2ef681291a
feat: more rules updates
2023-02-14 19:30:18 +01:00
4f59a13d46
feat: update wmic rules
2023-02-14 19:30:18 +01:00
d9d9227910
feat: new rule related to CVE-2022-21587 ( #4037 )
2023-02-14 14:30:12 +01:00
a79abaaf45
Merge pull request #4033 from qasimqlf/patch-32
...
feat: add missing `OriginalFileName` field
2023-02-13 14:48:10 +01:00
1adec45ca6
fix: add OriginalFileName ( #4032 )
2023-02-13 14:40:54 +01:00
ab611c29ba
fix: updated condition ( #4031 )
2023-02-13 14:37:33 +01:00
7b435afa4d
feat: add missing OriginalFileName field
2023-02-11 23:04:18 +05:00
095b41370f
Merge pull request #4027 from nasbench/nasbench-rule-devel
...
feat: updates and enhancements
2023-02-10 10:59:14 +01:00
1d89b041ae
fix: change title from domain to wbesites
2023-02-10 10:49:52 +01:00
5e3aae4970
fix: apply suggestions from code review
...
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2023-02-10 10:38:45 +01:00
82d0b9e10c
fix: add missing modified and improve test
2023-02-10 00:56:07 +01:00
5f6258fe57
fix: add missing modified
2023-02-10 00:48:13 +01:00
82cde0e10c
feat: update rules related to onenote and more
2023-02-10 00:40:16 +01:00
bea7614718
Remove Trailing space
...
The trailing space causes this rule not to trigger when the extension is used (cmd.exe), eg:
CommandLine: "C:\Windows\system32\cmd.exe" /r < "C:\Users\Administrator\desktop\test.txt"
2023-02-09 18:07:56 -05:00
c4d8be3780
fix: duplicate titles
2023-02-09 16:06:09 +01:00
da012ad80d
fix: resolves #4014
2023-02-09 15:48:13 +01:00
c8c32bf1d4
feat: add missing OriginalFileName field ( #4026 )
...
Add missing 'rundll32' OriginalFileName field to some process creation rules
2023-02-09 15:09:23 +01:00
ba80fc1372
Merge pull request #4024 from nasbench/nasbench-rule-devel
...
feat: updates and enhancements
2023-02-09 14:50:04 +01:00
9ddedc8958
fix: add fp filter
2023-02-09 14:27:12 +01:00
288914fe42
Add common childprocess filter for OneNote
...
Slight reoranization of the rule with an additional relevant reference.
Additionally adds the `filter_common_childproc` filter to
`proc_creation_win_susp_microsoft_onenote_child_process.yml` for common
processes that are launched from OneNote. OneNote will commonly launch
`Teams.exe -Embedded` for opening documents in Teams, as well as
`FileCoAuth.exe` when people are sharing/editing specific documents
through OneNote. For some organizations these can create enough noise
that it may be warranted to filter out as a part of the rule. Thusfar
malicious execution for `Teams.exe` and `FileCoAuth.exe` have not been
observed.
2023-02-09 14:20:22 +01:00
6d14a14f9e
fix: typos
...
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2023-02-09 13:09:46 +01:00
8c1a5fb834
fix: remove sysmon definition
...
Removed this definition for now as it's too generic and "obvious"
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2023-02-09 11:01:58 +01:00
a24012b2b5
fix: apply suggestions
2023-02-09 10:41:41 +01:00
b7a3000bb2
fix: update modified date
2023-02-09 10:38:21 +01:00
0c581fb62a
fix: apply suggestions from code review
...
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2023-02-09 10:31:11 +01:00
a175354a6f
fix: add missing modified
2023-02-08 22:10:05 +01:00
814ace9eaf
feat: more updates
2023-02-08 22:08:47 +01:00
c060127e67
fix: remove duplicate title
2023-02-08 20:04:46 +01:00
4bb2beeb15
fix: duplicate ids and small updates
2023-02-08 19:36:55 +01:00
4d1bd7663b
fix: update duplicate title
2023-02-08 19:16:53 +01:00
d78e66dde3
fix: yaml error
2023-02-08 19:14:18 +01:00
0717634671
feat: updates and enhancements
2023-02-08 19:12:35 +01:00
3e75e9022e
Merge branch 'SigmaHQ:master' into registry-rules-update
2023-02-08 18:27:36 +01:00
bd1d4825a3
fix: FP found in prod environment
...
Also seen in https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=18
2023-02-08 17:58:35 +01:00
8851420b92
feat: update registry_delete rules
2023-02-08 12:48:51 +01:00
6da1431612
fix: added originalfilename
2023-02-08 16:18:58 +05:00
692ad8356a
Merge branch 'registry-rules-update' of https://github.com/nasbench/sigma into registry-rules-update
2023-02-08 11:40:56 +01:00
de7b59c4d1
fix: add missing modified and new selection
2023-02-08 10:37:24 +01:00
518ff956ef
fix: typos and improve wording
...
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2023-02-08 10:29:48 +01:00
3ec159a400
feat: update registry_add rules
2023-02-08 00:37:22 +01:00
75df97b4bc
fix: apply suggestions from code review
2023-02-07 18:44:26 +01:00
9e7d7510db
fix: remove duplicate uuid
2023-02-07 17:22:02 +01:00
5fd152cd51
feat: more updates
2023-02-07 17:12:26 +01:00
b662042405
Merge branch 'SigmaHQ:master' into nasbench-rule-devel
2023-02-07 16:02:28 +01:00
2938a3fdb5
chore: minor stylistic changes to selection names
2023-02-07 16:01:42 +01:00
0dd23365ad
fix: fp found in test dataset
2023-02-07 14:49:42 +01:00
a19a75b0b0
fix: resolves #4015
2023-02-07 14:33:56 +01:00
d187470c38
Merge pull request #3960 from tropChaud/patch-3
...
Create proc_creation_win_wmic_system_info_discovery.yml
2023-02-07 14:24:12 +01:00
a7a4bce9b8
feat: update and enhancements
2023-02-07 13:55:14 +01:00
dc2d2f9d6d
fix: update title
2023-02-06 14:03:37 +01:00
Nasreddine Bencherchali