 remotephone@gmail.com
|
4486c3ffc9
|
adding new line at end of file
|
2020-10-07 22:11:05 -05:00 |
|
|
remotephone@gmail.com
|
cde0020d30
|
T1016 detection rules
|
2020-10-07 22:09:15 -05:00 |
|
|
Yugoslavskiy Daniil
|
185a634bd9
|
update authors for 2 rules
|
2019-12-07 02:10:06 +01:00 |
|
|
Yugoslavskiy Daniil
|
4789b15fd5
|
add rules by Sergey Soldatov, Kaspersky Lab
|
2019-12-07 01:45:55 +01:00 |
|
|
yugoslavskiy
|
edad1695f6
|
Merge branch 'oscd' of https://github.com/mrblacyk/sigma into mrblacyk-oscd
|
2019-12-02 02:56:53 +01:00 |
|
|
yugoslavskiy
|
48a94d1609
|
Update lnx_dd_delete_file.yml
|
2019-12-02 02:54:48 +01:00 |
|
|
yugoslavskiy
|
ca1c2f4436
|
Update lnx_chattr_immutable_removal.yml
|
2019-12-02 02:54:32 +01:00 |
|
|
yugoslavskiy
|
9e90335a5a
|
Update lnx_pers_systemd_reload.yml
|
2019-12-02 02:54:13 +01:00 |
|
|
yugoslavskiy
|
46ca68436e
|
Update lnx_file_or_folder_permissions.yml
|
2019-12-02 02:53:35 +01:00 |
|
|
yugoslavskiy
|
1273a10dcb
|
add win_new_service_creation.yml
|
2019-12-02 01:19:54 +01:00 |
|
|
yugoslavskiy
|
9fba097421
|
add sysmon_in_memory_powershell.yml by Tom Kern
|
2019-12-01 23:26:00 +01:00 |
|
|
mrblacyk
|
9d0889def4
|
Adding auditd compatibility
|
2019-11-29 09:34:08 +01:00 |
|
|
mrblacyk
|
cafbb25d2e
|
Update lnx_file_or_folder_permissions.yml
|
2019-11-29 09:33:04 +01:00 |
|
|
mrblacyk
|
bf5e6cc56b
|
Adding auditd compatibility
|
2019-11-29 09:32:05 +01:00 |
|
|
mrblacyk
|
a15c84eb80
|
Adding auditd compatibility
|
2019-11-29 09:27:31 +01:00 |
|
|
Yugoslavskiy Daniil
|
71e588cae1
|
add apt silence rules by Group-IB
|
2019-11-28 21:15:55 +01:00 |
|
|
yugoslavskiy
|
d5722979ea
|
add rules by Daniel Bohannon
|
2019-11-27 00:02:45 +01:00 |
|
|
yugoslavskiy
|
41a09cde34
|
updated filenames
|
2019-11-26 23:31:18 +01:00 |
|
|
yugoslavskiy
|
1b591ee598
|
add JET CSIRT team sysmon_process_reimaging.yml with unsupported logic
|
2019-11-19 02:17:07 +01:00 |
|
|
yugoslavskiy
|
2a33e6fed9
|
unify location of rules with unsupported logic
|
2019-11-19 02:12:22 +01:00 |
|
|
yugoslavskiy
|
efc404fbae
|
resolve conflicts with rule IDs; restored and deprecated sysmon_mimikatz_detection_lsass.yml
|
2019-11-19 02:11:19 +01:00 |
|
|
Florian Roth
|
2c855be9d3
|
fix: casing fix in renamed procdump rule
|
2019-11-18 15:57:14 +01:00 |
|
|
Florian Roth
|
fdc32889a7
|
rule: PulseSecure CVE-2019-11510 attack
|
2019-11-18 15:33:58 +01:00 |
|
|
Florian Roth
|
93f890b31d
|
rule: renamed procdump
|
2019-11-18 15:27:04 +01:00 |
|
|
Florian Roth
|
da05c9bb82
|
fix: line break in description
|
2019-11-18 15:26:55 +01:00 |
|
|
Florian Roth
|
2c54d1afe4
|
rule: removed Zebrocy rule because it doesn't work that way
reason: command line gets split up at the '&' character, which results in two command lines
|
2019-11-18 11:42:38 +01:00 |
