 Mark Morowczynski
|
375eeab4fa
|
Update azure_app_ropc_authentication.yml
|
2022-06-01 08:42:44 -07:00 |
|
|
Mark Morowczynski
|
fe64f81674
|
Create azure_app_ropc_authentication.yml
Adding ROPC Auth check
|
2022-06-01 08:41:43 -07:00 |
|
|
frack113
|
32e6a82cf2
|
Update azure_app_credential_added.yml
|
2022-05-27 06:56:07 +02:00 |
|
|
Mark Morowczynski
|
4f044ea760
|
Merge branch 'SigmaHQ:master' into markmorow
|
2022-05-26 12:38:05 -07:00 |
|
|
Mark Morowczynski
|
5229c05cab
|
Update azure_app_credential_added.yml
Changes based on Sigma template rules
|
2022-05-26 12:36:38 -07:00 |
|
|
frack113
|
dbcb0164ab
|
Merge pull request #3051 from frack113/mittre
Mitre tag change
|
2022-05-26 18:52:41 +02:00 |
|
|
Mark Morowczynski
|
8f9998d804
|
Merge branch 'SigmaHQ:master' into markmorow
|
2022-05-26 09:41:17 -07:00 |
|
|
frack113
|
b9a0c7e437
|
Mitre Update
|
2022-05-26 18:39:42 +02:00 |
|
|
Mark Morowczynski
|
97efeada5f
|
Update .gitignore
|
2022-05-26 09:39:00 -07:00 |
|
|
frack113
|
195be1b3d8
|
Merge pull request #3047 from redsand/feat_tool_to_generate_diff
Feat. adds helper script to run sigmac against only those rules that …
|
2022-05-26 18:29:15 +02:00 |
|
|
Mark Morowczynski
|
68836f3050
|
Update .gitignore
|
2022-05-25 19:59:00 -07:00 |
|
|
Mark Morowczynski
|
443e6e2d8e
|
Revert "Update .gitignore"
This reverts commit 46808867b1.
|
2022-05-25 19:38:48 -07:00 |
|
|
Mark Morowczynski
|
46808867b1
|
Update .gitignore
|
2022-05-25 19:20:17 -07:00 |
|
|
Mark Morowczynski
|
34d06708e5
|
Create azure_app_credential_added.yml
App Credential Add rule
|
2022-05-25 19:13:26 -07:00 |
|
|
Tim Shelton
|
2317d6c146
|
Feat. adds helper script to run sigmac against only those rules that changed
|
2022-05-25 15:43:59 +00:00 |
|
|
phantinuss
|
b80eb411ab
|
Merge pull request #3032 from frack113/lolbin_20220522
Add lolbas cl script
|
2022-05-25 12:02:44 +02:00 |
|
|
phantinuss
|
e475deaf4d
|
Update proc_creation_win_lolbas_cl_mutexverifiers.yml
|
2022-05-25 11:56:52 +02:00 |
|
|
phantinuss
|
3bdf29033a
|
Update proc_creation_win_lolbas_cl_loadassembly.yml
|
2022-05-25 11:55:37 +02:00 |
|
|
phantinuss
|
0685a71fca
|
Merge pull request #3046 from frack113/fix_cast
Fix duplicate cast
|
2022-05-25 11:50:58 +02:00 |
|
|
frack113
|
f737ba6e95
|
Fix duplicate cast
|
2022-05-25 11:19:09 +02:00 |
|
|
frack113
|
9d5587cf65
|
Merge pull request #3043 from nasbench/master
Add More Malicious PowerShell Script/Cmdlet Names
|
2022-05-25 06:32:07 +02:00 |
|
|
Nasreddine Bencherchali
|
c3d807f53a
|
Add More Malicious PowerShell Script/Cmdlet Names
|
2022-05-24 22:02:08 +01:00 |
|
|
Florian Roth
|
c7b90f108f
|
Merge pull request #3039 from jstnk9/master
New sigma rule to detect the use of Jlaive antivirus defense evasion
|
2022-05-24 20:25:42 +02:00 |
|
|
Florian Roth
|
a6202f7961
|
Merge pull request #3041 from SigmaHQ/rule-devel
refactor: old rule additions, rule: new powershell rules
|
2022-05-24 20:24:42 +02:00 |
|
|
Florian Roth
|
4b100116d4
|
Merge pull request #3031 from CD-R0M/master
