 Tim Shelton
|
6187cfdfd6
|
False positive when amazon workspaces is running and doing its weird little things
|
2022-07-14 19:41:52 +00:00 |
|
|
Florian Roth
|
8ace9631d0
|
Merge pull request #3220 from frack113/Eventdata_Data
Remove some keywords
|
2022-07-14 08:31:43 +02:00 |
|
|
frack113
|
9b319f0569
|
Update win_account_discovery.yml
|
2022-07-13 06:45:39 +02:00 |
|
|
Borna Talebi
|
f9faeacb5a
|
Update win_account_discovery.yml
|
2022-07-12 23:58:40 +04:30 |
|
|
Borna Talebi
|
0850419c95
|
Add FP from reference link
According to the query in reference, computer accounts should be excluded: "and not (SourceUserName IMATCHES '.*\$')"
|
2022-07-12 23:32:00 +04:30 |
|
|
frack113
|
0fbbbd19dc
|
fix list
|
2022-07-12 19:44:41 +02:00 |
|
|
frack113
|
c0b580169d
|
Change keywords to Data
|
2022-07-12 19:20:43 +02:00 |
|
|
Nasreddine Bencherchali
|
3a1bb6f7de
|
Fix Error in logsource
|
2022-07-12 16:50:08 +01:00 |
|
|
Florian Roth
|
98a7d2f76e
|
Merge pull request #3216 from nasbench/master
DFIR Report - SELECT XMRig FROM SQLServer (New Rules)
|
2022-07-12 17:40:44 +02:00 |
|
|
Nasreddine Bencherchali
|
3838c4dc22
|
Add "warning" section
|
2022-07-12 16:38:48 +01:00 |
|
|
Florian Roth
|
739a54289e
|
Update proc_creation_win_inline_base64_mz_header.yml
|
2022-07-12 17:33:04 +02:00 |
|
|
Nasreddine Bencherchali
|
ac76e31f95
|
Add missing references
|
2022-07-12 16:23:42 +01:00 |
|
|
Florian Roth
|
730ee2cc9b
|
Merge pull request #3217 from phantinuss/master
Fix FPs
|
2022-07-12 17:16:04 +02:00 |
|
|
Florian Roth
|
31ee9b7104
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-07-12 16:54:10 +02:00 |
|
|
phantinuss
|
b6025adaa8
|
fix: found on several systems in prod environment
|
2022-07-12 16:41:10 +02:00 |
|
|
Nasreddine Bencherchali
|
aeecd0530d
|
xp_cmdshell rules
|
2022-07-12 14:56:22 +01:00 |
|
|
Florian Roth
|
e79e4d6c3b
|
fix: FPs wtih csc.exe as child of sdiagnhost
|
2022-07-12 14:32:22 +02:00 |
|
|
phantinuss
|
7ca54a691b
|
fix: FP found in testing
|
2022-07-12 13:47:13 +02:00 |
|
|
Nasreddine Bencherchali
|
a41a73d721
|
DFIR Report - SELECT XMRig FROM SQLServer
|
2022-07-12 01:27:51 +01:00 |
|
|
Florian Roth
|
9b50323bc1
|
Merge pull request #3215 from nasbench/master
Reference+Selection Updates [Final Batch]
|
2022-07-11 22:47:17 +02:00 |
|
|
Florian Roth
|
6dde3012cc
|
refactor: some changes
|
2022-07-11 19:55:54 +02:00 |
|
|
Nasreddine Bencherchali
|
476f395126
|
Fix FP's
|
2022-07-11 18:33:54 +01:00 |
|
|
Nasreddine Bencherchali
|
614fe69363
|
Update proc_creation_win_susp_use_of_sqltoolsps_bin.yml
|
2022-07-11 18:27:06 +01:00 |
|
|
Nasreddine Bencherchali
|
3aab1cc54c
|
Update proc_creation_win_susp_service_path_modification.yml
|
2022-07-11 18:25:54 +01:00 |
|
|
Nasreddine Bencherchali
|
987b694223
|
Update proc_creation_win_susp_runscripthelper.yml
