 gsanm
|
150afd816d
|
IP Clean
|
2019-10-22 17:49:50 +07:00 |
|
|
Lep
|
dfe6b968c0
|
addins
|
2019-08-29 15:48:42 +07:00 |
|
|
Lep
|
af264c049b
|
end space
|
2019-08-29 15:43:36 +07:00 |
|
|
Lep
|
c95a17b061
|
process_creation
|
2019-08-28 17:30:13 +07:00 |
|
|
Lep
|
ba30b4929c
|
process_creation update
|
2019-08-28 17:13:54 +07:00 |
|
|
Lep
|
8b6bd45b0b
|
rules for APT32
|
2019-08-28 10:12:01 +07:00 |
|
|
Florian Roth
|
ca2019b57f
|
fix: typo in MITRE tag
|
2019-08-27 12:32:56 +02:00 |
|
|
Florian Roth
|
6b7cd94197
|
Changes
|
2019-08-27 12:23:42 +02:00 |
|
|
weev3
|
d42a51372d
|
Control Panel Item, MITRE_ID=T1196
|
2019-08-27 14:55:55 +06:30 |
|
|
Thomas Patzke
|
68fb56f503
|
Merge pull request #345 from ki11oFF/patch-1
Detection of usage mimikatz trough WinRM
|
2019-08-23 23:04:07 +02:00 |
|
|
Florian Roth
|
c291038ebe
|
rule: renamed powershell
|
2019-08-22 14:22:55 +02:00 |
|
|
Karneades
|
18bbec4bcd
|
improve(rule): add Empire links and userland match
Add default task name and powershell task command to match what the rule name says: detects default config.
|
2019-08-09 11:58:43 +02:00 |
|
|
Florian Roth
|
f3fb2b41b2
|
Rule: FP filters extended
|
2019-07-23 14:58:36 +02:00 |
|
|
Christophe Tafani-Dereeper
|
5bc10a4855
|
Include Github raw URLs in suspicious downloads detection rule
|
2019-07-05 09:01:35 +00:00 |
|
|
Thomas Patzke
|
dbbc1751ef
|
Converted rule to generic log source
|
2019-06-19 23:25:25 +02:00 |
|
|
Thomas Patzke
|
d14f5c3436
|
Merge pull request #371 from savvyspoon/issue285
CAR tagging
|
2019-06-19 23:21:43 +02:00 |
|
|
Thomas Patzke
|
d82df83ef1
|
Merge pull request #369 from TareqAlKhatib/refactors
Refactors
|
2019-06-19 23:16:19 +02:00 |
|
|
Michael Wade
|
f70549ec54
|
First Pass
|
2019-06-13 23:15:38 -05:00 |
|
|
Sherif Eldeeb
|
2d22a3fe02
|
Add detection for recent Mimikatz versions
GrantedAccess is 0x1010 not 0x1410 in recent versions of mimikatz.
This modification should address both
|
2019-06-12 12:13:31 +03:00 |
|
|
Thomas Patzke
|
5715413da9
|
Usage of Channel field name in ELK Windows config
|
2019-06-11 13:15:43 +02:00 |
|
|
Tareq AlKhatib
|
fce2a45dac
|
Corrected Typo
|
2019-06-10 09:51:34 +03:00 |
|
|
Florian Roth
|
7b63c92fc0
|
Rule: applying recommendation
https://twitter.com/SwiftOnSecurity/status/1131464234901094400
|
2019-05-23 09:44:25 +02:00 |
|
|
Olaf Hartong
|
b60cfbe244
|
Added password flag
|
2019-05-22 13:20:26 +02:00 |
|
|
Florian Roth
|
346022cfe8
|
Transformed to process creation rule
|
2019-05-22 12:50:49 +02:00 |
|
|
Olaf Hartong
|
4a775650a2
|
Rule Windows 10 scheduled task SandboxEscaper 0-day
|
2019-05-22 12:36:03 +02:00 |
|
|
Olaf Hartong
|
e675cdf9c4
|
Rule Windows 10 scheduled task SandboxEscaper 0-day
|
2019-05-22 12:32:07 +02:00 |
|
|
Olaf Hartong
|
544dfe3704
|
