 Florian Roth
|
57bfdc7a02
|
fix: more upper case chars
|
2021-09-07 09:19:23 +02:00 |
|
|
Florian Roth
|
0cce1c0245
|
fix: missing lowercase chars
|
2021-09-07 09:17:25 +02:00 |
|
|
Florian Roth
|
33be089ea2
|
fix: filename to lowercase
|
2021-09-07 09:16:35 +02:00 |
|
|
Florian Roth
|
b0c2d7b75a
|
fix: tags for WMI / execution / persistence
|
2021-09-01 16:34:50 +02:00 |
|
|
Florian Roth
|
2f7f050ad8
|
fix: removed tags
|
2021-09-01 16:32:27 +02:00 |
|
|
Florian Roth
|
1aac21ba79
|
fix: single list item issue
|
2021-09-01 14:03:42 +02:00 |
|
|
Florian Roth
|
505140d273
|
rule: extended WMI suspicious scripts rule
|
2021-09-01 13:57:48 +02:00 |
|
|
Florian Roth
|
e787420be1
|
rule: WMI filter content encoded executable
|
2021-09-01 13:57:36 +02:00 |
|
|
Florian Roth
|
8761927e8c
|
rule: susp scrcons.exe creating named pipe
|
2021-09-01 13:57:17 +02:00 |
|
|
Florian Roth
|
affc929c3b
|
LiquidSnake named pipe
|
2021-09-01 13:54:47 +02:00 |
|
|
Florian Roth
|
f102b2d9a1
|
docs: note to improved sysmon config
|
2021-09-01 13:07:18 +02:00 |
|
|
Florian Roth
|
9b20060275
|
SideWalk UA
|
2021-08-31 17:14:19 +02:00 |
|
|
Florian Roth
|
af9392ba0f
|
refactor: add 500 status code in selection2
to avoid FPs with exploitation attempts
|
2021-08-30 16:12:42 +02:00 |
|
|
Florian Roth
|
4a4966af77
|
rule: ProxyToken CVE-2021-33766 Exchange
|
2021-08-30 15:47:53 +02:00 |
|
|
Florian Roth
|
98de92ceaf
|
refactor: global rule match on system and security
|
2021-08-30 15:17:53 +02:00 |
|
|
Florian Roth
|
1ded4eb913
|
rules: cobalt strike rules refactored
|
2021-08-30 15:10:30 +02:00 |
|
|
Florian Roth
|
f78225c394
|
rule: UAC bypass by mocking dirs
|
2021-08-27 18:12:21 +02:00 |
|
|
Florian Roth
|
24d8701f15
|
fix: null cannot be used in a list with other values
|
2021-08-26 13:54:18 +02:00 |
|
|
Florian Roth
|
a231aa73b3
|
fix: FPs with whoami rule and 4688 event IDs without parent info
|
2021-08-26 13:33:25 +02:00 |
|
|
Florian Roth
|
8b318b9273
|
refactor: Mimikatz keyword rule refactoring
|
2021-08-26 12:51:45 +02:00 |
|
|
Florian Roth
|
46e312ff0d
|
fix: error in modifier
|
2021-08-24 15:03:23 +02:00 |
|
|
Florian Roth
|
cc519552aa
|
refactor: RazorInstaller integrity level system
|
2021-08-24 14:54:07 +02:00 |
|
|
Florian Roth
|
6ca30619ac
|
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
|
2021-08-24 12:30:42 +02:00 |
|
|
Florian Roth
|
3cdb88ad55
|
refactor: level of suspicious parent for powershell rule
|
2021-08-24 12:30:40 +02:00 |
|
|
Florian Roth
|
272625a005
|
Update win_susp_splwow64.yml
|
2021-08-24 08:34:08 +02:00 |
|
|
Florian Roth
|
998ebbe1f3
|
fix: typo in name
|
2021-08-23 18:46:05 +02:00 |
|
|
Florian Roth
|
6b86dacc9e
|
rule: razor installer
|
