 Florian Roth
|
1b0aaf62c3
|
Merge pull request #1266 from omkar72/ryuk
modifying couple of rules
|
2020-12-13 19:05:54 +01:00 |
|
|
Florian Roth
|
e2ade077ed
|
Merge pull request #1275 from bczyz1/patch-3
update win_apt_slingshot.yml
|
2020-12-13 19:04:47 +01:00 |
|
|
Florian Roth
|
d1f7a206b9
|
Merge pull request #1289 from weslambert/master
Fix typo
|
2020-12-13 19:04:07 +01:00 |
|
|
Florian Roth
|
9f70bcab23
|
Merge pull request #1300 from shilch/master
Add sigmac flag to delimit results by NUL instead of \n
|
2020-12-13 19:03:27 +01:00 |
|
|
Florian Roth
|
5197f21ed1
|
fix: duplicate ID
|
2020-12-13 18:59:04 +01:00 |
|
|
Florian Roth
|
c6eadea9d9
|
Merge pull request #1304 from hieuttmmo/master
Detects suspicious shell spawn from MSSQL process, this might be sigh…
|
2020-12-11 18:40:27 +01:00 |
|
|
Florian Roth
|
612008a4d8
|
fix identation
|
2020-12-11 18:40:17 +01:00 |
|
|
Tran Trung Hieu
|
edc79a8bb6
|
Detects suspicious shell spawn from MSSQL process, this might be sight of RCE or SQL Injection
|
2020-12-11 15:17:23 +07:00 |
|
|
Florian Roth
|
cfe60d180b
|
Merge pull request #1301 from d4rk-d4nph3/master
Added rule for Fortinet CVE-2018-13379 preauth file read exploitation.
|
2020-12-08 11:09:51 +01:00 |
|
|
Florian Roth
|
b6d62b7a21
|
Merge pull request #1302 from Neo23x0/rule-devel
TA505 Dropper, minor fix in PowerShell Rule
|
2020-12-08 10:40:07 +01:00 |
|
|
Florian Roth
|
2c642c64d2
|
Removed a value
|
2020-12-08 10:38:32 +01:00 |
|
|
Florian Roth
|
a87a81d8cc
|
Update web_fortinet_cve_2018_13379_preauth_read_exploit.yml
|
2020-12-08 10:33:52 +01:00 |
|
|
Florian Roth
|
640470cefd
|
TA505 Loader Rule
|
2020-12-08 10:15:30 +01:00 |
|
|
Bhabesh Rai
|
3ddf940812
|
Added rule for Fortinet CVE-2018-13379 preauth file read exploitation.
|
2020-12-08 14:46:47 +05:45 |
|
|
Simon
|
97fcae56fd
|
Update sigmac.py
|
2020-12-06 20:08:00 +01:00 |
|
|
Florian Roth
|
540039cbc3
|
fix: Malicious Nishang PowerShell Commandlets FP with MDATP
|
2020-12-05 09:33:42 +01:00 |
|
|
Simon
|
4a4d3e1d35
|
Update sigmac.py
|
2020-12-04 18:22:24 +01:00 |
|
|
Simon Hilchenbach
|
a40ef7360d
|
Add sigmac flag to delimit results by NUL instead of \n
|
2020-12-04 18:05:23 +01:00 |
|
|
Thomas Patzke
|
578d2f0585
|
Merge pull request #1283 from 404d/mdatp-fixes
mdatp: Mapping and generic event changes, case insensitive search
|
2020-11-29 21:56:17 +01:00 |
|
|
OG
|
8e801ede32
|
Update win_susp_psexec_eula.yml
|
2020-11-29 17:45:29 +05:30 |
|
|
Florian Roth
|
3d39d49d65
|
Merge pull request #1295 from findthebad/fix-winlogbeat-config
Updated winlogbeat.yml config to include OriginalFileName
|
2020-11-26 23:17:45 +01:00 |
|
|
findthebad
|
ad899899ab
|
Updated winlogbeat.yml config to include OriginalFileName
|
2020-11-26 14:48:14 -05:00 |
|
|
Florian Roth
|
084cd39505
|
Merge pull request #1294 from Neo23x0/devel
Trickbot rules improved
|
2020-11-26 10:13:35 +01:00 |
|
|
Florian Roth
|
c6fc9de144
|
New Trickbot wermgr rule
|
2020-11-26 09:54:27 +01:00 |
|
|
Florian Roth
|
c111ab3141
|
Improved Trickbot recon rule
|
2020-11-26 09:54:13 +01:00 |
|
|
Florian Roth
|
b31ed47ccf