|
2022-07-11 18:24:17 +01:00 |
|
|
Nasreddine Bencherchali
|
093aff99b0
|
Update proc_creation_win_lsass_dump.yml
|
2022-07-11 18:22:50 +01:00 |
|
|
Nasreddine Bencherchali
|
f2d9299703
|
Update proc_creation_win_susp_runonce_execution.yml
|
2022-07-11 18:21:46 +01:00 |
|
|
Nasreddine Bencherchali
|
9feec535f6
|
Update proc_creation_win_base64_listing_shadowcopy.yml
|
2022-07-11 18:19:46 +01:00 |
|
|
Nasreddine Bencherchali
|
62574e9b0c
|
Update Ref+Selection 3
|
2022-07-11 18:12:51 +01:00 |
|
|
Nasreddine Bencherchali
|
12d187bc91
|
Update Ref+Selection 2
|
2022-07-11 17:48:40 +01:00 |
|
|
phantinuss
|
e31d752146
|
fix: FPs found in prod environment
|
2022-07-11 15:47:11 +02:00 |
|
|
Nasreddine Bencherchali
|
fb73dfca88
|
Merge branch 'master' of https://github.com/nasbench/sigma
|
2022-07-11 14:11:59 +01:00 |
|
|
Nasreddine Bencherchali
|
238e0ecd7d
|
Update Ref+Selection
|
2022-07-11 14:11:53 +01:00 |
|
|
Florian Roth
|
e7f5b07f2d
|
Merge pull request #3213 from SigmaHQ/rule-devel
refactor: another Follina process pattern observed ITW
|
2022-07-11 13:00:51 +02:00 |
|
|
Florian Roth
|
5b8f7d977f
|
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
|
2022-07-11 12:52:08 +02:00 |
|
|
Florian Roth
|
a17364104b
|
refactor: Follina patterns
|
2022-07-11 12:52:06 +02:00 |
|
|
Nasreddine Bencherchali
|
d2f08cca5d
|
New Rules
|
2022-07-11 10:22:45 +01:00 |
|
|
Florian Roth
|
9daef055ae
|
Merge pull request #3211 from SigmaHQ/rule-devel
fix: FPs with notepad as parent
|
2022-07-08 20:40:49 +02:00 |
|
|
Florian Roth
|
0640695258
|
fix: FPs with notepad.exe as parent
Closing https://github.com/SigmaHQ/sigma/issues/3208
|
2022-07-08 19:28:43 +02:00 |
|
|
frack113
|
4f21febbb4
|
Fix detection
|
2022-07-08 18:20:37 +02:00 |
|
|
Florian Roth
|
578c838277
|
Merge pull request #3203 from nasbench/master
Reference Update [Batch 1]
|
2022-07-08 10:47:50 +02:00 |
|
|
Nasreddine Bencherchali
|
8b9307de30
|
Update selections
|
2022-07-07 20:55:19 +01:00 |
|
|
Nasreddine Bencherchali
|
68c27b56d4
|
Update proc_creation_win_exploit_cve_2020_1048.yml
|
2022-07-07 20:16:30 +01:00 |
|
|
Nasreddine Bencherchali
|
aec95b6d65
|
Update selections and indentation
|
2022-07-07 20:13:45 +01:00 |
|
|
Nasreddine Bencherchali
|
49e389db5c
|
Add More paths
|
2022-07-07 19:13:22 +01:00 |
|
|
Nasreddine Bencherchali
|
b26c28972d
|
Add missing definition fields and references
|
2022-07-07 19:13:01 +01:00 |
|
|
Florian Roth
|
21d2bbdba4
|
fix: filter expressions missing in condition
|
2022-07-07 18:42:05 +02:00 |
|
|
Florian Roth
|
c7eb123bc3
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-07-07 18:21:16 +02:00 |
|
|
Florian Roth
|
b58c797c61
|
fix: FPs with Visual Studio
|
2022-07-07 18:20:10 +02:00 |
|
|
Florian Roth
|
a70b4e5e9d
|
fix: FPs
|
2022-07-07 17:47:43 +02:00 |
|