51363d8a87
Update lnx_setuid_setgid.yml
2020-07-03 18:56:40 +03:00
87346d4b94
Update lnx_disabling_security_tools.yml
2020-07-03 18:56:30 +03:00
64afd6e7ee
Update lnx_connection_proxy.yml
2020-07-03 18:56:19 +03:00
9bfc3d6807
Delete lnx_file_copy.yml
2020-06-18 23:37:12 +03:00
a963630db8
Remote File Copy
2020-06-18 23:36:29 +03:00
3a607abe33
Update lnx_trap.yml
2020-06-17 19:51:53 +03:00
7b86f4aefb
Update lnx_trap.yml
2020-06-17 19:47:31 +03:00
ebbd32d2e1
file extension
2020-06-17 19:43:57 +03:00
f989f7e155
file extension
2020-06-17 19:43:49 +03:00
772c03c49a
Connection Proxy
2020-06-17 19:39:55 +03:00
9d285ecf74
Trap
2020-06-17 19:39:00 +03:00
d0b66ab828
Space After Filename
2020-06-17 19:38:38 +03:00
3b8fb9e3d8
Disabling Security Tools
2020-06-17 19:38:10 +03:00
fd2429bd34
Update lnx_setuid_setgid.yml
2020-06-16 19:46:50 +02:00
06fe720165
Update lnx_sudo_enumeration.yml
2020-06-16 19:33:39 +02:00
545c05d4d3
Update lnx_setuid_setgid.yml
2020-06-16 19:31:34 +02:00
0027415fa2
Update lnx_setuid_setgid.yml
2020-06-16 20:26:50 +03:00
41b2309418
file type changed
2020-06-16 20:24:09 +03:00
0d0058da43
added id
2020-06-16 20:21:07 +03:00
bbcd506fb1
added id
2020-06-16 20:21:02 +03:00
ace575aaa6
added id
2020-06-16 20:20:42 +03:00
4b1557a587
Setuid and Setgid
...
Detects suspicious change of file privileges with chown and chmod commands
2020-06-16 20:12:24 +03:00
b7e1c6750c
sudo caching
...
attack.t1206
2020-06-16 19:31:02 +03:00
e43f13ed67
Update lnx_sudo_enumeration.yml
...
attack.t1169
2020-06-16 19:20:42 +03:00
52487159c5
Detect Sudo enumeration commands
2020-06-16 19:17:00 +03:00
74e16fdccd
Merge pull request #803 from gamma37/clear_cmd_history
...
Edit Clear Command History
2020-05-29 17:32:43 +02:00
537bda4417
Update lnx_shell_clear_cmd_history.yml
2020-05-28 10:56:35 +02:00
5a48934822
Edit Clear Command History
...
I suggest a new point of view to detect that bash_history has been cleared : Instead of trying to detect all the commands that can do that, we could monitor the size of the file and log whenever it has less than 1 line.
2020-05-28 10:52:17 +02:00
8321cc7ee1
Merge pull request #772 from gamma37/suspicious_activities
...
Create a rule for "suspicious activities"
2020-05-23 18:11:32 +02:00
e1a05dfc1c
Update lnx_auditd_susp_C2_commands.yml
2020-05-23 16:49:03 +02:00
71c507d8a9
remove space bedore colon
2020-05-18 11:34:53 +02:00
55eec46932
Create a rule for "suspicious activities"
2020-05-18 11:25:18 +02:00
cbf06b1e43
lowercased tag
2020-05-18 10:11:32 +02:00
904716771a
Create a new rule to detect "Create Account"
2020-05-18 10:03:34 +02:00
7b713fbe7f
rule: OpenSSHd rule adjusted
2020-05-15 17:19:32 +02:00
373424f145
Rule fixes
...
Made tests pass the new CI tests. Added further allowed lower case words
in rule test.
2020-02-20 23:00:16 +01:00
d7bd90cb24
Merge branch 'master' into oscd
2020-02-03 23:13:16 +01:00
593abb1cce
OSCD QA wave 3
2020-02-02 12:41:12 +01:00
03ecb3b8dc
refactor: moved rues from 'apt' folder in respective folders
2020-02-01 17:59:26 +01:00
d42e87edd7
fix: fixed casing and long rule titles
2020-01-30 17:26:09 +01:00
e79e99c4aa
fix: fixed missing date fields in remaining files
2020-01-30 16:07:37 +01:00
efd3af0812
fix: fixed missing date fields in other files
2020-01-30 15:32:39 +01:00
924e1feb54
UUIDs + moved unsupported logic
...
* Added UUIDs to all contributed rules
* Moved unsupported logic directory out of rules/ because this breaks CI
testing.
2019-12-19 23:56:36 +01:00
edad1695f6
Merge branch 'oscd' of https://github.com/mrblacyk/sigma into mrblacyk-oscd
2019-12-02 02:56:53 +01:00
48a94d1609
Update lnx_dd_delete_file.yml
2019-12-02 02:54:48 +01:00
ca1c2f4436
Update lnx_chattr_immutable_removal.yml
2019-12-02 02:54:32 +01:00
9e90335a5a
Update lnx_pers_systemd_reload.yml
2019-12-02 02:54:13 +01:00
46ca68436e
Update lnx_file_or_folder_permissions.yml
2019-12-02 02:53:35 +01:00
9d0889def4
Adding auditd compatibility
2019-11-29 09:34:08 +01:00
cafbb25d2e
Update lnx_file_or_folder_permissions.yml
2019-11-29 09:33:04 +01:00
Ömer Günal