Create proc_creation_win_rundll32_parent_explorer.yml
|
2022-05-24 20:19:11 +02:00 |
|
|
Florian Roth
|
0e62d5b204
|
fix: bugs in rules
|
2022-05-24 20:18:41 +02:00 |
|
|
Florian Roth
|
246d53854d
|
Merge pull request #3042 from zakibro/master
New detection - Linux Keylogging
|
2022-05-24 19:49:38 +02:00 |
|
|
zakibro
|
7a33aac1ed
|
Update lnx_auditd_keylogging_with_pam_d.yml
adding missing uuid
|
2022-05-24 17:15:54 +02:00 |
|
|
zakibro
|
89d88288d6
|
New detection - Linux Keylogging
|
2022-05-24 17:05:38 +02:00 |
|
|
Florian Roth
|
37cef9b153
|
rule: PowerShell obfuscate Net.WebClient
|
2022-05-24 15:20:21 +02:00 |
|
|
Florian Roth
|
642a334d9e
|
rule: suspicious PowerShell encoded command patterns
|
2022-05-24 15:20:01 +02:00 |
|
|
Florian Roth
|
a296bfe667
|
rule: suspicious anydesk start location
|
2022-05-24 15:19:45 +02:00 |
|
|
Florian Roth
|
9d11505aa8
|
refactor: rule additions
|
2022-05-24 15:19:25 +02:00 |
|
|
Florian Roth
|
662c13a720
|
Merge pull request #3035 from redsand/hawk_backend_cfg_update
Backend: adding additional entries to hawk.yml
|
2022-05-24 12:33:11 +02:00 |
|
|
Florian Roth
|
522eb09635
|
Merge pull request #3037 from redsand/fp_powershell_ps_access_win_api
FP: filtering out Amaazon AWS header
|
2022-05-24 12:32:58 +02:00 |
|
|
Florian Roth
|
3b360544a5
|
Merge pull request #3038 from redsand/hawk_backend_sys_update
Backend: because hawk splits up SYSTEM and NT AUTHORITY, additional t…
|
2022-05-24 12:32:34 +02:00 |
|
|
phantinuss
|
657e235420
|
Merge pull request #3040 from pH-T/master
added 'similar' related type to test_rules script
|
2022-05-24 11:11:37 +02:00 |
|
|
Paul Hager
|
9b80dd990a
|
added 'similar' related type
|
2022-05-24 09:51:48 +02:00 |
|
|
jstnk9
|
6f1602d243
|
New sigma rule to detect the use of Jlaive antivirus defense evasion
|
2022-05-24 02:40:08 +02:00 |
|
|
Tim Shelton
|
b339901806
|
Backend: because hawk splits up SYSTEM and NT AUTHORITY, additional treatment is needed on some rules
|
2022-05-23 23:52:52 +00:00 |
|
|
Tim Shelton
|
0fb943dc2c
|
FP: fixing modifier
|
2022-05-23 21:43:43 +00:00 |
|
|
Tim Shelton
|
c807191ab7
|
FP: filtering out Amaazon AWS header
|
2022-05-23 21:41:13 +00:00 |
|
|
Tim Shelton
|
6ca03d741b
|
adding additional file hash column translation
|
2022-05-23 21:11:34 +00:00 |
|
|
CD-R0M
|
87de0d39db
|
Update proc_creation_win_rundll32_parent_explorer.yml
|
2022-05-23 16:49:40 -04:00 |
|
|
Tim Shelton
|
605a0bc678
|
Backend: adding additional entries to hawk.yml
|
2022-05-23 18:46:50 +00:00 |
|
|
Florian Roth
|
25edbeca69
|
Merge pull request #3034 from phantinuss/master
fix: FP found in testing environment
|
2022-05-23 17:18:25 +02:00 |
|
|
phantinuss
|
61c10d73e0
|
fix: FP found in testing environment
|
2022-05-23 16:45:27 +02:00 |
|
|
Florian Roth
|
0053a35328
|
Merge pull request #3033 from martinspielmann/patch-1
Fix typo
|
2022-05-23 11:20:16 +02:00 |
|
|
Martin
|
86d11e62e8
|
Fix typo
|
2022-05-23 10:50:59 +02:00 |
|
|
CD-R0M
|
9c26e12358
|
Update proc_creation_win_rundll32_parent_explorer.yml
|
2022-05-22 15:23:25 -04:00 |
|