 Florian Roth
|
1b0aaf62c3
|
Merge pull request #1266 from omkar72/ryuk
modifying couple of rules
|
2020-12-13 19:05:54 +01:00 |
|
|
Florian Roth
|
e2ade077ed
|
Merge pull request #1275 from bczyz1/patch-3
update win_apt_slingshot.yml
|
2020-12-13 19:04:47 +01:00 |
|
|
Florian Roth
|
612008a4d8
|
fix identation
|
2020-12-11 18:40:17 +01:00 |
|
|
Tran Trung Hieu
|
edc79a8bb6
|
Detects suspicious shell spawn from MSSQL process, this might be sight of RCE or SQL Injection
|
2020-12-11 15:17:23 +07:00 |
|
|
Florian Roth
|
b6d62b7a21
|
Merge pull request #1302 from Neo23x0/rule-devel
TA505 Dropper, minor fix in PowerShell Rule
|
2020-12-08 10:40:07 +01:00 |
|
|
Florian Roth
|
640470cefd
|
TA505 Loader Rule
|
2020-12-08 10:15:30 +01:00 |
|
|
OG
|
8e801ede32
|
Update win_susp_psexec_eula.yml
|
2020-11-29 17:45:29 +05:30 |
|
|
Florian Roth
|
c6fc9de144
|
New Trickbot wermgr rule
|
2020-11-26 09:54:27 +01:00 |
|
|
Florian Roth
|
c111ab3141
|
Improved Trickbot recon rule
|
2020-11-26 09:54:13 +01:00 |
|
|
bczyz1
|
05398ae95e
|
change field newprocessname -> image
|
2020-11-23 13:43:19 +01:00 |
|
|
bczyz1
|
193021eff8
|
Update win_apt_slingshot.yml
fix condition
|
2020-11-20 09:19:03 +01:00 |
|
|
Florian Roth
|
af4d546408
|
Merge pull request #1282 from Neo23x0/rule-devel
fix: FPs with notepad++ GUP rule
|
2020-11-10 13:39:28 +01:00 |
|
|
Florian Roth
|
2e9d7951a6
|
Merge pull request #1272 from bczyz1/patch-2
Fix typo in win_apt_lazarus_session_hijack.yml
|
2020-11-10 13:35:08 +01:00 |
|
|
Florian Roth
|
f6c0fb2d33
|
fix: FPs with notepad++ GUP rule
|
2020-11-09 16:34:12 +01:00 |
|
|
Florian Roth
|
c3785d6dc7
|
rule: FPs with WmiPrvSE rule
|
2020-11-05 16:44:33 +01:00 |
|
|
bczyz1
|
c554aaea8f
|
update win_apt_slingshot.yml
- optimized rule
- added detection of task modification (flag /change + /disable as described here https://stackoverflow.com/questions/26169582/does-anyone-know-of-a-way-to-turn-off-windows-defragmenters-default-schedule-us)
|
2020-11-05 15:51:22 +01:00 |
|
|
bczyz1
|
4a5b2d642e
|
Fix typo in win_apt_lazarus_session_hijack.yml
|
2020-11-03 14:46:29 +01:00 |
|
|
omkargudhate22
|
f1bb9726ca
|
updated mitre tag
|
2020-10-30 13:35:40 +05:30 |
|
|
omkar72
|
86a849728d
|
ryuk changes
|
2020-10-30 13:15:11 +05:30 |
|
|
Florian Roth
|
75637324e0
|
feat: cover newest emotet campaigns
|
2020-10-23 23:44:48 +02:00 |
|
|
Florian Roth
|
198b292c26
|
rule: emotet encoded commands
|
2020-10-20 12:51:58 +02:00 |
|
|
Florian Roth
|
48f1be04d4
|
fix: ping hex ip rule
|
2020-10-16 10:06:24 +02:00 |
|
|
Florian Roth
|
3affdd12e0
|
fix: rule title casing
|
2020-10-12 09:51:35 +02:00 |
|
|
Florian Roth
|
0d0cda0f86
|
docs: improved false positive notes
|
2020-10-12 09:18:42 +02:00 |
|
|
Florian Roth
|
e7c6794ecd
|
rule: suspicious wmic process call create + rundll32
|
2020-10-12 09:18:30 +02:00 |
|
|
Florian Roth
|
2e732eb01f
|
Merge branch 'master' into rule-devel
|
2020-10-12 09:13:24 +02:00 |
|
|
Florian Roth
|
c17ca6d5fe
|
