 Florian Roth
|
6ce58d7201
|
refactor: removed unnecessary regex
|
2022-02-21 11:01:18 +01:00 |
|
|
Florian Roth
|
635a5c7d41
|
fix: wrong condition
|
2022-02-11 12:47:34 +01:00 |
|
|
Florian Roth
|
1bf00333f7
|
fix: exclude empty OriginalName fields
|
2022-02-11 12:01:02 +01:00 |
|
|
Florian Roth
|
e6989f9efb
|
rules: samdumps, suspicious program names
|
2022-02-11 11:58:02 +01:00 |
|
|
Florian Roth
|
a05b3e50e5
|
refactor and new: lsass process dumping rules
|
2022-02-10 09:17:25 +01:00 |
|
|
Florian Roth
|
3e0f45d11e
|
rule: suspicious execution from temp folders
|
2022-02-08 16:15:46 +01:00 |
|
|
Florian Roth
|
ed06403d04
|
fix: unneeded list
|
2022-02-08 12:21:43 +01:00 |
|
|
Florian Roth
|
9bc8bb5c20
|
fix: remove old link to removed part of rule
|
2022-02-08 09:36:31 +01:00 |
|
|
Florian Roth
|
88ce0ed97d
|
rule: Network Reconnaissance Activity
|
2022-02-08 09:36:03 +01:00 |
|
|
Florian Roth
|
094215a7e0
|
Update win_pc_embed_exe_lnk.yml
|
2022-02-06 14:20:30 +01:00 |
|
|
frack113
|
f1f38a2df4
|
add win_pc_embed_exe_lnk
|
2022-02-06 14:01:48 +01:00 |
|
|
frack113
|
ebd09793d7
|
Merge pull request #2643 from elhoim/patch-1
Avoiding being too narrow for paths
|
2022-02-05 12:03:46 +01:00 |
|
|
Florian Roth
|
8dc0835b2a
|
Update win_pc_redirect_to_stream.yml
|
2022-02-04 23:18:08 +01:00 |
|
|
Florian Roth
|
affd73506d
|
Update win_pc_susp_instalutil.yml
|
2022-02-04 23:16:05 +01:00 |
|
|
David André
|
391d73a2c2
|
Avoiding being too narrow for paths
InstallUtil.exe is also available under 32 bits path for .net framework
|
2022-02-04 21:08:47 +01:00 |
|
|
frack113
|
16fed13bb0
|
Order files
|
2022-02-04 10:52:55 +01:00 |
|
|
frack113
|
2887cf2800
|
Merge pull request #2623 from frack113/red_t1555_003
Redcannary windows
|
2022-02-03 22:23:19 +01:00 |
|
|
Florian Roth
|
20a7bad5d8
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-02-02 20:40:21 +01:00 |
|
|
Florian Roth
|
885651efae
|
fix: FPs noticed with Aurora
|
2022-02-02 20:39:47 +01:00 |
|
|
Florian Roth
|
ef955b92ae
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-02-02 13:49:23 +01:00 |
|
|
Florian Roth
|
cb8a0a6e73
|
Revert "fix: FPs with GoogleDrive update"
This reverts commit 86f3302a33.
