273fdb9985
fix: typos in multiple rules ( #4011 )
2023-02-06 13:53:23 +01:00
7c38a5c496
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
66700a69e2
Merge pull request #3994 from ionsor/patch-8
...
Update proc_creation_lnx_hack_tools.yml
2023-01-31 17:45:11 +01:00
2684f0f63c
fix: remove unnecessary entry
2023-01-31 17:21:42 +01:00
412efdad03
fix: update selection
2023-01-31 17:15:49 +01:00
164ee358c3
fix: update modified date
2023-01-31 17:12:20 +01:00
6a337151d1
feat: apply suggestions from code review
...
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2023-01-31 17:11:18 +01:00
8f6242c35f
Update proc_creation_lnx_hack_tools.yml
...
added to the list of hacking tools, Linpeas, a privilege escalation script
2023-01-31 17:01:17 +01:00
33952874f1
fix: update selection
2023-01-31 14:14:50 +01:00
e158d6c1eb
feat: add shadow file
2023-01-31 12:25:33 +01:00
6a65920dd6
feat: new rules from blackberry
2023-01-31 00:38:06 +01:00
1033b3f404
change status to test
2023-01-27 06:48:34 +01:00
cb67871bd2
Revert "Change status of old rules"
2023-01-26 19:37:18 +01:00
5323fd4baa
Change status of old rules
2023-01-25 18:41:18 +01:00
f7b159350d
Merge pull request #3954 from nasbench/nasbench-rule-devel
...
feat: updates and enhancements
2023-01-25 13:21:44 +01:00
f42eb77f29
fix: rule logic
2023-01-25 12:03:11 +01:00
d47215d469
fix: single element selection
2023-01-25 01:35:47 +01:00
7d2b70cb91
feat: add bpf related rules
2023-01-25 01:14:49 +01:00
0312c481d9
Change rules using all of required-lists to |all
...
When a Sigma rule writer wants to create a list of values where all of
them must be matched for the rule to trigger, the approach used
previously was to have an `all of` condition for a single selector.
However, this has now changed, and the new approach is to use an empty
key and the |all modifier (i.e., `'|all'`).
This commit (tries to) identify all the rules that used the old
approach and modifies them to use the new approach instead.
See SigmaHQ/sigma-specification#53 for further discussion.
2023-01-23 14:37:25 +00:00
1c0bf6e262
feat: update windows firewall rules
2023-01-17 19:01:37 +01:00
85fb255bc9
feat: new rules and updates
2023-01-17 01:00:44 +01:00
e886902374
Update proc_creation_lnx_system_network_connections_discovery.yml
2023-01-13 10:12:10 +01:00
d91a1d0903
filter some legitimate activity
...
Filter landscape-sysinfo tool calling who
2023-01-13 00:47:40 -08:00
15757c2b7d
fix: remove tactic links
2023-01-10 19:20:31 +01:00
4023bf2c83
Remove mitre url
2023-01-10 18:09:04 +01:00
d6059d801b
Filename normalisation
2023-01-07 08:52:11 +01:00
ea4b844c8e
fix: broken selections
2023-01-06 17:28:29 +01:00
7e73028c5e
feat: updates and enhancements
2023-01-06 16:35:34 +01:00
39d4b577a1
Merge pull request #3872 from frack113/linux_order
...
order linux file
2023-01-05 10:18:53 +01:00
379fa4f3df
Update modified
2023-01-05 09:11:49 +01:00
a499c7076d
fix Image field
...
On Linux git has no .exe extension
2023-01-05 09:47:11 +02:00
01e7adeb30
order linux file
2023-01-05 08:14:19 +01:00
d8b8cf04bd
fix: wrong fp
2023-01-04 18:38:04 +01:00
2b04519923
fix: unique item list
2023-01-04 18:26:59 +01:00
711ba956e3
feat: updates and enhancements
2023-01-04 17:49:32 +01:00
b6426ab3f9
Fix file name
2022-12-31 18:23:37 +01:00
c2ce5d01fc
Add sysmon linux v1.0.2
2022-12-31 18:08:11 +01:00
ddb5cd0ead
Add sysmon linux v1.0.2
2022-12-31 18:04:21 +01:00
73f56c2f0e
Hidden Linux Binary Execution ( #3108 )
...
Co-authored-by: Florian Roth <venom14@gmail.com >
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com >
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2022-12-31 08:27:32 +01:00
425c29cf1c
feat: add new linux rules
2022-12-29 11:17:42 +01:00
85aa0220d0
Merge pull request #3819 from blueteam0ps/master
...
lnx_auditd_debugfs_usage.yml
2022-12-27 16:57:22 +01:00
0d2ddb4a9b
fix: small selection fix for clarity
2022-12-27 16:23:09 +01:00
256d6a839e
fix: update condition
...
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2022-12-27 16:13:56 +01:00
281dc11fc5
fix: remove correlation
2022-12-27 15:31:51 +01:00
7060db3d47
Promotion rules ( #3821 )
...
* Promotion rules
* fix missing null
* fix: modified date
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com >
2022-12-27 12:29:10 +01:00
2d759cad94
Add rule delete group or user ( #3822 )
...
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com >
2022-12-27 11:21:14 +01:00
1d8256fa69
Update lnx_auditd_debugfs_usage.yml
2022-12-25 09:47:19 +11:00
81d8d1a5a7
replaced timeframe with timespan
2022-12-25 08:10:03 +11:00
976d994cee
Updated to include additional tools
...
Expanded the list of Linux tools that may be used to obtain volume meta info and also included the auditd.
Removed specific switches for tools as those tools and debugfs exec within that time period will be rare.
2022-12-25 07:57:18 +11:00
de84fbcd62
lnx_auditd_debugfs_usage.yml
2022-12-24 23:41:20 +11:00
Wagga