 Mark Morowczynski
|
375eeab4fa
|
Update azure_app_ropc_authentication.yml
|
2022-06-01 08:42:44 -07:00 |
|
|
Mark Morowczynski
|
fe64f81674
|
Create azure_app_ropc_authentication.yml
Adding ROPC Auth check
|
2022-06-01 08:41:43 -07:00 |
|
|
frack113
|
32e6a82cf2
|
Update azure_app_credential_added.yml
|
2022-05-27 06:56:07 +02:00 |
|
|
Mark Morowczynski
|
4f044ea760
|
Merge branch 'SigmaHQ:master' into markmorow
|
2022-05-26 12:38:05 -07:00 |
|
|
Mark Morowczynski
|
5229c05cab
|
Update azure_app_credential_added.yml
Changes based on Sigma template rules
|
2022-05-26 12:36:38 -07:00 |
|
|
frack113
|
dbcb0164ab
|
Merge pull request #3051 from frack113/mittre
Mitre tag change
|
2022-05-26 18:52:41 +02:00 |
|
|
frack113
|
b9a0c7e437
|
Mitre Update
|
2022-05-26 18:39:42 +02:00 |
|
|
Mark Morowczynski
|
97efeada5f
|
Update .gitignore
|
2022-05-26 09:39:00 -07:00 |
|
|
Mark Morowczynski
|
34d06708e5
|
Create azure_app_credential_added.yml
App Credential Add rule
|
2022-05-25 19:13:26 -07:00 |
|
|
phantinuss
|
b80eb411ab
|
Merge pull request #3032 from frack113/lolbin_20220522
Add lolbas cl script
|
2022-05-25 12:02:44 +02:00 |
|
|
phantinuss
|
e475deaf4d
|
Update proc_creation_win_lolbas_cl_mutexverifiers.yml
|
2022-05-25 11:56:52 +02:00 |
|
|
phantinuss
|
3bdf29033a
|
Update proc_creation_win_lolbas_cl_loadassembly.yml
|
2022-05-25 11:55:37 +02:00 |
|
|
frack113
|
f737ba6e95
|
Fix duplicate cast
|
2022-05-25 11:19:09 +02:00 |
|
|
Nasreddine Bencherchali
|
c3d807f53a
|
Add More Malicious PowerShell Script/Cmdlet Names
|
2022-05-24 22:02:08 +01:00 |
|
|
Florian Roth
|
c7b90f108f
|
Merge pull request #3039 from jstnk9/master
New sigma rule to detect the use of Jlaive antivirus defense evasion
|
2022-05-24 20:25:42 +02:00 |
|
|
Florian Roth
|
a6202f7961
|
Merge pull request #3041 from SigmaHQ/rule-devel
refactor: old rule additions, rule: new powershell rules
|
2022-05-24 20:24:42 +02:00 |
|
|
Florian Roth
|
4b100116d4
|
Merge pull request #3031 from CD-R0M/master
Create proc_creation_win_rundll32_parent_explorer.yml
|
2022-05-24 20:19:11 +02:00 |
|
|
Florian Roth
|
0e62d5b204
|
fix: bugs in rules
|
2022-05-24 20:18:41 +02:00 |
|
|
zakibro
|
7a33aac1ed
|
Update lnx_auditd_keylogging_with_pam_d.yml
adding missing uuid
|
2022-05-24 17:15:54 +02:00 |
|
|
zakibro
|
89d88288d6
|
New detection - Linux Keylogging
|
2022-05-24 17:05:38 +02:00 |
|
|
Florian Roth
|
37cef9b153
|
rule: PowerShell obfuscate Net.WebClient
|
2022-05-24 15:20:21 +02:00 |
|
|
Florian Roth
|
642a334d9e
|
rule: suspicious PowerShell encoded command patterns
|
2022-05-24 15:20:01 +02:00 |
|
|
Florian Roth
|
a296bfe667
|
rule: suspicious anydesk start location
|
2022-05-24 15:19:45 +02:00 |
|
|
Florian Roth
|
9d11505aa8
|
refactor: rule additions
|
2022-05-24 15:19:25 +02:00 |
|
|
jstnk9
|
6f1602d243
|
New sigma rule to detect the use of Jlaive antivirus defense evasion
