2ef681291a
feat: more rules updates
2023-02-14 19:30:18 +01:00
4f59a13d46
feat: update wmic rules
2023-02-14 19:30:18 +01:00
d9d9227910
feat: new rule related to CVE-2022-21587 ( #4037 )
2023-02-14 14:30:12 +01:00
a79abaaf45
Merge pull request #4033 from qasimqlf/patch-32
...
feat: add missing `OriginalFileName` field
2023-02-13 14:48:10 +01:00
1adec45ca6
fix: add OriginalFileName ( #4032 )
2023-02-13 14:40:54 +01:00
ab611c29ba
fix: updated condition ( #4031 )
2023-02-13 14:37:33 +01:00
7b435afa4d
feat: add missing OriginalFileName field
2023-02-11 23:04:18 +05:00
da61cf17bd
Merge pull request #4028 from securepeacock/patch-39
...
Create proc_creation_win_userdomain_variable_enumeration.yml
2023-02-11 07:23:32 +01:00
095b41370f
Merge pull request #4027 from nasbench/nasbench-rule-devel
...
feat: updates and enhancements
2023-02-10 10:59:14 +01:00
6623dec47b
fix: some stylistic issues
2023-02-10 10:56:37 +01:00
1d89b041ae
fix: change title from domain to wbesites
2023-02-10 10:49:52 +01:00
5e3aae4970
fix: apply suggestions from code review
...
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2023-02-10 10:38:45 +01:00
677ae061c5
Merge pull request #4030 from BlueTeamNinja/patch-1
...
fix: remove trailing space from logic
2023-02-10 10:35:20 +01:00
38e160cac2
Merge pull request #4029 from nasbench/fix-sigmac-modifier-bug
...
fix: add new edge case handling
2023-02-10 08:48:58 +01:00
82d0b9e10c
fix: add missing modified and improve test
2023-02-10 00:56:07 +01:00
5f6258fe57
fix: add missing modified
2023-02-10 00:48:13 +01:00
82cde0e10c
feat: update rules related to onenote and more
2023-02-10 00:40:16 +01:00
bea7614718
Remove Trailing space
...
The trailing space causes this rule not to trigger when the extension is used (cmd.exe), eg:
CommandLine: "C:\Windows\system32\cmd.exe" /r < "C:\Users\Administrator\desktop\test.txt"
2023-02-09 18:07:56 -05:00
c67782b098
fix: add new edge case
...
Add edge case handling for when converting rules that use one of the new modifiers introduced in PySIGMA
2023-02-09 23:35:56 +01:00
dda55238d4
Create proc_creation_win_userdomain_variable_enumeration.yml
2023-02-09 16:59:06 -05:00
c4d8be3780
fix: duplicate titles
2023-02-09 16:06:09 +01:00
da012ad80d
fix: resolves #4014
2023-02-09 15:48:13 +01:00
c8c32bf1d4
feat: add missing OriginalFileName field ( #4026 )
...
Add missing 'rundll32' OriginalFileName field to some process creation rules
2023-02-09 15:09:23 +01:00
ba80fc1372
Merge pull request #4024 from nasbench/nasbench-rule-devel
...
feat: updates and enhancements
2023-02-09 14:50:04 +01:00
ebb4ae0949
Merge pull request #4018 from signus/20230207-onenote-childproc
...
fix: add new fp filter
2023-02-09 14:49:35 +01:00
9ddedc8958
fix: add fp filter
2023-02-09 14:27:12 +01:00
288914fe42
Add common childprocess filter for OneNote
...
Slight reoranization of the rule with an additional relevant reference.
Additionally adds the `filter_common_childproc` filter to
`proc_creation_win_susp_microsoft_onenote_child_process.yml` for common
processes that are launched from OneNote. OneNote will commonly launch
`Teams.exe -Embedded` for opening documents in Teams, as well as
`FileCoAuth.exe` when people are sharing/editing specific documents
through OneNote. For some organizations these can create enough noise
that it may be warranted to filter out as a part of the rule. Thusfar
malicious execution for `Teams.exe` and `FileCoAuth.exe` have not been
observed.
2023-02-09 14:20:22 +01:00
6d14a14f9e
fix: typos
...
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2023-02-09 13:09:46 +01:00
135bd53b4c
Merge pull request #4025 from nasbench/registry-rules-update
...
feat: registry rules update
2023-02-09 12:12:20 +01:00
8c1a5fb834
fix: remove sysmon definition
...
Removed this definition for now as it's too generic and "obvious"
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2023-02-09 11:01:58 +01:00
a24012b2b5
fix: apply suggestions
2023-02-09 10:41:41 +01:00
b7a3000bb2
fix: update modified date
2023-02-09 10:38:21 +01:00
0c581fb62a
fix: apply suggestions from code review
...
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2023-02-09 10:31:11 +01:00
a175354a6f
fix: add missing modified
2023-02-08 22:10:05 +01:00
814ace9eaf
feat: more updates
2023-02-08 22:08:47 +01:00
c060127e67
fix: remove duplicate title
2023-02-08 20:04:46 +01:00
4bb2beeb15
fix: duplicate ids and small updates
2023-02-08 19:36:55 +01:00
4d1bd7663b
fix: update duplicate title
2023-02-08 19:16:53 +01:00
d78e66dde3
fix: yaml error
2023-02-08 19:14:18 +01:00
0717634671
feat: updates and enhancements
2023-02-08 19:12:35 +01:00
3e75e9022e
Merge branch 'SigmaHQ:master' into registry-rules-update
2023-02-08 18:27:36 +01:00
7676547486
Merge pull request #4023 from phantinuss/master
...
fix: FP found in prod environment
2023-02-08 18:06:53 +01:00
bd1d4825a3
fix: FP found in prod environment
...
Also seen in https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=18
2023-02-08 17:58:35 +01:00
3915224993
Merge pull request #4021 from qasimqlf/patch-29
...
feat: add `OriginalFileName`
2023-02-08 14:44:08 +01:00
8851420b92
feat: update registry_delete rules
2023-02-08 12:48:51 +01:00
6da1431612
fix: added originalfilename
2023-02-08 16:18:58 +05:00
692ad8356a
Merge branch 'registry-rules-update' of https://github.com/nasbench/sigma into registry-rules-update
2023-02-08 11:40:56 +01:00
2885c9352e
Merge pull request #4017 from nasbench/nasbench-rule-devel
...
feat: updates, fixes and enhancements
2023-02-08 10:58:58 +01:00
de7b59c4d1
fix: add missing modified and new selection
2023-02-08 10:37:24 +01:00
518ff956ef
fix: typos and improve wording
...
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2023-02-08 10:29:48 +01:00
Nasreddine Bencherchali