusuket
|
bd6243be7d
|
fix: remove unneeded backslash escape in character class.
|
2022-12-31 00:33:00 +09:00 |
|
|
Nasreddine Bencherchali
|
261bb8758a
|
Merge branch 'SigmaHQ:master' into nasbench-rule-devel
|
2022-12-30 11:49:08 +01:00 |
|
|
frack113
|
aee5ca7afc
|
Fix invalid field cast or name (#3841)
|
2022-12-30 11:46:21 +01:00 |
|
|
Nasreddine Bencherchali
|
d4b9df608b
|
fix: broken selection
|
2022-12-30 10:30:15 +01:00 |
|
|
Nasreddine Bencherchali
|
58f47b9875
|
fix: add known children appvlp
|
2022-12-30 10:24:25 +01:00 |
|
|
frack113
|
995b5918f2
|
Update rules/windows/process_creation/proc_creation_win_susp_shellexec_rundll_usage.yml
|
2022-12-30 10:21:54 +01:00 |
|
|
frack113
|
f083c5f83f
|
Merge branch 'master' into patch-1
|
2022-12-30 10:12:25 +01:00 |
|
|
frack113
|
d10ecf5527
|
Merge pull request #3838 from redsand/fp_sysmon_werfault_child
FP when sysmon crashes and werfault gets launched
|
2022-12-30 10:08:09 +01:00 |
|
|
zydyka
|
d7bc30587f
|
Update proc_creation_win_sysmon_exploitation.yml
|
2022-12-30 09:00:57 +05:00 |
|
|
Nasreddine Bencherchali
|
1e29560591
|
fix: duplicate title
|
2022-12-30 01:10:03 +01:00 |
|
|
Nasreddine Bencherchali
|
2d5231ca2c
|
fix: broken selection
|
2022-12-30 00:58:17 +01:00 |
|
|
Nasreddine Bencherchali
|
c6fd915619
|
feat: updates and enhancements
|
2022-12-30 00:56:40 +01:00 |
|
|
Tim Shelton
|
aeab567fb9
|
FP when sysmon crashes and werfault gets launched
|
2022-12-29 21:18:26 +00:00 |
|
|
fukusuket
|
42ab7c0484
|
fix regex escape
|
2022-12-30 00:11:52 +09:00 |
|
|
frack113
|
197615345b
|
Add missing lolbin OSBinaries (#3835)
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-12-29 14:36:33 +01:00 |
|
|
Nasreddine Bencherchali
|
19396788db
|
Merge pull request #3831 from redsand/fp_suspicious_process_privilege
FP: filters out erl.exe running handle.exe with elevated privileges
|
2022-12-28 21:18:54 +01:00 |
|
|
Florian Roth
|
f3abafed94
|
fix: Windows Defender detection
|
2022-12-28 20:52:53 +01:00 |
|
|
Nasreddine Bencherchali
|
77113a7340
|
fix: author ref
|
2022-12-28 18:42:47 +01:00 |
|
|
Nasreddine Bencherchali
|
3677b9f2e6
|
fix: enhance fp filter
|
2022-12-28 18:42:12 +01:00 |
|
|
Tim Shelton
|
f5fffd8e92
|
FP: filters out erl.exe running handle.exe with elevated privileges
|
2022-12-28 16:44:25 +00:00 |
|
|
frack113
|
b3ec85b25b
|
Merge pull request #3826 from nasbench/fix-old-sigma-link
fix: rename links from old repo to SigmaHQ
|
2022-12-28 11:11:04 +01:00 |
|
|
Nasreddine Bencherchali
|
a25027fef8
|
fix: rename links from old repo to SigmaHQ
|
2022-12-27 21:05:16 +01:00 |
|
|
frack113
|
0392f92a0d
|
PowerShell Token Obfuscation (#3825)
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-12-27 20:03:05 +01:00 |
|
|
frack113
|
e1707c8f50
|
rewrite issue 1555 (#3818)
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-12-27 19:28:34 +01:00 |
|
|
Florian Roth
|
3e712480c4
|
Merge pull request #3824 from SigmaHQ/rule-devel
Htran/NATbypass, Greedy RAR
|
2022-12-27 16:34:33 +01:00 |
|
|
Nasreddine Bencherchali
|
88e56229cf
|
fix: indentation and selection names for clarity
|
2022-12-27 16:26:20 +01:00 |
|
|
Florian Roth
|
32a17342b4
|
Update rules/windows/process_creation/proc_creation_win_rar_susp_greedy.yml
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-12-27 15:46:37 +01:00 |
|
|
frack113
|
8a6f66b120
|
Rules for Issue 575 (#3820)
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-12-27 15:17:45 +01:00 |
|
|
Nasreddine Bencherchali
|
47572e08c8
|
fix: remove additional space
|
2022-12-27 14:27:55 +01:00 |
|
|
frack113
|
7060db3d47
|
Promotion rules (#3821)
* Promotion rules
* fix missing null
* fix: modified date
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-12-27 12:29:10 +01:00 |
|
|
sai prashanth pulisetti
|
8b05818559
|
Create proc_creation_win_SharpImpersonation_tool.yml (#3823)
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
|
2022-12-27 12:02:22 +01:00 |
|
|
Florian Roth
|
0cd5eb375d
|
Merge branch 'master' into rule-devel
|
2022-12-27 11:58:53 +01:00 |
|
|
Florian Roth
|
65f92dcd47
|
rule: HTran / NATBypass usage
|
2022-12-27 11:58:44 +01:00 |
|
|
frack113
|
8ea3999754
|
Merge pull request #3302 from memory-shards/master
Create proc_creation_win_lolbin_agentexecutor.yml
|
2022-12-24 15:45:35 +01:00 |
|
|
Nasreddine Bencherchali
|
794d93c298
|
fix: broken selection
|
2022-12-24 14:11:32 +01:00 |
|
|
Nasreddine Bencherchali
|
e7d6bf7cab
|
fix: enhance logic of AgentExecutor rules
|
2022-12-24 14:10:21 +01:00 |
|
|
frack113
|
271460062e
|
Merge pull request #3815 from nasbench/aadinternals-rules
feat: new aadinternals related rules
|
2022-12-23 20:20:07 +01:00 |
|
|
frack113
|
5fdad241ea
|
Update proc_creation_win_lolbin_agentexecutor.yml
|
2022-12-23 20:11:55 +01:00 |
|
|
Nasreddine Bencherchali
|
5a8808e0ac
|
fix: wrong category
|
2022-12-23 19:27:34 +01:00 |
|
|
Nasreddine Bencherchali
|
1f38e15bb4
|
fix: fp section
|
2022-12-23 19:24:08 +01:00 |
|