 Cyb3rEng
|
5508ff45b6
|
Add files via upload
|
2021-08-30 21:47:36 -06:00 |
|
|
Florian Roth
|
a5c6bbe04d
|
Merge pull request #1946 from SigmaHQ/rule-devel
rule: ProxyToken CVE-2021-33766 Exchange
|
2021-08-30 17:39:37 +02:00 |
|
|
Florian Roth
|
af9392ba0f
|
refactor: add 500 status code in selection2
to avoid FPs with exploitation attempts
|
2021-08-30 16:12:42 +02:00 |
|
|
Florian Roth
|
36a227796a
|
Merge pull request #1945 from SigmaHQ/rule-devel
rules: cobalt strike rules refactored
|
2021-08-30 15:48:01 +02:00 |
|
|
Florian Roth
|
4a4966af77
|
rule: ProxyToken CVE-2021-33766 Exchange
|
2021-08-30 15:47:53 +02:00 |
|
|
Florian Roth
|
98de92ceaf
|
refactor: global rule match on system and security
|
2021-08-30 15:17:53 +02:00 |
|
|
Florian Roth
|
1ded4eb913
|
rules: cobalt strike rules refactored
|
2021-08-30 15:10:30 +02:00 |
|
|
frack113
|
26bf8e1690
|
Merge pull request #1943 from frack113/update_test
Update test
|
2021-08-30 12:22:51 +02:00 |
|
|
frack113
|
6daaab7bc3
|
Merge pull request #1942 from frack113/update_help
Update help message
|
2021-08-30 12:22:19 +02:00 |
|
|
frack113
|
8ad2c722d6
|
add uberagent COVERAGE
|
2021-08-29 12:19:49 +02:00 |
|
|
frack113
|
2e79998cc7
|
add devo COVERAGE
|
2021-08-29 11:47:47 +02:00 |
|
|
frack113
|
83e2f3640c
|
add lacework backend
|
2021-08-29 09:24:43 +02:00 |
|
|
frack113
|
772fe06e10
|
fix Backend does not support map values of type <class 'bool'> (57)
|
2021-08-29 09:10:30 +02:00 |
|
|
frack113
|
5ad29cf0c2
|
fix Base backend doesn't support multiple conditions (29)
|
2021-08-29 09:03:50 +02:00 |
|
|
frack113
|
718b44c38a
|
fix List values must be strings or numbers (46)
|
2021-08-29 08:57:25 +02:00 |
|
|
frack113
|
4c414b2e8b
|
fix Base backend doesn't support multiple conditions (33)
|
2021-08-29 08:52:54 +02:00 |
|
|
frack113
|
970dfa2f92
|
Merge pull request #1938 from EvanYu0816/upstream-fixes
Fix Pass the Hash and NotPetya Ransomware rule
|
2021-08-28 21:02:04 +02:00 |
|
|
frack113
|
a7456d4d6c
|
Merge pull request #1940 from frack113/fix_ps_fp
Powershell correction
|
2021-08-28 20:48:07 +02:00 |
|
|
frack113
|
3e355c64db
|
Merge pull request #1939 from SigmaHQ/rule-devel
rule: UAC bypass by mocking dirs
|
2021-08-28 20:47:27 +02:00 |
|
|
frack113
|
5f1143247b
|
Update "sigmac -l" message
|
2021-08-28 08:51:58 +02:00 |
|
|
frack113
|
6aae623f45
|
Remove duplicate file
|
2021-08-28 08:42:02 +02:00 |
|
|
frack113
|
68237dffc4
|
fix HostApplication
|
2021-08-28 08:18:47 +02:00 |
|
|
frack113
|
ef6e0c5a4c
|
Fix error and FP
|
2021-08-28 08:02:16 +02:00 |
|
|
Florian Roth
|
f78225c394
|
rule: UAC bypass by mocking dirs
|
2021-08-27 18:12:21 +02:00 |
|
|
Evan Yu
|
178d82e9cd
|
Fix NotPetya Ransomware rule
|
2021-08-27 11:53:50 -04:00 |
|
|
Evan Yu
|
8bdd3e3987
|
Simplify Pass the Pash rule
|
2021-08-27 11:53:28 -04:00 |
|
|
frack113
|
ff37a49dc0
|
Merge pull request #1930 from SigmaHQ/rule-devel
fix: FPs with whoami rule and 4688 event IDs without parent info
|
2021-08-27 06:27:30 +02:00 |
|
|
frack113
|