Merge pull request #1018 from savvyspoon/wcry-dns
WannaCry Killswitch domain DNS query
|
2020-09-29 09:27:21 +02:00 |
|
|
Florian Roth
|
d7d9c0e772
|
Merge pull request #1021 from hieuttmmo/master
Sigma rule to detect AdFind.exe execution
|
2020-09-27 09:50:41 +02:00 |
|
|
Florian Roth
|
8020fe3c40
|
false positive condition
|
2020-09-26 17:03:29 +02:00 |
|
|
Florian Roth
|
60795f7050
|
Update win_susp_adfind.yml
Fear that a simple adfind.exe causes too many false positives
|
2020-09-26 17:02:39 +02:00 |
|
|
Florian Roth
|
dbdd758365
|
Duplicate Rule
we already have a rule for that
|
2020-09-26 17:01:32 +02:00 |
|
|
Tran Trung Hieu
|
d4dd0600ad
|
Fix logsource service to process_creation
|
2020-09-26 21:45:23 +07:00 |
|
|
Tran Trung Hieu
|
c756fc8576
|
Detect Suspicious AdFind Execution
|
2020-09-26 21:34:06 +07:00 |
|
|
Mike Wade
|
7b1ef9ea64
|
fixing test runner issues
|
2020-09-15 15:45:33 -06:00 |
|
|
Mike Wade
|
6ed36b0e41
|
fixed issues with tabs and duplicate tags
|
2020-09-15 08:52:00 -06:00 |
|
|
Mike Wade
|
da9b32bdd6
|
we
|
2020-09-15 06:24:44 -06:00 |
|
|
Mike Wade
|
8ce73bd8df
|
Fixed issues with tags and missing files
|
2020-09-15 06:10:57 -06:00 |
|
|
Thomas Patzke
|
378d9c94cf
|
Merge branch 'master' of https://github.com/socprime/sigma into pr-981
|
2020-09-15 12:14:49 +02:00 |
|
|
Mike Wade
|
249c255435
|
No Idea why these files are deleted
|
2020-09-13 22:00:30 -06:00 |
|
|
Yugoslavskiy Daniil
|
1fc202fe5d
|
fix typos, update tags
|
2020-09-13 15:46:45 +02:00 |
|
|
Tran Trung Hieu
|
49ba107dce
|
Fixed Title
|
2020-09-10 17:36:37 +07:00 |
|
|
Tran Trung Hieu
|
f7d5240d40
|
Added UID, fixed rule description
|
2020-09-10 17:20:16 +07:00 |
|
|
Tran Trung Hieu
|
1b6c6ec5bf
|
Detects a suspicious activities of MpCmdRun.exe, which could be an action for downloading a file from the internet using Windows Defender
|
2020-09-10 17:16:06 +07:00 |
|
|
Florian Roth
|
de5444a81e
|
Merge pull request #989 from oscd-initiative/master
[OSCD Initiative][ATT&CK tags update]
|
2020-09-08 13:27:58 +02:00 |
|
|
Florian Roth
|
6f96bbbe65
|
Merge pull request #977 from barvhaim/patch-1
Update win_new_service_creation.yml typo
|
2020-09-07 09:39:28 +02:00 |
|
|
Florian Roth
|
37751fc3a1
|
Merge pull request #978 from barvhaim/patch-2
Update sysmon_apt_muddywater_dnstunnel.yml typo
|
2020-09-07 09:39:11 +02:00 |
|
|
e6e6e
|
98c412044a
|
att&ck tags review: windows/process_creation part 5
added missing ATT&CK v6.3 IDs with comments and removed unnecessary "modified" attributes
|
2020-09-07 02:00:41 +04:00 |
|
|
e6e6e
|
7ae76b8d99
|
Revert "att&ck tags review: windows/process_creation part 5"
This reverts commit e94c47e74e.
|
2020-09-07 01:28:08 +04:00 |
|
|
e6e6e
|
e94c47e74e
|
att&ck tags review: windows/process_creation part 5
added missing ATT&CK v6.3 IDs with comments and removed unnecessary "modified" attributes
|
2020-09-07 01:19:41 +04:00 |
|
|
grikos
|
961e4eef4c
|
att&ck tags review: windows/process_creation part 6
|
2020-09-05 20:35:21 +03:00 |
|