security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,904 Commits 1 Branch 57 Tags
16fed13bb0636b32e83d5851a572e2d21145f087
Commit Graph

2547 Commits

Author SHA1 Message Date
frack113 16fed13bb0 Order files 2022-02-04 10:52:55 +01:00
frack113 2887cf2800 Merge pull request #2623 from frack113/red_t1555_003 
Redcannary windows
 2022-02-03 22:23:19 +01:00
Florian Roth 20a7bad5d8 Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing 2022-02-02 20:40:21 +01:00
Florian Roth 885651efae fix: FPs noticed with Aurora 2022-02-02 20:39:47 +01:00
Florian Roth ef955b92ae Merge branch 'master' into aurora-false-positive-fixing 2022-02-02 13:49:23 +01:00
Florian Roth cb8a0a6e73 Revert "fix: FPs with GoogleDrive update" 
This reverts commit 86f3302a33.
 2022-02-02 13:49:06 +01:00
phantinuss b627c62fe8 fix: filter out googledrivesync.exe FP 2022-02-02 12:25:55 +01:00
Florian Roth 86f3302a33 fix: FPs with GoogleDrive update 2022-02-02 11:45:42 +01:00
phantinuss a22d57fc87 fix: rename filter 2022-02-02 11:12:39 +01:00
phantinuss 2d36c6222d fix: FPs found in prod environment 2022-02-02 11:03:19 +01:00
Florian Roth f357c73554 Merge branch 'master' into aurora-false-positive-fixing 2022-02-01 19:50:21 +01:00
Florian Roth 9fc06fb027 Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing 2022-02-01 15:57:20 +01:00
Florian Roth 6efa5da3dc fix: unescaped double back slashes 2022-02-01 15:57:15 +01:00
Florian Roth 926f9b588c Merge pull request #2605 from securepeacock/patch-9 
Rundll32 From Abnormal Drive
 2022-01-31 16:38:46 +01:00
Florian Roth fb44e9ae56 Update process_creation_rundll32_not_from_c_drive.yml 2022-01-30 21:48:57 +01:00
frack113 0bcb842c70 Redcannary windows 2022-01-30 18:47:49 +01:00
Florian Roth 642b3748fe Merge pull request #2615 from frack113/redcannary_20220128 
Add windows redcannary rules
 2022-01-29 15:25:40 +01:00
Florian Roth 56fba15638 Update process_creation_tool_nircmd.yml 2022-01-28 23:14:17 +01:00
Florian Roth 34c8de908d Update process_creation_tool_nircmd_as_system.yml 2022-01-28 23:08:41 +01:00
Nasreddine Bencherchali 6f96372ece Update process_creation_tool_nircmd_as_system.yml 2022-01-28 21:10:52 +01:00
Nasreddine Bencherchali b0b9d32dfa Update process_creation_tool_nircmd.yml 2022-01-28 21:10:03 +01:00
Nasreddine Bencherchali 0b09dbdcd1 Update process_creation_tool_nircmd_as_system.yml 2022-01-28 21:01:43 +01:00
Florian Roth 0391cffab4 Merge pull request #2616 from SigmaHQ/rule-devel 
rule: xordump
 2022-01-28 18:06:21 +01:00
Florian Roth bfee0f8067 rule: xordump 2022-01-28 17:26:12 +01:00
frack113 5b30db61b0 Add windows redcannary rules 2022-01-28 16:12:38 +01:00
Florian Roth a5cb3ba37f Merge pull request #2598 from SigmaHQ/rule-devel 
rules: NirCmd, NSudo, RunX
 2022-01-28 12:18:15 +01:00
frack113 9a517bae7c Merge pull request #2614 from frack113/update_ref 
sysmon_proxy_execution_wuauclt Update References
 2022-01-28 11:51:45 +01:00
Florian Roth 982808c3db refactor: whoami / authority, rule: whoami as trusted installer 2022-01-28 11:30:30 +01:00
frack113 a6e3b4691b Update References 2022-01-28 10:30:39 +01:00
frack113 d4b4d4e382 Merge pull request #2612 from glennbarrett/patch-1 
Typo fix in win_plugx_susp_exe_locations.yml
 2022-01-28 10:00:07 +01:00
frack113 069d4ac8bd Update modified 2022-01-28 09:09:26 +01:00
frack113 4ef359a96f Merge pull request #2611 from redsand/fp_for_iexplorer 
adding filter for fp of iexplorer calling cpl
 2022-01-28 06:59:35 +01:00
Glenn Barrett edb769b086 Typo fix in win_plugx_susp_exe_locations.yml 
Change SysWowo64 to SysWow64
 2022-01-27 15:08:54 -05:00
Tim Shelton f8ce6d87a8 adding filter for fp of iexplorer calling cpls: C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:276824072 WinX:0 WinY:0 IEFrame:0000000000000000 2022-01-27 16:31:37 +00:00
securepeacock 1cfa06e6e6 Update process_creation_rundll32_not_from_c_drive.yml 2022-01-25 14:43:30 -05:00
securepeacock 076b0c9246 Create process_creation_rundll32_not_from_c_drive.yml 
Sample Log:

