28953a2942
fix: MITRE tags in rule
2020-03-25 18:11:04 +01:00
6584729a0d
rule: powershell downloadfile
2020-03-25 14:58:14 +01:00
35e43db7a7
fix: converted CRLF line break to LF
2020-03-25 14:36:34 +01:00
17297193c7
Merge branch 'master' into devel
2020-03-25 14:18:11 +01:00
50b0d04ee8
rule: Exploited CVE-2020-10189 Zoho ManageEngine
2020-03-25 14:02:53 +01:00
28d8b87a0f
rule: extended web shell spawn rule
2020-03-25 14:02:39 +01:00
c10332b06c
Merge pull request #663 from neu5ron/updates_sigmac_and_rules
...
Updates sigmac and rules
2020-03-22 00:22:31 +01:00
6040b1f1f8
Merge pull request #668 from Neo23x0/devel
...
Devel
2020-03-19 18:36:31 +01:00
8454f60a8e
fix: reduced level due to false positives
2020-03-17 20:40:28 +01:00
4c94906d53
rule should be wildcard AND had a prepended ^ in one of the CommandLine conditions that would have caused to not trigger
2020-03-14 15:00:42 -04:00
cbf0f43934
Merge pull request #655 from msec1203/msec1203-patch-1
...
add rule for suspicious use of csharp console by scripting utility
2020-03-09 18:01:12 +01:00
6845fa21b3
fix: fixed several issues
2020-03-09 17:43:16 +01:00
ddefb3bc58
Merge branch 'master' into devel
2020-03-07 11:06:25 +01:00
b9e4734087
fix sysmon registry rules with HKLM/HKU format as used since 02/2017 in sysmon
2020-03-04 12:47:42 -05:00
6bbb166f3d
rule: extended webshell rule with tomcat.exe
2020-03-04 14:25:57 +01:00
53278c2a46
Merge pull request #649 from Neo23x0/devel
...
fix: avoiding FPs with Citrix software
2020-03-03 11:35:02 +01:00
f98ad7a8df
fix: wrong identifier
2020-03-03 11:25:02 +01:00
be4242aca8
fix avoiding FPs with MpCmdRun
...
ParentImage: C:\Windows\System32\services.exe
CommandLine: C:\Program Files\Microsoft Security Client\\MpCmdRun.exe
2020-03-03 11:16:59 +01:00
b63889af75
Fixed rules that likely will cause false negatives by fix
2020-03-01 23:14:53 +01:00
0a62b8747e
Merge pull request #634 from EccoTheFlintstone/fp_fix3
...
Rule: restore initial behaviour matching single word with spaces on each side
2020-03-01 22:40:24 +01:00
ada0edb822
Merge pull request #621 from wagga40/new_koadic_rule
...
New Koadic detection rule
2020-02-26 13:25:03 +01:00
0ba6874645
Merge pull request #638 from Neo23x0/devel
...
Several false positives with new rules
2020-02-26 09:46:02 +01:00
1c90d6badd
level increased
2020-02-26 09:42:31 +01:00
c8afd4a16b
Merge pull request #637 from tjgeorgen/patch-1
...
fix missing status & description in status field
2020-02-26 09:40:55 +01:00
4f3e3166d3
fixing false positives
2020-02-26 09:33:55 +01:00
74f3fe70cc
fix missing status & description in status field
2020-02-25 16:30:41 -05:00
3247d5692a
wmiprvse subprocess: add fallback check on username instead of only logonid
2020-02-24 09:25:20 -05:00
df7356e829
Rule: restore initial behaviour matching single word with spaces on each side
2020-02-24 08:00:06 -05:00
aa1eff5419
fix FP on rmdir matching dir
2020-02-24 05:23:23 -05:00
bfab143c7c
Merge pull request #632 from EccoTheFlintstone/fp_fix
...
fix false positive on taskkill.exe not related to service stop at all
2020-02-24 09:58:33 +01:00
f807dae69a
fix false positive on taskkill.exe not related to service stop at all
2020-02-24 03:03:46 -05:00
1703b725d3
fix non ascii character in rule
2020-02-24 02:58:34 -05:00
48d95f027c
Merge branch 'oscd'
2020-02-20 23:11:57 +01:00
373424f145
Rule fixes
...
Made tests pass the new CI tests. Added further allowed lower case words
in rule test.
2020-02-20 23:00:16 +01:00
6413730810
fix: fixing too restrictive rule
...
https://twitter.com/Hexacorn/status/1229702521679118336
2020-02-18 10:43:22 +01:00
04b97bd84c
fix: character in filename
2020-02-18 10:19:48 +01:00
cd607d4fed
rule: process dump via rundll32 and comsvcs.dll's MiniDumpW
2020-02-18 10:04:55 +01:00
73dfc847fc
rule: changed lsass process dump to level high
2020-02-18 10:03:25 +01:00
b9c745a1b2
New Koadic detection rule
2020-02-16 16:48:49 +01:00
d0e284ae18
fix typo (duplicates)
2020-02-16 18:19:25 +03:00
f118839664
Further fixes and deduplications
...
From suggestions of @yugoslavskiy in issue #554 .
2020-02-16 14:03:07 +01:00
77c927bc14
Revert "Moved rules with enrichments into unsupported"
...
This reverts commit ba83b8862a
2020-02-15 22:52:06 +01:00
080532d20c
logsource change
...
I've swapped the lines in the logsource section to make it clearer that the category "process_creation" covers all sources that generate process creation logs on the windows platform.
2020-02-07 15:47:27 +01:00
f70f847524
additional gallium ttp
...
sha1 process creation only makes sense for sysmon
2020-02-07 14:08:40 +00:00
7fdd6f7bce
Swapped accidental deletion of older rule duplicate
2020-02-06 23:41:05 +01:00
d7bd90cb24
Merge branch 'master' into oscd
2020-02-03 23:13:16 +01:00
f7394d09e0
Deduplication
2020-02-03 22:41:55 +01:00
815c562a17
Merge branch 'master' into oscd
2020-02-02 13:40:08 +01:00
ba83b8862a
Moved rules with enrichments into unsupported
2020-02-02 12:46:03 +01:00
593abb1cce
OSCD QA wave 3
2020-02-02 12:41:12 +01:00
Florian Roth