14d81bae06
Update proc_creation_win_msdt.yml
2022-05-31 09:46:40 +01:00
1e16ed0090
Merge pull request #3055 from phantinuss/master
...
Rule Harmonization
2022-05-31 08:27:35 +02:00
4010249934
update date
2022-05-30 11:24:54 +02:00
204df4b094
Merge pull request #3057 from frack113/lolbas_20220528
...
Lolbas
2022-05-30 08:46:46 +02:00
41d5ea5042
Update proc_creation_win_lolbas_utilityfunctions.yml
2022-05-30 08:35:06 +02:00
6e41ecdaaf
Merge pull request #3059 from c3rb3ru5d3d53c/patch-1
...
Follina — a Microsoft Office code execution vulnerability
2022-05-30 06:50:53 +02:00
18dc60858a
Fix selection1
2022-05-30 06:44:45 +02:00
7cd648a1ed
Update proc_creation_win_lolbins_by_office_applications.yml
...
https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
2022-05-29 21:28:35 -03:00
e9d18b5075
Create proc_creation_win_msdt.yml
2022-05-29 12:53:45 +01:00
7897192050
Merge branch 'master' of github.com:frack113/sigma into lolbas_20220528
2022-05-28 17:05:39 +02:00
b243c65d8a
Fix date
2022-05-28 17:04:12 +02:00
5b2ab692dc
Lolbas rule
2022-05-28 16:54:45 +02:00
7266c9ff62
fix: specify for local system user
2022-05-27 15:46:56 +02:00
54c2977ddb
chore: harmonize wuauclt rules - kept the oldest, most generic, highest level one
2022-05-27 15:16:31 +02:00
32169dbc33
chore: harmonization of generic 'nt system' user checks
...
also a simple (non-commprehensive) test case to find
usages of localized user names
2022-05-27 15:16:31 +02:00
5e2e776bce
Adjusting condition
2022-05-26 18:38:12 +00:00
48e37241dd
FP: IBM ClientSolutions is valid directory
2022-05-26 18:25:43 +00:00
b80eb411ab
Merge pull request #3032 from frack113/lolbin_20220522
...
Add lolbas cl script
2022-05-25 12:02:44 +02:00
e475deaf4d
Update proc_creation_win_lolbas_cl_mutexverifiers.yml
2022-05-25 11:56:52 +02:00
3bdf29033a
Update proc_creation_win_lolbas_cl_loadassembly.yml
2022-05-25 11:55:37 +02:00
f737ba6e95
Fix duplicate cast
2022-05-25 11:19:09 +02:00
c7b90f108f
Merge pull request #3039 from jstnk9/master
...
New sigma rule to detect the use of Jlaive antivirus defense evasion
2022-05-24 20:25:42 +02:00
a6202f7961
Merge pull request #3041 from SigmaHQ/rule-devel
...
refactor: old rule additions, rule: new powershell rules
2022-05-24 20:24:42 +02:00
0e62d5b204
fix: bugs in rules
2022-05-24 20:18:41 +02:00
37cef9b153
rule: PowerShell obfuscate Net.WebClient
2022-05-24 15:20:21 +02:00
642a334d9e
rule: suspicious PowerShell encoded command patterns
2022-05-24 15:20:01 +02:00
a296bfe667
rule: suspicious anydesk start location
2022-05-24 15:19:45 +02:00
9d11505aa8
refactor: rule additions
2022-05-24 15:19:25 +02:00
6f1602d243
New sigma rule to detect the use of Jlaive antivirus defense evasion
2022-05-24 02:40:08 +02:00
87de0d39db
Update proc_creation_win_rundll32_parent_explorer.yml
2022-05-23 16:49:40 -04:00
9c26e12358
Update proc_creation_win_rundll32_parent_explorer.yml
2022-05-22 15:23:25 -04:00
e9976bc3db
Update proc_creation_win_rundll32_parent_explorer.yml
2022-05-22 15:21:41 -04:00
03b304e6c4
Add lolbas cl script
2022-05-22 12:33:09 +02:00
1e728d9598
Create proc_creation_win_rundll32_parent_explorer.yml
2022-05-21 17:07:31 -04:00
946e4582a3
Merge pull request #3030 from SigmaHQ/aurora-false-positive-fixing
...
fix: detection with Windows Defender
2022-05-20 20:05:43 +02:00
e8f59c8d0f
fix: detection with Windows Defender
2022-05-20 19:27:48 +02:00
74b9f97b9c
Renamed suspicious in filenames to susp
2022-05-19 09:37:04 +02:00
003e5bee6d
Merge pull request #3018 from SigmaHQ/rule-devel
...
refactor: rule addition
2022-05-19 07:50:36 +02:00
3fe86e3b84
rule: grpconv execution
2022-05-18 17:56:26 +02:00
04a3dfeb01
Merge pull request #3025 from nasbench/master
...
Quick Updates and Fixes
2022-05-18 17:35:18 +02:00
7d296ef078
fix: change on deleted rule
2022-05-18 17:34:39 +02:00
99e81ea2eb
Merge branch 'pr/3023'
2022-05-18 17:33:10 +02:00
15cee5c0b1
Update proc_creation_win_susp_taskkill.yml
2022-05-18 17:28:26 +02:00
dcf236fede
Quick Updates and Fixes
...
- Added "Invoke-EventViewer.ps1" script to the rule "file_event_win_powershell_exploit_scripts"
- Added "OriginalFileName" to "proc_creation_win_susp_taskkill"
- Created rule for "winword" being used as a LOLBIN to download and load arbitrary DLLs
2022-05-18 12:50:59 +01:00
354e8ded4e
Merge pull request #3020 from nasbench/master
...
Rule Update (Batch 2)
2022-05-18 07:05:34 +02:00
07a79acede
Update proc_creation_win_lolbas_extrac32.yml
2022-05-17 15:33:18 +01:00
389240855d
Update proc_creation_win_lolbas_extrac32.yml
2022-05-17 15:17:09 +01:00
3bbeab2a7b
Requested Changes
2022-05-17 15:04:26 +01:00
7ea6ed3db6
Merge pull request #3016 from frack113/ttdinjec
...
ttdinject lolbin
2022-05-17 06:28:22 +02:00
b49633d32b
#2902 : Remove t1547.006
2022-05-16 21:57:30 -05:00
Nasreddine Bencherchali