|
2022-02-02 13:49:06 +01:00 |
|
|
phantinuss
|
b627c62fe8
|
fix: filter out googledrivesync.exe FP
|
2022-02-02 12:25:55 +01:00 |
|
|
Florian Roth
|
86f3302a33
|
fix: FPs with GoogleDrive update
|
2022-02-02 11:45:42 +01:00 |
|
|
phantinuss
|
a22d57fc87
|
fix: rename filter
|
2022-02-02 11:12:39 +01:00 |
|
|
phantinuss
|
2d36c6222d
|
fix: FPs found in prod environment
|
2022-02-02 11:03:19 +01:00 |
|
|
Florian Roth
|
f357c73554
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-02-01 19:50:21 +01:00 |
|
|
Florian Roth
|
9fc06fb027
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-02-01 15:57:20 +01:00 |
|
|
Florian Roth
|
6efa5da3dc
|
fix: unescaped double back slashes
|
2022-02-01 15:57:15 +01:00 |
|
|
Florian Roth
|
926f9b588c
|
Merge pull request #2605 from securepeacock/patch-9
Rundll32 From Abnormal Drive
|
2022-01-31 16:38:46 +01:00 |
|
|
Florian Roth
|
fb44e9ae56
|
Update process_creation_rundll32_not_from_c_drive.yml
|
2022-01-30 21:48:57 +01:00 |
|
|
frack113
|
0bcb842c70
|
Redcannary windows
|
2022-01-30 18:47:49 +01:00 |
|
|
Florian Roth
|
642b3748fe
|
Merge pull request #2615 from frack113/redcannary_20220128
Add windows redcannary rules
|
2022-01-29 15:25:40 +01:00 |
|
|
Florian Roth
|
56fba15638
|
Update process_creation_tool_nircmd.yml
|
2022-01-28 23:14:17 +01:00 |
|
|
Florian Roth
|
34c8de908d
|
Update process_creation_tool_nircmd_as_system.yml
|
2022-01-28 23:08:41 +01:00 |
|
|
Nasreddine Bencherchali
|
6f96372ece
|
Update process_creation_tool_nircmd_as_system.yml
|
2022-01-28 21:10:52 +01:00 |
|
|
Nasreddine Bencherchali
|
b0b9d32dfa
|
Update process_creation_tool_nircmd.yml
|
2022-01-28 21:10:03 +01:00 |
|
|
Nasreddine Bencherchali
|
0b09dbdcd1
|
Update process_creation_tool_nircmd_as_system.yml
|
2022-01-28 21:01:43 +01:00 |
|
|
Florian Roth
|
0391cffab4
|
Merge pull request #2616 from SigmaHQ/rule-devel
rule: xordump
|
2022-01-28 18:06:21 +01:00 |
|
|
Florian Roth
|
bfee0f8067
|
rule: xordump
|
2022-01-28 17:26:12 +01:00 |
|
|
frack113
|
5b30db61b0
|
Add windows redcannary rules
|
2022-01-28 16:12:38 +01:00 |
|
|
Florian Roth
|
a5cb3ba37f
|
Merge pull request #2598 from SigmaHQ/rule-devel
rules: NirCmd, NSudo, RunX
|
2022-01-28 12:18:15 +01:00 |
|
|
frack113
|
9a517bae7c
|
Merge pull request #2614 from frack113/update_ref
sysmon_proxy_execution_wuauclt Update References
|
2022-01-28 11:51:45 +01:00 |
|
|
Florian Roth
|
982808c3db
|
refactor: whoami / authority, rule: whoami as trusted installer
|
2022-01-28 11:30:30 +01:00 |
|
|
frack113
|
a6e3b4691b
|
Update References
|
2022-01-28 10:30:39 +01:00 |
|
|
frack113
|
d4b4d4e382
|
Merge pull request #2612 from glennbarrett/patch-1
Typo fix in win_plugx_susp_exe_locations.yml
|
2022-01-28 10:00:07 +01:00 |
|
|
frack113
|
069d4ac8bd
|
Update modified
|
2022-01-28 09:09:26 +01:00 |
|
|
frack113
|
4ef359a96f
|
Merge pull request #2611 from redsand/fp_for_iexplorer
adding filter for fp of iexplorer calling cpl
|
2022-01-28 06:59:35 +01:00 |
|
|
Glenn Barrett
|
edb769b086
|
Typo fix in win_plugx_susp_exe_locations.yml
Change SysWowo64 to SysWow64
|
2022-01-27 15:08:54 -05:00 |
|
|
Tim Shelton
|
f8ce6d87a8
|
adding filter for fp of iexplorer calling cpls: C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:276824072 WinX:0 WinY:0 IEFrame:0000000000000000
|
2022-01-27 16:31:37 +00:00 |
|
|
securepeacock
|
1cfa06e6e6
|
Update process_creation_rundll32_not_from_c_drive.yml
|
2022-01-25 14:43:30 -05:00 |
|