 Andreas Hunkeler
|
c8fa678a9b
|
rule: add tag execution to new bpftrace rule
|
2022-02-11 14:14:22 +01:00 |
|
|
Andreas Hunkeler
|
66b9d35ee9
|
rule: add new bpftrace unsafe option rule
|
2022-02-11 12:08:53 +01:00 |
|
|
frack113
|
ff9ecf395f
|
Fix detection
|
2022-02-06 19:16:27 +01:00 |
|
|
zakibro
|
d5257f9a05
|
Update lnx_auditd_systemd_service_creation.yml
fixing logic
|
2022-02-04 12:15:36 +01:00 |
|
|
Pawel Mazur
|
fede3b1183
|
Auditd rule - Systemd Service Creation
|
2022-02-03 20:31:07 +01:00 |
|
|
frack113
|
c3c13d6089
|
add lnx_pwnkit_local_privilege_escalation
|
2022-01-29 10:07:54 +01:00 |
|
|
zakibro
|
c1c5ed0db7
|
Update lnx_auditd_cve_2021_4034.yml
|
2022-01-27 12:55:22 +01:00 |
|
|
zakibro
|
bd9b5172cd
|
Update lnx_auditd_cve_2021_4034.yml
|
2022-01-27 12:44:53 +01:00 |
|
|
Pawel Mazur
|
c924977576
|
Adding auditd rule for CVE-2021-4034
|
2022-01-27 12:36:19 +01:00 |
|
|
Pawel Mazur
|
bbdfb79bc0
|
Adding new linux auditd rule - Disable Dystem Firewall
|
2022-01-22 15:12:24 +01:00 |
|
|
frack113
|
dfc477888b
|
Merge pull request #2583 from BlackB0lt/patch-22
Create lnx_doas_conf_creation.yml
|
2022-01-21 18:44:08 +01:00 |
|
|
Florian Roth
|
885f70b0f3
|
Update lnx_doas_execution.yml
|
2022-01-20 13:08:39 +01:00 |
|
|
Florian Roth
|
375acb8ba4
|
Update lnx_doas_conf_creation.yml
|
2022-01-20 13:07:53 +01:00 |
|
|
Sittikorn S
|
f21d10b69f
|
Update lnx_doas_conf_creation.yml
|
2022-01-20 11:00:18 +07:00 |
|
|
Sittikorn S
|
f195160baa
|
Update lnx_doas_execution.yml
|
2022-01-20 10:58:47 +07:00 |
|
|
Sittikorn S
|
8b94046efa
|
Update lnx_doas_execution.yml
|
2022-01-20 10:11:24 +07:00 |
|
|
Sittikorn S
|
41065bcc91
|
Update lnx_doas_conf_creation.yml
|
2022-01-20 10:11:14 +07:00 |
|
|
Sittikorn S
|
bb574151ba
|
Create lnx_doas_conf_creation.yml
|
2022-01-20 09:50:41 +07:00 |
|
|
Sittikorn S
|
4f56e0d92e
|
Update lnx_doas_execution.yml
|
2022-01-20 09:48:24 +07:00 |
|
|
Sittikorn S
|
eb4731b370
|
Create lnx_doas_execution.yml
|
2022-01-20 09:46:17 +07:00 |
|
|
frack113
|
4631d0c482
|
remove invalid tag
|
2022-01-19 18:23:30 +01:00 |
|
|
frack113
|
f7e670d55e
|
Simple Quote
|
2022-01-11 13:40:53 +01:00 |
|
|
Florian Roth
|
e055ec1d52
|
refactor: change all " of them" expressions
|
2022-01-11 10:59:57 +01:00 |
|
|
frack113
|
9092958019
|
fix quote
|
2022-01-10 22:25:47 +01:00 |
|
|
frack113
|
a885d95aa3
|
Update pattern
|
2021-12-10 16:45:42 +01:00 |
|
|
frack113
|
b56630ced1
|
Add lnx_susp_dev_tcp
|
2021-12-10 13:39:06 +01:00 |
|
|
phantinuss
|
07a0a37273
|
feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*'
|
2021-12-02 14:47:39 +01:00 |
|
|
Pawel Mazur
|
6e43a294a2
|
Linux Auditd - Discovery of Capabilities files
|
2021-11-28 16:48:37 +01:00 |
|
|
frack113
|
01dc930c17
|
Change status for old rules
|
2021-11-27 11:33:14 +01:00 |
|
|
Florian Roth
|
4a69c71b2f
|
Update lnx_shell_clear_cmd_history.yml
|
2021-11-24 09:31:12 +01:00 |
|
|
Florian Roth
|
94c61bf07a
|
Update lnx_shell_clear_cmd_history.yml
|
2021-11-24 09:29:48 +01:00 |
|
|
secjunkie
|
b76d000f26
|
Update lnx_shell_clear_cmd_history.yml
cat and ln can use zero or null
chattr does not clear but stops further logging
|
2021-11-23 23:06:23 +00:00 |
|
|
remotephone
|
be59ca0f01
|
Update macos_space_after_filename.yml
Fixing new line and updating change date
|
2021-11-20 15:54:24 -06:00 |
|
|
remotephone
|
9530d67834
|
Create macos_space_after_filename.yml
Adding coverage for macOS space after filename
|
2021-11-20 15:43:51 -06:00 |
|
|
frack113
|
1cfca93354
|
Missing status in rules (#2284)
* add missing status
|
2021-11-19 22:32:26 +01:00 |
|
|
frack113
|
0c61c444eb
|
Merge pull request #2278 from zakibro/master
Adding New Linux Auditd rule - Data Exfil with Wget
|
2021-11-19 22:30:10 +01:00 |
|
|
Pawel Mazur
|
87f64e28fd
|
Adding New Linux Auditd rule - Data Exfil with Wget
|
2021-11-18 18:03:17 +01:00 |
|
|
Florian Roth
|
a921bd5ec8
|
style: reordered rule layout
|
2021-11-17 18:59:40 +01:00 |
|
|
Florian Roth
|
645292d945
|
removed contributor, added to authors
|
2021-11-12 19:44:50 +01:00 |
|
|
Pawel Mazur
|
07a3e3e234
|
Making the Password Policy Discovery rule more resilient by adding detection for specific commands
|
2021-11-12 16:18:29 +01:00 |
|
|
frack113
|
c2ef681e86
|
fix modified
|
2021-11-11 10:26:08 +01:00 |
|
|
frack113
|
c682c12ecf
|
Add sudo service
|
2021-11-11 10:21:21 +01:00 |
|
|
frack113
|
1d38a7dfa5
|
Fix linux process_creation field case
|
2021-11-11 10:16:36 +01:00 |
|
|
frack113
|
bd3358d33c
|
Fix auditd field name
|
2021-11-11 10:13:48 +01:00 |
|
|
frack113
|
735e5eade9
|
Fix macos category
|
2021-11-11 09:52:31 +01:00 |
|
|
frack113
|
18fea95b86
|
move to macos
|
2021-11-09 13:33:58 +01:00 |
|
|
frack113
|
e8a36ace96
|
move to other
|
2021-11-09 13:32:22 +01:00 |
|
|
frack113
|
c8f488eabf
|
move to builtin
|
2021-11-09 13:27:20 +01:00 |
|
|
zakibro
|
30f13d41f5
|
Update lnx_auditd_load_module_insmod.yml
fixing missing date
|
2021-11-02 17:16:59 +01:00 |
|
|
Pawel Mazur
|
dd7817917c
|
Linux - Auditd - Loading of Kernel Module via Insmod rule
|
2021-11-02 17:04:39 +01:00 |
|