 frack113
|
6c19303aa4
|
normalize logsource
|
2021-11-09 10:48:13 +01:00 |
|
|
frack113
|
8f39ef9ed1
|
normalize logsource
|
2021-11-09 10:41:09 +01:00 |
|
|
frack113
|
73e2b5fae6
|
Merge pull request #2233 from frack113/zipexec
Add win_pc_susp_zipexec
|
2021-11-08 22:46:17 +01:00 |
|
|
frack113
|
3e670a876f
|
Merge pull request #2232 from frack113/fix_sysmon_rule
fix logsources
|
2021-11-08 21:28:44 +01:00 |
|
|
frack113
|
d3c3cd9930
|
Merge pull request #2230 from frack113/process_creation_clean
Process creation directory clean
|
2021-11-08 21:27:25 +01:00 |
|
|
frack113
|
24b1d781ad
|
Merge pull request #2229 from frack113/fiw_windows
fix product windows case
|
2021-11-08 21:27:01 +01:00 |
|
|
frack113
|
94c8d01df1
|
Merge branch 'SigmaHQ:master' into zipexec
|
2021-11-08 19:02:46 +01:00 |
|
|
frack113
|
f58aa4401e
|
Merge branch 'SigmaHQ:master' into process_creation_clean
|
2021-11-08 19:02:32 +01:00 |
|
|
frack113
|
5a5b64c7a2
|
Merge branch 'SigmaHQ:master' into fix_sysmon_rule
|
2021-11-08 19:02:25 +01:00 |
|
|
frack113
|
d13ccc8cba
|
Merge branch 'SigmaHQ:master' into fiw_windows
|
2021-11-08 19:02:00 +01:00 |
|
|
frack113
|
b424e699c0
|
Merge pull request #2236 from frack113/pipenv_2021_5_29
Use correct pipenv version
|
2021-11-08 19:00:59 +01:00 |
|
|
frack113
|
8ed456258f
|
Use correct pipenv version
|
2021-11-08 18:22:23 +01:00 |
|
|
frack113
|
4672762010
|
add win_pc_susp_zipexec
|
2021-11-07 21:57:40 +01:00 |
|
|
frack113
|
e51dab10c2
|
fix logsources
|
2021-11-07 09:55:02 +01:00 |
|
|
frack113
|
aa8694fdef
|
add missing category
|
2021-11-06 10:17:12 +01:00 |
|
|
frack113
|
68d30293b5
|
Cleanup process_creation
|
2021-11-06 10:16:16 +01:00 |
|
|
frack113
|
a3f3ec84c9
|
fix product windows case
|
2021-11-05 13:16:24 +01:00 |
|
|
frack113
|
7f087797d6
|
Merge pull request #2175 from frack113/elastic_is_bad_in_regex
manage start end regex for Elastic
|
2021-11-05 12:27:18 +01:00 |
|
|
frack113
|
80d2aee944
|
Merge pull request #2227 from redsand/remove_duplicate_powershell_check
Removing duplicate rule of Powershell memory check
|
2021-11-05 11:15:38 +01:00 |
|
|
frack113
|
3416db7301
|
Merge pull request #2225 from frack113/cmdl32
add win_pc_susp_cmdl32_lolbas
|
2021-11-04 20:58:50 +01:00 |
|
|
frack113
|
a811acde00
|
Merge pull request #2224 from frack113/schtasks_appdata
add win_pc_susp_schtasks_user_temp
|
2021-11-04 20:58:31 +01:00 |
|
|
Tim Shelton
|
dda204bd51
|
updating yaml
|
2021-11-04 18:56:07 +00:00 |
|
|
Tim Shelton
|
e266491f0a
|
adding obsoletes tags
|
2021-11-04 18:36:55 +00:00 |
|
|
frack113
|
e058e56c22
|
fix unknown
|
2021-11-04 18:07:16 +01:00 |
|
|
Tim Shelton
|
1ae596b634
|
removing rule 867613fb-fa60-4497-a017-a82df74a172c . this is a duplicate of 092bc4b9-3d1d-43b4-a6b4-8c8acd83522f and does not contain an allow list of known processes.