Rule Windows 10 scheduled task SandboxEscaper 0-day
|
2019-05-22 12:28:42 +02:00 |
|
|
Florian Roth
|
c937fe3c1b
|
Rule: Terminal Service Process Spawn
|
2019-05-22 10:38:27 +02:00 |
|
|
Florian Roth
|
74ca0eeb88
|
Rule: Renamed PsExec
|
2019-05-21 09:49:40 +02:00 |
|
|
Patryk
|
c163dcbe05
|
Update sysmon_mimikatz_trough_winrm.yml
Deleted tab character (\t)
|
2019-05-20 13:22:36 +02:00 |
|
|
Patryk
|
a9faa3dc33
|
Create sysmon_mimikatz_trough_winrm.yml
Detects usage of mimikatz through WinRM protocol
|
2019-05-20 12:25:58 +02:00 |
|
|
Florian Roth
|
694fa567b6
|
Reformatted
|
2019-05-15 20:22:53 +02:00 |
|
|
Florian Roth
|
1c36bfde79
|
Bugfix - Swisscom in Newline
|
2019-05-15 15:03:55 +02:00 |
|
|
Florian Roth
|
d5f49c5777
|
Fixed syntax
|
2019-05-15 14:50:57 +02:00 |
|
|
Florian Roth
|
508d1cdae0
|
Removed double back slashes
|
2019-05-15 14:46:45 +02:00 |
|
|
Unknown
|
13522b97a7
|
Adjusting Newline
|
2019-05-15 12:15:41 +02:00 |
|
|
Unknown
|
275896dbe6
|
Suspicious Outbound RDP Rule likely identifying CVE-2019-0708
|
2019-05-15 11:47:12 +02:00 |
|
|
Florian Roth
|
f78413deab
|
Merge pull request #309 from jmlynch/master
added rules for renamed wscript, cscript and paexec. Added two direct…
|
2019-04-17 23:59:27 +02:00 |
|
|
Florian Roth
|
daaee558a1
|
Rule: added date to Tom's WMI rule
|
2019-04-15 09:06:53 +02:00 |
|
|
Florian Roth
|
65b81dad32
|
Rule: Suspicious scripting in a WMI consumer
|
2019-04-15 08:13:35 +02:00 |
|
|
Jason Lynch
|
f0c8c428bb
|
added rules for renamed wscript, cscript and paexec. Added two directories to the existing sysmon_susp_prog_location_network_connection rule. These additions are all fin7 related.
|
2019-04-08 08:07:30 -04:00 |
|
|
Florian Roth
|
81693d81b6
|
Merge pull request #295 from sbousseaden/master
Create win_atsvc_task.yml
|
2019-04-04 18:32:13 +02:00 |
|
|
Karneades
|
865d971704
|
Remove backslashes in CommandLine for sticky key rule
Example command line is exactly "cmd.exe sethc.exe 211".
=> the detection with *\cmd.exe... would not match.
|
2019-04-03 16:16:18 +02:00 |
|
|
sbousseaden
|
3d69727332
|
Create sysmon_rdp_settings_hijack.yml
|
2019-04-03 14:16:25 +02:00 |
|
|
sbousseaden
|
016261cacf
|
Update sysmon_lsass_memdump.yml
|
2019-04-03 14:06:49 +02:00 |
|
|
sbousseaden
|
a85c668f6f
|
Update sysmon_lsass_memdump.yml
|
2019-04-03 14:00:51 +02:00 |
|
|
sbousseaden
|
32c6b34746
|
Create sysmon_lsass_memdump.yml
|
2019-04-03 13:51:59 +02:00 |
|
|
sbousseaden
|
ddb2d92a98
|
Create sysmon_tsclient_filewrite_startup.yml
|
2019-04-03 13:19:59 +02:00 |
|
|
Tareq AlKhatib
|
783d8c4268
|
Reverting back to regular Sysmon 1 to fix CI test
|
2019-03-09 21:31:56 +03:00 |
|
|
Tareq AlKhatib
|
075df83118
|
Converted to use the new process_creation data source
|
2019-03-09 20:57:59 +03:00 |
|