2021-08-23 18:44:15 +02:00 |
|
|
Florian Roth
|
91b42f9077
|
fix: indentation
|
2021-08-23 15:03:59 +02:00 |
|
|
Florian Roth
|
a0f72e5f6f
|
rule: suspicious splwow64 process starts
|
2021-08-23 10:41:42 +02:00 |
|
|
Florian Roth
|
dc3ed771b5
|
rule: EfsPotato Named Pipe
|
2021-08-23 08:32:50 +02:00 |
|
|
frack113
|
768855e6d6
|
update modified after FP fix
|
2021-08-18 18:17:53 +02:00 |
|
|
Florian Roth
|
44013e25c8
|
fix: FPs with WMIADAP.exe
|
2021-08-18 17:26:57 +02:00 |
|
|
Florian Roth
|
5fa5a412d5
|
fix: FPs with [reflection.assembly]::Load
|
2021-08-18 09:49:34 +02:00 |
|
|
frack113
|
136c53190a
|
Merge pull request #1860 from frack113/duplicate_uuid
Update test_missing_id message
|
2021-08-17 17:13:00 +02:00 |
|
|
Florian Roth
|
f36b1cbd2a
|
Merge pull request #1854 from SigmaHQ/rule-devel
rule: Antivirus hacktool events, Procdump rules refactoring
|
2021-08-17 13:45:07 +02:00 |
|
|
Florian Roth
|
a0625ad074
|
Merge branch 'master' into rule-devel
|
2021-08-17 12:29:55 +02:00 |
|
|
Florian Roth
|
9684c4e55f
|
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
|
2021-08-17 12:03:54 +02:00 |
|
|
Florian Roth
|
80b3acfce9
|
fix: false positive with Xen / Oracle scripts
|
2021-08-17 12:03:49 +02:00 |
|
|
frack113
|
63733a623e
|
Merge pull request #1861 from austinsonger/aws_eks_cluster_modified_or_deleted.yml
aws_eks_cluster_created_or_deleted.yml
|
2021-08-17 06:25:18 +02:00 |
|
|
frack113
|
2521ae2ed1
|
Merge pull request #1859 from austinsonger/gcp_vpn_tunnel_modified_or_deleted.yml
gcp_vpn_tunnel_modified_or_deleted.yml
|
2021-08-17 06:24:49 +02:00 |
|
|
frack113
|
accb675ed5
|
fix error space
|
2021-08-16 20:36:55 +02:00 |
|
|
Austin Songer
|
80062ff5cd
|
Update aws_eks_cluster_created_or_deleted.yml
|
2021-08-16 12:42:14 -05:00 |
|
|
Austin Songer
|
cfb863a98e
|
Update aws_eks_cluster_created_or_deleted.yml
|
2021-08-16 11:52:22 -05:00 |
|
|
frack113
|
76d956e110
|
update test_missing_id
|
2021-08-16 18:12:17 +02:00 |
|
|
frack113
|
dfd9e6d8f0
|
Merge pull request #1857 from frack113/fix_HostApplication
Update definition for powershell-classic rule
|
2021-08-16 17:18:24 +02:00 |
|
|
frack113
|
eb406ba36f
|
Merge pull request #1844 from frack113/cleanup
Add more compliance test
|
2021-08-16 17:17:25 +02:00 |
|
|
Austin Songer
|
ed507b82f4
|
Update and rename aws_eks_cluster_modified_or_deleted.yml to aws_eks_cluster_created_or_deleted.yml
|
2021-08-16 09:58:48 -05:00 |
|
|
Austin Songer
|
c7831a3d70
|
Update gcp_vpn_tunnel_modified_or_deleted.yml
|
2021-08-16 09:45:31 -05:00 |
|
|
Florian Roth
|
d2790f2450
|
fix: missing "|all" modifier
|
2021-08-16 16:14:48 +02:00 |
|
|
frack113
|
e1b99db149
|
fix duplicate uuid
|
2021-08-16 15:50:14 +02:00 |
|