|
2021-11-04 17:07:00 +00:00 |
|
|
frack113
|
5506b1c566
|
add OriginalFileName
|
2021-11-04 13:42:04 +01:00 |
|
|
frack113
|
b43d1bf809
|
Merge pull request #2223 from zakibro/master
Linux - Auditd - Loading of Kernel Module via Insmod rule
|
2021-11-03 21:10:45 +01:00 |
|
|
frack113
|
edb1458791
|
add win_pc_susp_cmdl32_lolbas
|
2021-11-03 20:45:21 +01:00 |
|
|
frack113
|
be6186fa1c
|
Forget the Local
|
2021-11-03 17:01:34 +01:00 |
|
|
frack113
|
5a4db26ec7
|
add win_pc_susp_schtasks_user_temp
|
2021-11-03 15:14:34 +01:00 |
|
|
zakibro
|
30f13d41f5
|
Update lnx_auditd_load_module_insmod.yml
fixing missing date
|
2021-11-02 17:16:59 +01:00 |
|
|
Pawel Mazur
|
dd7817917c
|
Linux - Auditd - Loading of Kernel Module via Insmod rule
|
2021-11-02 17:04:39 +01:00 |
|
|
frack113
|
eb9428ff6a
|
Merge pull request #2221 from skirankumar/master
Added another application
|
2021-11-02 16:28:33 +01:00 |
|
|
frack113
|
e599ddc26a
|
Merge pull request #2220 from frack113/unsecure_level
add win_pc_set_policies_to_unsecure_level
|
2021-11-02 16:28:21 +01:00 |
|
|
frack113
|
d7612739e7
|
Merge pull request #2219 from jordischoots/fix-error-introduced-in-commit-58d9e41
Fix errors introduced at commit 58d9e41
|
2021-11-02 06:34:46 +01:00 |
|
|
S.kiran kumar
|
802cdb0189
|
Added another application
|
2021-11-01 21:41:57 +05:30 |
|
|
Jordi Schoots
|
23ed626287
|
Change location value=str(value)
|
2021-11-01 16:05:34 +01:00 |
|
|
frack113
|
2a2bfab06e
|
add win_pc_set_policies_to_unsecure_level
|
2021-11-01 15:35:46 +01:00 |
|
|
Jordi Schoots
|
9d0123e782
|
Fix errors introduced at commit 58d9e41
|
2021-11-01 12:40:41 +01:00 |
|
|
frack113
|
fb750721b2
|
Merge pull request #2212 from frack113/new_status
New status from discussions
|
2021-10-31 20:38:28 +01:00 |
|
|
frack113
|
eb242fba28
|
Merge pull request #2214 from elhoim/patch-1
Adding multiple named pipes
|
2021-10-31 07:44:31 +01:00 |
|
|
frack113
|
9f7d4a832e
|
Update sysmon_mal_namedpipes.yml
|
2021-10-31 07:03:27 +01:00 |
|
|
frack113
|
21654923be
|
Merge pull request #2218 from frack113/malware_run
add user temp folder
|
2021-10-31 07:01:10 +01:00 |
|
|
frack113
|
eba2f3b68f
|
add temp folder
|
2021-10-30 17:28:07 +02:00 |
|
|
David André
|
0de88e2f30
|
Added four other named pipes and corrected one missing slash
|
2021-10-29 16:33:07 +02:00 |
|
|
David André
|
8c57d29561
|
Added turla hyperstack named pipe
|
2021-10-29 15:49:04 +02:00 |
|
|
frack113
|
bcdf13c680
|
Merge pull request #2213 from frack113/fix_rule
Fix detection file_event_mal_vhd_download.yml
|
2021-10-29 12:26:06 +02:00 |
|
|
frack113
|
a936f1afb7
|
Merge pull request #2211 from nasbench/master
Update winlogbeat-modules-enabled.yml
|
2021-10-29 12:25:30 +02:00 |
|
|
frack113
|
e34ac47b03
|
Merge pull request #2210 from phantinuss/newrules
fix FPs found in production environment
|
2021-10-29 12:25:19 +02:00 |
|
|
phantinuss
|
4b18d5e45c
|
chore: set status to test
|
2021-10-29 09:57:19 +02:00 |
|