 Florian Roth
|
6ce58d7201
|
refactor: removed unnecessary regex
|
2022-02-21 11:01:18 +01:00 |
|
|
Florian Roth
|
ab3f1f6e7d
|
refactor: extend values - sam rule
|
2022-02-16 16:59:32 +01:00 |
|
|
Florian Roth
|
a72e432389
|
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
|
2022-02-11 14:15:54 +01:00 |
|
|
Florian Roth
|
0476b8693d
|
refactor: extended .iso rule
|
2022-02-11 14:15:51 +01:00 |
|
|
Florian Roth
|
635a5c7d41
|
fix: wrong condition
|
2022-02-11 12:47:34 +01:00 |
|
|
Florian Roth
|
3fa2d13e10
|
rule: iso / img file mount
|
2022-02-11 12:37:35 +01:00 |
|
|
Florian Roth
|
8e255bfdaf
|
refactor: sam hive dump filename rule
|
2022-02-11 12:16:40 +01:00 |
|
|
Florian Roth
|
1bf00333f7
|
fix: exclude empty OriginalName fields
|
2022-02-11 12:01:02 +01:00 |
|
|
Florian Roth
|
e6989f9efb
|
rules: samdumps, suspicious program names
|
2022-02-11 11:58:02 +01:00 |
|
|
Florian Roth
|
5ab21fdd0a
|
docs: wording
|
2022-02-10 12:49:23 +01:00 |
|
|
Florian Roth
|
3c7c348b89
|
refactor: extended rules and made them more exact
|
2022-02-10 12:46:24 +01:00 |
|
|
Florian Roth
|
a05b3e50e5
|
refactor and new: lsass process dumping rules
|
2022-02-10 09:17:25 +01:00 |
|
|
Florian Roth
|
3e0f45d11e
|
rule: suspicious execution from temp folders
|
2022-02-08 16:15:46 +01:00 |
|
|
Florian Roth
|
ed06403d04
|
fix: unneeded list
|
2022-02-08 12:21:43 +01:00 |
|
|
Florian Roth
|
9bc8bb5c20
|
fix: remove old link to removed part of rule
|
2022-02-08 09:36:31 +01:00 |
|
|
Florian Roth
|
88ce0ed97d
|
rule: Network Reconnaissance Activity
|
2022-02-08 09:36:03 +01:00 |
|
|
Florian Roth
|
90f551a194
|
Merge branch 'master' into rule-devel
|
2022-02-06 23:34:54 +01:00 |
|
|
Florian Roth
|
d083efa095
|
fix: FPs noticed with Aurora
|
2022-02-06 23:33:52 +01:00 |
|
|
frack113
|
6dbbccc84e
|
Merge pull request #2648 from frack113/x86matthew_lnk
add win_pc_embed_exe_lnk
|
2022-02-06 21:15:51 +01:00 |
|
|
frack113
|
968dbeeaca
|
Merge pull request #2647 from frack113/red_20220206
add posh_ps_get_adreplaccount
|
2022-02-06 21:15:31 +01:00 |
|
|
frack113
|
60a0e26974
|
Merge pull request #2651 from frack113/fix_detecttion
lnx_auditd_systemd_service_creation fix detection
|
2022-02-06 21:13:12 +01:00 |
|
|
Florian Roth
|
c5bdbb1b71
|
Merge pull request #2649 from SigmaHQ/rule-devel
refactor: lsass dump filename IOC pattern
|
2022-02-06 20:39:23 +01:00 |
|
|
frack113
|
ff9ecf395f
|
Fix detection
|
2022-02-06 19:16:27 +01:00 |
|
|
Florian Roth
|
80a552d28d
|
refactor: lsass dump filename IOC pattern
|
2022-02-06 14:26:55 +01:00 |
|
|
Florian Roth
|
094215a7e0
|
Update win_pc_embed_exe_lnk.yml
|
2022-02-06 14:20:30 +01:00 |
|
|
Florian Roth
|
97dacc4ffc
|
refactor: increased level to medium
|
2022-02-06 14:17:38 +01:00 |
|
|
frack113
|
f1f38a2df4
|
add win_pc_embed_exe_lnk
|
2022-02-06 14:01:48 +01:00 |
|
|
frack113
|