|
|
Florian Roth
|
04288771a1
|
fix: bugfix in RottenPotato rule - wrong identifier
|
2019-11-15 11:50:03 +01:00 |
|
|
Florian Roth
|
7e6031705e
|
rule: RottenPotato attack pattern
|
2019-11-15 11:44:18 +01:00 |
|
|
Florian Roth
|
ff3ed04405
|
rule: Exploiting SetupComplete.cmd CVE-2019-1378
|
2019-11-15 00:26:18 +01:00 |
|
|
Florian Roth
|
2b7699cc15
|
fix: fixed broken condition
|
2019-11-14 10:15:18 +01:00 |
|
|
Florian Roth
|
95a8563606
|
Rule: suspicious msiexec directory
|
2019-11-14 09:51:55 +01:00 |
|
|
yugoslavskiy
|
ac21810d7a
|
Merge pull request #516 from yugoslavskiy/oscd_task_#2_credentials_dumping
oscd task #2 completed
|
2019-11-14 01:03:27 +03:00 |
|
|
yugoslavskiy
|
1cc9ddc8b8
|
Update win_dumping_ntdsdit_via_netsync.yml
|
2019-11-14 01:00:28 +03:00 |
|
|
yugoslavskiy
|
d29941b414
|
Update win_dumping_ntdsdit_via_dcsync.yml
|
2019-11-14 00:59:38 +03:00 |
|
|
yugoslavskiy
|
01ed5a7135
|
Update sysmon_unsigned_image_loaded_into_lsass.yml
|
2019-11-14 00:58:39 +03:00 |
|
|
yugoslavskiy
|
20a5c9498c
|
Update sysmon_raw_disk_access_using_illegitimate_tools.yml
|
2019-11-14 00:58:00 +03:00 |
|
|
yugoslavskiy
|
4b8873b706
|
Update sysmon_lsass_memory_dump_file_creation.yml
|
2019-11-14 00:55:20 +03:00 |
|
|
yugoslavskiy
|
f0cce60a2c
|
Update sysmon_cred_dump_tools_dropped_files.yml
|
2019-11-14 00:53:25 +03:00 |
|
|
yugoslavskiy
|
9b9f37715f
|
Update process_creation_shadow_copies_deletion.yml
|
2019-11-14 00:50:10 +03:00 |
|
|
yugoslavskiy
|
a1831bb503
|
Update process_creation_shadow_copies_creation.yml
|
2019-11-14 00:48:50 +03:00 |
|
|
yugoslavskiy
|
1445589839
|
Update process_creation_copying_sensitive_files_with_credential_data.yml
|
2019-11-14 00:47:14 +03:00 |
|
|
yugoslavskiy
|
c7c29a39b6
|
Update win_susp_lsass_dump_generic.yml
|
2019-11-14 00:45:47 +03:00 |
|
|
yugoslavskiy
|
633c6db254
|
Update win_remote_registry_management_using_reg_utility.yml
|
2019-11-14 00:44:47 +03:00 |
|
|
yugoslavskiy
|
cd31354df2
|
Update win_quarkspwdump_clearing_hive_access_history.yml
|
2019-11-14 00:43:56 +03:00 |
|
|
yugoslavskiy
|
334626168c
|
Update win_mal_service_installs.yml
|
2019-11-14 00:43:03 +03:00 |
|
|
yugoslavskiy
|
cd69111522
|
Merge branch 'oscd' into master
|
2019-11-14 00:36:34 +03:00 |
|
|
yugoslavskiy
|
3cd1abd0a1
|
Update sysmon_suspicious_remote_thread.yml
|
2019-11-14 00:34:09 +03:00 |
|
|
yugoslavskiy
|
1e75979a2a
|
Update sysmon_minidumwritedump_lsass.yml
|
2019-11-14 00:32:06 +03:00 |
|
|
yugoslavskiy
|
f2caf366cb
|
moved net_possible_dns_rebinding.yml to unsupported logic directory; renamed win_powershell_bitsjob.yaml -> win_powershell_bitsjob.yml
|
2019-11-14 00:24:53 +03:00 |
|
|
yugoslavskiy
|
94caaff4fa
|
Merge branch 'oscd' of https://github.com/Neo23x0/sigma into oscd
|
2019-11-14 00:23:22 +03:00 |
|