|
2022-05-24 02:40:08 +02:00 |
|
|
Tim Shelton
|
0fb943dc2c
|
FP: fixing modifier
|
2022-05-23 21:43:43 +00:00 |
|
|
Tim Shelton
|
c807191ab7
|
FP: filtering out Amaazon AWS header
|
2022-05-23 21:41:13 +00:00 |
|
|
CD-R0M
|
87de0d39db
|
Update proc_creation_win_rundll32_parent_explorer.yml
|
2022-05-23 16:49:40 -04:00 |
|
|
phantinuss
|
61c10d73e0
|
fix: FP found in testing environment
|
2022-05-23 16:45:27 +02:00 |
|
|
CD-R0M
|
9c26e12358
|
Update proc_creation_win_rundll32_parent_explorer.yml
|
2022-05-22 15:23:25 -04:00 |
|
|
CD-R0M
|
e9976bc3db
|
Update proc_creation_win_rundll32_parent_explorer.yml
|
2022-05-22 15:21:41 -04:00 |
|
|
frack113
|
03b304e6c4
|
Add lolbas cl script
|
2022-05-22 12:33:09 +02:00 |
|
|
CD-R0M
|
1e728d9598
|
Create proc_creation_win_rundll32_parent_explorer.yml
|
2022-05-21 17:07:31 -04:00 |
|
|
Florian Roth
|
bea6f18d35
|
Merge pull request #3024 from redsand/win_system_susp_eventlog_cleared
Making a derived detection for system/application/security event logs…
|
2022-05-20 20:56:00 +02:00 |
|
|
Florian Roth
|
946e4582a3
|
Merge pull request #3030 from SigmaHQ/aurora-false-positive-fixing
fix: detection with Windows Defender
|
2022-05-20 20:05:43 +02:00 |
|
|
Florian Roth
|
e86d007d35
|
Merge pull request #3027 from elhoim/rename_suspicious
Renamed suspicious in filenames to susp
|
2022-05-20 19:28:24 +02:00 |
|
|
Florian Roth
|
e8f59c8d0f
|
fix: detection with Windows Defender
|
2022-05-20 19:27:48 +02:00 |
|
|
MatilJ
|
10f0a82b94
|
Fix detection
|
2022-05-19 21:09:47 +03:00 |
|
|
Tim Shelton
|
600a7cd0e8
|
Re-adding accidently removed entry
|
2022-05-19 17:16:39 +00:00 |
|
|
Tim Shelton
|
60e6a147b4
|
merging remote change
|
2022-05-19 16:11:58 +00:00 |
|
|
Tim Shelton
|
3f6cabcae8
|
Updating to include match on Channel
|
2022-05-19 16:08:34 +00:00 |
|
|
David ANDRE
|
74b9f97b9c
|
Renamed suspicious in filenames to susp
|
2022-05-19 09:37:04 +02:00 |
|
|
Florian Roth
|
003e5bee6d
|
Merge pull request #3018 from SigmaHQ/rule-devel
refactor: rule addition
|
2022-05-19 07:50:36 +02:00 |
|
|
Florian Roth
|
3fe86e3b84
|
rule: grpconv execution
|
2022-05-18 17:56:26 +02:00 |
|
|
Florian Roth
|
04a3dfeb01
|
Merge pull request #3025 from nasbench/master
Quick Updates and Fixes
|
2022-05-18 17:35:18 +02:00 |
|
|
Florian Roth
|
7d296ef078
|
fix: change on deleted rule
|
2022-05-18 17:34:39 +02:00 |
|
|
Florian Roth
|
99e81ea2eb
|
Merge branch 'pr/3023'
|
2022-05-18 17:33:10 +02:00 |
|
|
Florian Roth
|
a55e8f2ac1
|
refactor: PoSh Defender Tampering
|
2022-05-18 17:29:38 +02:00 |
|
|
Florian Roth
|
15cee5c0b1
|
Update proc_creation_win_susp_taskkill.yml
|
2022-05-18 17:28:26 +02:00 |
|
|
frack113
|
d620f11e84
|
Merge pull request #3021 from redsand/fix_err_in_assignment
User meant to use service vs category. currently no category assignme…
|
2022-05-18 17:16:30 +02:00 |
|