security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
13,580 Commits 1 Branch 57 Tags
74e2d1bd3cec8fa72ba06cf4eef8e58fb5e0e237
Commit Graph

10589 Commits

Author SHA1 Message Date
Florian Roth 74e2d1bd3c Merge pull request #3718 from SigmaHQ/rule-devel 
Rule devel
 2022-11-19 11:33:53 +01:00
Florian Roth 66adbb43f7 chore: change modified date 2022-11-19 08:48:43 +01:00
Florian Roth 4e36ec7175 Update rules/windows/process_creation/proc_creation_win_susp_process_hacker.yml 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-11-19 08:45:58 +01:00
Florian Roth 009ef39ca0 Update rules/windows/process_creation/proc_creation_win_susp_process_hacker.yml 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-11-19 08:45:50 +01:00
Florian Roth 37f6586987 Update rules/windows/process_creation/proc_creation_win_susp_process_hacker.yml 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-11-19 08:45:39 +01:00
Florian Roth 4e27fec49b Update rules/windows/process_creation/proc_creation_win_susp_process_hacker.yml 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-11-19 08:45:30 +01:00
jstnk9 f0bac30cfb Update netflow_cleartext_protocols.yml (#3716) 2022-11-18 15:55:11 +01:00
frack113 59ccb74bc6 Add proc_creation_win_susp_powercfg 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-11-18 11:26:04 +01:00
Nasreddine Bencherchali 6603ca9202 fix: update rules to not use regex 2022-11-18 11:16:13 +01:00
Nasreddine Bencherchali 7804decd2d feat: add more clarification to the test (#3710) 
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
 2022-11-18 11:15:50 +01:00
Nasreddine Bencherchali 20b0a6bad8 Rule Dev 2022-11-18 11:15:28 +01:00
nikitah4x 0f496be1e5 Add new rule to detect PST export when eDiscovery alert policy is disabled (M365) 2022-11-18 08:40:39 +01:00
frack113 cd3082c3f2 Add proc_creation_win_susp_msbuild (#3708) 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-11-18 08:29:50 +01:00
sysradwin b851fe17b9 Update proc_creation_win_base64_reflective_assembly_load.yml 2022-11-17 13:03:32 -05:00
Florian Roth 5c5639cfc6 Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel 2022-11-17 17:34:50 +01:00
Florian Roth 860b290f32 fix: change casing 2022-11-17 17:34:48 +01:00
Florian Roth 18a44625fc Merge pull request #3702 from nasbench/nasbench-rule-devel 
fix: fix issues and deprecate rule
 2022-11-17 14:49:43 +01:00
Nasreddine Bencherchali 54a94f6f1c fix: add more cases 2022-11-17 10:26:00 +01:00
Nasreddine Bencherchali ef91852c44 fix: update modified date 2022-11-17 10:15:58 +01:00
Nasreddine Bencherchali 6674ed0554 fix: add removed comments 2022-11-17 00:57:24 +01:00
Nasreddine Bencherchali ae149345b5 fix: fix #1972 2022-11-17 00:53:00 +01:00
Nasreddine Bencherchali 061f93364e fix: update invoke-obfuscation rules 2022-11-17 00:25:04 +01:00
Nasreddine Bencherchali b03ccf6844 fix: fix #3699 2022-11-16 23:41:16 +01:00
Florian Roth 136398698b fix: list with one element 2022-11-16 20:18:30 +01:00
Florian Roth 4234018e22 fix: duplicate uuid 2022-11-16 20:17:29 +01:00
Florian Roth 54669f283d Merge branch 'master' into rule-devel 2022-11-16 18:12:30 +01:00
Florian Roth c79f594425 rule: proc hacker, system informer driver load; refactor: imphash casing 2022-11-16 18:12:23 +01:00
Florian Roth 890c2496d1 Merge pull request #3695 from nasbench/add-missing-originalfilename 
feat: add missing `OriginalFileName` field
 2022-11-16 10:44:54 +01:00
Florian Roth eefa2da8b4 Merge pull request #3700 from jstnk9/master 
Update rpc_firewall_eventlog_recon.yml
 2022-11-16 08:55:49 +01:00
Nasreddine Bencherchali 569d1d757a fix: remove non existent eid and fix #2744 2022-11-15 22:58:19 +01:00
Nasreddine Bencherchali 11ce8a1e5b fix: deprecate 5f113a8f-8b61-41ca-b90f-d374fa7e4a39 2022-11-15 22:56:51 +01:00
jstnk9 9ec8d40b42 Update rpc_firewall_eventlog_recon.yml 
removed duplicated ref
 2022-11-15 21:58:53 +01:00
Nasreddine Bencherchali 38688b6e68 fix: fix remarks after review 2022-11-15 10:01:11 +01:00
Florian Roth 187cb6b47e Merge pull request #3694 from SigmaHQ/aurora-false-positive-fixing 
Aurora false positive fixing
 2022-11-15 09:35:45 +01:00
Nasreddine Bencherchali f0f660100a fix: fixed broken condition 2022-11-15 00:02:19 +01:00
Nasreddine Bencherchali 7f736b7443 feat: add missing OriginalFileName field 
First batch
 2022-11-14 23:08:19 +01:00
Florian Roth d8704daf79 fix: change modified date 2022-11-14 17:21:08 +01:00
Florian Roth d43517078b fix: modifier 2022-11-14 17:08:08 +01:00
Florian Roth f0681fc49f add another character 2022-11-14 17:06:20 +01:00
Florian Roth c03944c700 fix: condition 2022-11-14 14:24:00 +01:00
phantinuss 64d10f845a fix: FPs in testing environment 2022-11-14 08:54:47 +01:00
Florian Roth 0fb1295157 fix: FPs noticed with Aurora 2022-11-13 20:26:03 +01:00
Florian Roth 91acad69a8 fix: field value 2022-11-12 09:39:25 +01:00
Florian Roth c6d02d6fe2 rule: modified date update, PPLKiller 2022-11-12 09:27:41 +01:00
Florian Roth 6f26d672f1 refactor: add forkatz imphash 2022-11-12 08:39:36 +01:00
Florian Roth b0d47b303e Merge branch 'master' into aurora-false-positive-fixing 2022-11-12 08:34:48 +01:00
Florian Roth c37e099271 Merge branch 'master' into rule-devel 2022-11-12 08:33:29 +01:00
Florian Roth 951ad8c453 rule: suspicious command line flags 2022-11-12 08:33:21 +01:00
Florian Roth f94f0727c4 fix: FPs noticed with Aurora and VStudio 2022-11-12 08:33:04 +01:00
Florian Roth 99b865b603 Merge pull request #3690 from nasbench/nasbench-rule-devel 
Rule Dev
 2022-11-11 18:41:58 +01:00