62611e0e39
|
add posh_ps_get_adreplaccount
|
2022-02-06 11:15:00 +01:00 |
|
|
Florian Roth
|
e28d5ce97f
|
Merge pull request #2646 from SigmaHQ/rule-devel
fix: avoid Microsoft Defender detections
|
2022-02-06 09:44:40 +01:00 |
|
|
Florian Roth
|
27c63d2735
|
Merge branch 'master' into rule-devel
|
2022-02-06 08:57:37 +01:00 |
|
|
Florian Roth
|
e2aa3665af
|
fix: avoid Microsoft Defender detections
We keep the strings as specific as necessary while avoiding Microsoft Defender detections on the rule files
|
2022-02-06 08:56:54 +01:00 |
|
|
Florian Roth
|
49d35717ad
|
Merge pull request #2645 from SigmaHQ/aurora-false-positive-fixing
Aurora false positive fixing
|
2022-02-05 22:26:52 +01:00 |
|
|
Florian Roth
|
fada8df7d4
|
fix: FP notices with Aurora
|
2022-02-05 21:40:03 +01:00 |
|
|
Florian Roth
|
44221ed95e
|
fix: Aurora Sigma rule matches in application log
|
2022-02-05 21:38:10 +01:00 |
|
|
frack113
|
ebd09793d7
|
Merge pull request #2643 from elhoim/patch-1
Avoiding being too narrow for paths
|
2022-02-05 12:03:46 +01:00 |
|
|
frack113
|
ef629c1502
|
Merge pull request #2641 from frack113/red_20220204
Windows redcanaryco
|
2022-02-05 12:03:28 +01:00 |
|
|
frack113
|
59141ce789
|
Merge pull request #2636 from zakibro/master
Auditd rule - Systemd Service Creation
|
2022-02-05 10:35:01 +01:00 |
|
|
Florian Roth
|
c23a82d2e7
|
Update win_re_set_servicedll.yml
|
2022-02-04 23:19:36 +01:00 |
|
|
Florian Roth
|
8dc0835b2a
|
Update win_pc_redirect_to_stream.yml
|
2022-02-04 23:18:08 +01:00 |
|
|
Florian Roth
|
affd73506d
|
Update win_pc_susp_instalutil.yml
|
2022-02-04 23:16:05 +01:00 |
|
|
David André
|
391d73a2c2
|
Avoiding being too narrow for paths
InstallUtil.exe is also available under 32 bits path for .net framework
|
2022-02-04 21:08:47 +01:00 |
|
|
Florian Roth
|
aa2baf5f3a
|
Merge pull request #2642 from SigmaHQ/aurora-false-positive-fixing
fix: far too many FPs with new "Suspicious Load of Advapi31.dll" rule
|
2022-02-04 18:21:20 +01:00 |
|
|
Florian Roth
|
8aad83a737
|
fix: far too many FPs with new Advapi31.dll rule
|
2022-02-04 14:03:14 +01:00 |
|
|
zakibro
|
d5257f9a05
|
Update lnx_auditd_systemd_service_creation.yml
fixing logic
|
2022-02-04 12:15:36 +01:00 |
|
|
Florian Roth
|
e15821b4f0
|
Merge pull request #2639 from frack113/aurora_fp
aurora OneDrive FP
|
2022-02-04 11:03:45 +01:00 |
|
|
Florian Roth
|
a561d49cf0
|
Merge pull request #2640 from SigmaHQ/aurora-false-positive-fixing
Aurora false positive fixing
|
2022-02-04 11:03:33 +01:00 |
|
|
frack113
|
16fed13bb0
|
Order files
|
2022-02-04 10:52:55 +01:00 |
|
|
frack113
|
c54e18dea9
|
Windows Redcannary
|
2022-02-04 10:49:50 +01:00 |
|
|
Florian Roth
|
7be3c7e302
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-02-04 09:54:06 +01:00 |
|
|
Florian Roth
|
4ec69d60e8
|
refactor: simplified condition
|
2022-02-04 09:53:41 +01:00 |
|