Process Create: RuleName: - UtcTime: 2022-01-25 17:12:12.156 ProcessGuid: {A931971D-2F6C-61F0-D700-000000005200} ProcessId: 724 Image: C:\Windows\notepad.exe FileVersion: 10.0.14393.0 (rs1_release.160715-1616) Description: Notepad Product: Microsoft® Windows® Operating System Company: Microsoft Corporation OriginalFileName: NOTEPAD.EXE CommandLine: "c:\windows\notepad.exe" CurrentDirectory: E:\ User: WINDOMAIN\vagrant LogonGuid: {A931971D-283E-61F0-3DF7-080000000000} LogonId: 0x8F73D TerminalSessionId: 1 IntegrityLevel: Medium Hashes: SHA1=40F2E778CF1EFFA957C719D2398E641EFF20E613,MD5=3B508CAE5DEBCBA928B5BC355517E2E6,SHA256=DA0ACEE8F60A460CFB5249E262D3D53211EBC4C777579E99C8202B761541110A,IMPHASH=968239BE2020F1C0DAFFDCDBD49E9C82 ParentProcessGuid: {A931971D-2F57-61F0-D600-000000005200} ParentProcessId: 936 ParentImage: C:\Windows\System32\rundll32.exe ParentCommandLine: "C:\Windows\System32\rundll32.exe" SharedFiles.dll,BasicScore ParentUser: WINDOMAIN\vagrant
 2022-01-25 14:42:13 -05:00
Max Altgelt 51d9aca239 chore: update modified date 2022-01-25 11:46:16 +01:00
Max Altgelt 0cad38be34 fix: Add filter for empty image to rule 2022-01-25 11:43:35 +01:00
frack113 8a47c56397 Merge pull request #2595 from frack113/red_20220123b 
Windows Redcannary
 2022-01-25 06:21:17 +01:00
frack113 f634962420 Merge pull request #2594 from frack113/red_20220123 
Windows Redcannary tests
 2022-01-25 06:20:53 +01:00
frack113 0d5618f8ef Merge pull request #2593 from frack113/moonbounce 
add win_pc_susp_instalutil
 2022-01-25 06:20:38 +01:00
Florian Roth f80f0d3696 rules: nircmd, nsudo, runx 2022-01-24 13:37:28 +01:00
Florian Roth d9193efda3 Merge pull request #2597 from SigmaHQ/rule-devel 
AdvancedRun and Bugfix
 2022-01-24 12:39:51 +01:00
Florian Roth 9505a761e1 fix: bug in rule - missing backspace 2022-01-24 11:54:58 +01:00
frack113 2dc0c2a8a9 fix field name case 2022-01-23 19:12:12 +01:00
frack113 f1959f25d7 Windows Redcannary 2022-01-23 16:37:59 +01:00
frack113 097704d834 add win_pc_susp_instalutil 2022-01-23 14:47:25 +01:00
frack113 90334e7f7c Redcannary windows test 2022-01-23 11:37:01 +01:00
frack113 31e38623de Update win_susp_curl_fileupload 2022-01-23 11:35:36 +01:00
frack113 eb22807ddc Order rules 2022-01-20 22:06:55 +01:00