|
Merge branch 'master' into devel
|
2020-11-26 09:44:56 +01:00 |
|
|
Florian Roth
|
13354dd7a2
|
Merge pull request #1293 from hegga/cb-fix-domain-fieldmapping
Fix field mapping for DestinationHostname
|
2020-11-26 09:40:28 +01:00 |
|
|
Helge Aksdal
|
3a7c114ca3
|
Fix field mapping for DestinationHostname
|
2020-11-26 04:17:28 +01:00 |
|
|
bczyz1
|
05398ae95e
|
change field newprocessname -> image
|
2020-11-23 13:43:19 +01:00 |
|
|
Thomas Patzke
|
0ed54a6cae
|
Merge pull request #1290 from arollyson/helix_backend
Backend: FireEye Helix
|
2020-11-21 00:06:19 +01:00 |
|
|
bczyz1
|
193021eff8
|
Update win_apt_slingshot.yml
fix condition
|
2020-11-20 09:19:03 +01:00 |
|
|
Alek Rollyson
|
83b8af6cd2
|
Add FirEye Helix backend
|
2020-11-19 11:18:28 -05:00 |
|
|
weslambert
|
832e582b8d
|
Fix typo
|
2020-11-17 17:44:40 -05:00 |
|
|
Florian Roth
|
7566f19635
|
Merge pull request #1267 from w0rk3r/ecs-1
Suricata ECS
|
2020-11-17 15:05:47 +01:00 |
|
|
Florian Roth
|
9944c0e563
|
Merge branch 'master' into pr/1267
|
2020-11-17 14:33:55 +01:00 |
|
|
Florian Roth
|
1540241106
|
Merge branch 'master' of https://github.com/Neo23x0/sigma
|
2020-11-17 14:29:42 +01:00 |
|
|
Florian Roth
|
88e3de816d
|
docs: uberAgent ESA target in README
|
2020-11-17 14:29:36 +01:00 |
|
|
Florian Roth
|
c5c6557ca2
|
Merge pull request #1256 from vastlimits/master
Backend: uberAgent ESA converter backend
|
2020-11-17 14:29:01 +01:00 |
|
|
Florian Roth
|
94540ea0b6
|
Merge pull request #1284 from heyibrahimkhan/master
added role name field to ecs-cloudtrail.
|
2020-11-17 14:24:40 +01:00 |
|
|
heyibrahimkhan@gmail.com
|
eed4fe04d5
|
added role name field to ecs-cloudtrail.
|
2020-11-13 05:59:55 +05:00 |
|
|
Simen Lybekk
|
c0a7cdc3de
|
mdatp: Use case-insensitive searches by default
This sohuld match the draft Sigma specification as well as other backends
|
2020-11-12 14:09:30 +01:00 |
|
|
Simen Lybekk
|
a75d4fb561
|
mdatp: Add more field mappings and table<->generic event mappings, skip IMPHASH as it's not supported
|
2020-11-12 13:15:38 +01:00 |
|
|
Sven Scharmentke
|
446b0b7f9d
|
Merge branch 'master_origin'
|
2020-11-11 12:32:53 +01:00 |
|
|
Sven Scharmentke
|
a58d04e4df
|
Rules: Support image_load
|
2020-11-11 12:31:55 +01:00 |
|
|
Thomas Patzke
|
43b9b17767
|
Merge pull request #1281 from andurin/kibana-ndjson-configs
kibana-ndjson for all configs which already have kibana
|
2020-11-11 07:34:37 +01:00 |
|
|
Florian Roth
|
af4d546408
|
Merge pull request #1282 from Neo23x0/rule-devel
fix: FPs with notepad++ GUP rule
|
2020-11-10 13:39:28 +01:00 |
|
|
Florian Roth
|
2e9d7951a6
|
Merge pull request #1272 from bczyz1/patch-2
Fix typo in win_apt_lazarus_session_hijack.yml
|
2020-11-10 13:35:08 +01:00 |
|
|
Florian Roth
|
230562bdf6
|
Merge pull request #1278 from K-Yo/update-navigator-v4
Update navigator v4
|
2020-11-10 13:34:46 +01:00 |
|
|
Florian Roth
|
c087e39698
|
Merge pull request #1277 from K-Yo/fix-unicode-error
Fix unicode error in sigma2attack
|
2020-11-10 13:34:05 +01:00 |
|
|
Florian Roth
|
f6c0fb2d33
|
fix: FPs with notepad++ GUP rule
|
2020-11-09 16:34:12 +01:00 |
|