0de795b0a2
|
Merge pull request #1936 from austinsonger/gworkspace_application_remove.yml
add gworkspace_application_remove.yml
|
2021-08-27 06:25:15 +02:00 |
|
|
frack113
|
00cceb7be8
|
Merge pull request #1935 from austinsonger/gworkspace_mfa_disabled.yml
add gworkspace_mfa_disabled.yml
|
2021-08-27 06:24:26 +02:00 |
|
|
frack113
|
b10629f4d8
|
Merge pull request #1934 from OTRF/feature/AADHealth-Agent-HybridADFSServices
Feature/aad health agent hybrid adfs services
|
2021-08-27 06:22:18 +02:00 |
|
|
frack113
|
1baa678df0
|
Merge pull request #1933 from hazedav/lacework
new lacework backend
|
2021-08-27 06:15:09 +02:00 |
|
|
Austin Songer
|
72485a5619
|
Update gworkspace_application_removed.yml
|
2021-08-26 21:16:21 -05:00 |
|
|
Austin Songer
|
62cefcc028
|
Rename gworkspace_application_remove.dyml to gworkspace_application_removed.yml
|
2021-08-26 21:15:56 -05:00 |
|
|
Austin Songer
|
bc246ff59d
|
Rename gworkspace_application_remove.yml to gworkspace_application_remove.dyml
|
2021-08-26 20:58:22 -05:00 |
|
|
Austin Songer
|
55f5ff3d89
|
Application Removed
|
2021-08-26 20:55:07 -05:00 |
|
|
Austin Songer
|
1fffb7a3f5
|
Gworkspace MFA disabled.
|
2021-08-26 20:28:35 -05:00 |
|
|
Roberto Rodriguez
|
f05cf20b12
|
Merge branch 'master' into feature/AADHealth-Agent-HybridADFSServices
|
2021-08-26 16:12:38 -04:00 |
|
|
Roberto Rodriguez
|
f98970ef06
|
adding basic rules to detect behavior around AAD health agents and AAD Hybrid Health AD FS services in Azure
|
2021-08-26 16:10:42 -04:00 |
|
|
David Hazekamp
|
cc6e4381b2
|
feat(backend): introducing lacework backend
Adding authors
Removing todo
|
2021-08-26 14:12:47 -05:00 |
|
|
David Hazekamp
|
a5d175fbf7
|
feat(backend): introducing lacework backend
|
2021-08-26 14:05:44 -05:00 |
|
|
frack113
|
a6149462d8
|
Merge pull request #1931 from phantinuss/master
More malleable CobaltStrike C2 profiles from new source/reference
|
2021-08-26 17:18:19 +02:00 |
|
|
frack113
|
59000b993d
|
Merge pull request #1932 from mlp1515/french_user
Add French user
|
2021-08-26 17:12:39 +02:00 |
|
|
phantinuss
|
e59b8e1e3e
|
add applicable pipe names from regex rule
|
2021-08-26 14:53:20 +02:00 |
|
|
mlp1515
|
cce7cfc79a
|
Update win_tool_psexec.yml
French language settings
|
2021-08-26 12:51:45 +00:00 |
|
|
mlp1515
|
e1aa82b412
|
Update win_susp_tscon_localsystem.yml
French language settings
|
2021-08-26 12:50:24 +00:00 |
|
|
mlp1515
|
e9ed5f592c
|
Update sysmon_always_install_elevated_windows_installer.yml
French language settings
|
2021-08-26 12:48:59 +00:00 |
|
|
mlp1515
|
4f49f03460
|
Update sysmon_abusing_debug_privilege.yml
French language settings
|
2021-08-26 12:46:15 +00:00 |
|
|
mlp1515
|
a31422db74
|
Update win_susp_schtask_creation.yml
French language settings
|
2021-08-26 12:45:24 +00:00 |
|
|
mlp1515
|
5f419d6f35
|
Update win_susp_taskmgr_localsystem.yml
French language settings
|
2021-08-26 12:44:35 +00:00 |
|
|
mlp1515
|
5545403a9b
|
Update win_whoami_as_system.yml
French language settings
|
2021-08-26 12:43:33 +00:00 |
|