b199e50898
Merge pull request #3358 from frack113/fix_3351
...
Fix condition
2022-08-11 18:24:43 +02:00
41d79d4d1b
Update proc_creation_win_vul_java_remote_debugging.yml
...
simplified rule
2022-08-11 13:29:15 +02:00
8da1502e5d
Update proc_creation_win_vul_java_remote_debugging.yml
...
For Java Running with Remote Debugging, add filtering to vulnerable jvm versions. Later jvm versions limit remote debugging access to localhost by default.
2022-08-11 13:20:40 +02:00
80df54d092
Fix condition
2022-08-11 06:59:01 +02:00
1a57509e85
Merge pull request #3346 from nasbench/nasbench-rule-devel
...
Updates + New Rules
2022-08-11 06:26:57 +02:00
634397e855
Merge pull request #3353 from nasbench/tune-fp-short-path-rules
...
Fix FP - Short Path Rules
2022-08-11 06:26:41 +02:00
f34a60b215
Update proc_creation_win_rundll32_unc_path.yml
2022-08-10 22:08:03 +01:00
f51547fe96
Update proc_creation_win_rundll32_unc_path.yml
2022-08-10 21:15:12 +01:00
3201b68004
Final update
2022-08-10 18:33:17 +01:00
0f8ad22b9a
Update proc_creation_win_susp_wmic_proc_create.yml
2022-08-10 17:53:09 +01:00
021c297e96
Update title and description
2022-08-10 17:48:48 +01:00
5cde4a2d7e
fix: FP with Avast
2022-08-10 17:28:02 +02:00
babdecc642
Update proc_creation_win_ntfs_short_name_use_image.yml
2022-08-10 15:25:10 +01:00
14277c5b6d
Fix FP
2022-08-10 15:15:49 +01:00
c2b415601e
Merge pull request #3344 from phantinuss/master
...
fix: FP found in testing
2022-08-10 14:04:37 +02:00
8e63a4b2e1
fix: another Win7 i386 path
2022-08-10 13:54:19 +02:00
b5c15c5137
More additions and updates
2022-08-10 12:52:49 +01:00
d666a18615
Fix issue 3342
2022-08-10 07:52:50 +02:00
b7e5e128c7
Update proc_creation_win_disable_service.yml
2022-08-09 18:42:39 +01:00
b905df6bc7
Updates + New Rules
2022-08-09 18:35:45 +01:00
df4b8eadbf
fix: FP in testing
2022-08-09 18:34:53 +02:00
68a768f829
Merge pull request #3335 from nasbench/nasbench-rule-devel
...
Update Ntfs Short Name rule
2022-08-09 17:53:05 +02:00
f5d0753167
Add extensions
2022-08-09 16:05:36 +01:00
f1eba85780
Add short name path
2022-08-07 08:37:58 +02:00
be896d1013
rename rule
2022-08-06 18:43:59 +01:00
3388b675ac
Create proc_creation_win_ntfs_short_name_use_image.yml
2022-08-06 18:43:33 +01:00
c38bfe86da
Add short path and Image
2022-08-06 11:25:44 +02:00
7553a98be0
Merge pull request #3328 from frack113/legacy_short_name
...
Add proc_creation_win_shortname_use.yml
2022-08-06 07:41:12 +02:00
8041ab5130
Merge pull request #3325 from nasbench/nasbench-rule-devel
...
Update+New Rules
2022-08-05 23:42:09 +02:00
b4472132a4
Fix after review
2022-08-05 18:40:12 +01:00
f704feaf69
New Rules
2022-08-05 17:11:42 +01:00
9ef9103368
Update PowerShell + other rules
2022-08-05 17:10:41 +01:00
cb5c245a3a
Add proc_creation_win_shortname_use.yml
2022-08-05 12:04:00 +02:00
d259f9400e
Update
2022-08-05 10:18:07 +01:00
d5f7de1314
Merge pull request #3324 from SigmaHQ/rule-devel
...
Suspicious IIS Registration, Plink refactoring, remove Github compromise rules
2022-08-05 09:39:41 +02:00
07e55593c3
Update some registry rules
2022-08-05 00:39:32 +01:00
23052b8b19
Update proc_creation_win_susp_copy_system32.yml
2022-08-04 19:43:36 +01:00
751fbd7a2e
Update proc_creation_win_susp_calc.yml
2022-08-04 19:36:07 +01:00
be40827c9b
Update proc_creation_win_susp_calc.yml
2022-08-04 19:28:28 +01:00
307f9c6a35
New rules
2022-08-04 19:11:16 +01:00
d6a2c13738
Update rules (desc, selection, logic)
2022-08-04 18:08:08 +01:00
7b6e92afca
fix: attack tag
2022-08-04 18:51:44 +02:00
fe2e279cfa
Add more comsvcs variations
...
Based on this https://twitter.com/Wietze/status/1542107456507203586
2022-08-04 16:18:51 +01:00
6d66ed6267
Update description + Missing related field
2022-08-04 15:57:18 +01:00
14dba5ba8b
refactor: plink usage / tunneling
2022-08-04 16:54:15 +02:00
d535ff34b9
rule: Suspicious IIS module installation
2022-08-04 15:27:47 +02:00
d46d89e403
Merge pull request #3315 from nasbench/nasbench-rule-devel
...
New Rules + Update
2022-08-04 13:34:26 +02:00
0e133f7d58
Additional updates
2022-08-04 11:53:09 +01:00
83451b3e6d
Update proc_creation_win_exfil_data_via_cli.yml
2022-08-04 10:58:56 +01:00
8e08ff3060
Fix
2022-08-04 10:58:34 +01:00
Florian Roth