 frack113
|
769451dc03
|
Add missing id
|
2021-09-03 13:42:15 +02:00 |
|
|
frack113
|
815134df7f
|
Cleanup
|
2021-09-03 13:30:10 +02:00 |
|
|
zakibro
|
8bd859f550
|
Update lnx_auditd_system_info_discovery.yml
|
2021-09-03 13:07:42 +02:00 |
|
|
Pawel Mazur
|
864286e206
|
New Rule - Linux-Auditd-System Information Discovery
|
2021-09-03 11:33:18 +02:00 |
|
|
frack113
|
b731c20594
|
Merge pull request #1971 from phantinuss/master
fix: prevent possible FPs
|
2021-09-02 15:34:46 +02:00 |
|
|
frack113
|
a048403089
|
Merge pull request #1973 from klingerko/cs_namedpipe_updates
Remove duplicate and regex improvements
|
2021-09-02 15:25:01 +02:00 |
|
|
phantinuss
|
ab721c736c
|
chore: move level/falsepositives to bottom
|
2021-09-02 14:55:17 +02:00 |
|
|
klingerko
|
15e25f9635
|
update modifed date
|
2021-09-02 14:50:14 +02:00 |
|
|
phantinuss
|
0b373ff1e9
|
fix: remove 2nd selection due to FPs
|
2021-09-02 14:47:47 +02:00 |
|
|
phantinuss
|
5cb6eed52e
|
fix: remove single value lists
|
2021-09-02 14:09:03 +02:00 |
|
|
phantinuss
|
f4a5df67ae
|
further narrowing down of the selection, therefore removing the filter
|
2021-09-02 10:28:01 +02:00 |
|
|
Florian Roth
|
0603581111
|
Merge pull request #1969 from SigmaHQ/rule-devel
More Named Pipe Rules and WMI rule refactoring
|
2021-09-02 10:15:00 +02:00 |
|
|
frack113
|
5212b388c6
|
Merge pull request #1967 from d4rk-d4nph3/master
Added rule for detection of Atera RMM Agent installation
|
2021-09-02 09:19:49 +02:00 |
|
|
Thomas Patzke
|
51bc036dbf
|
Merge pull request #1921 from roysjosh/azure-sentinel-arm-output
Azure Sentinel support
|
2021-09-01 22:26:42 +02:00 |
|
|
Thomas Patzke
|
3d6ad1bc0f
|
Merge pull request #1944 from ncrqnt/elastic-subtechniques
[Elastic] Add support for authors and subtechniques
|
2021-09-01 22:25:10 +02:00 |
|
|
Thomas Patzke
|
6d3f7069e6
|
Merge pull request #1962 from neu5ron/qoutes_and_wildcards
Elasticsearch Backend fix small corner cases of quotes and wildcards
|
2021-09-01 22:08:40 +02:00 |
|
|
Konstantin Klinger
|
457da818a4
|
regex optimisations
|
2021-09-01 17:06:55 +02:00 |
|
|
Konstantin Klinger
|
e83ee55573
|
remove duplicate
|
2021-09-01 17:05:36 +02:00 |
|
|
Florian Roth
|
b0c2d7b75a
|
fix: tags for WMI / execution / persistence
|
2021-09-01 16:34:50 +02:00 |
|
|
Florian Roth
|
2f7f050ad8
|
fix: removed tags
|
2021-09-01 16:32:27 +02:00 |
|
|
phantinuss
|
0b38237dbf
|
fix: add relation to now obsolete rule
|
2021-09-01 15:38:29 +02:00 |
|
|
phantinuss
|
ae9966bdcc
|
fix: unifying two overlapping rules
|
2021-09-01 14:48:32 +02:00 |
|
|
phantinuss
|
deefcaa8ac
|
fix: prevent possible FPs with the respective command only used as the last parameter
|
2021-09-01 14:33:46 +02:00 |
|
|
frack113
|
434c3891ff
|
Merge pull request #1965 from frack113/add_tags
Add tags when missing
|
2021-09-01 14:07:31 +02:00 |
|
|
Florian Roth
|
1aac21ba79
|
fix: single list item issue
|
2021-09-01 14:03:42 +02:00 |
|
|
Florian Roth
|
1c4f642227
|
Merge pull request #1699 from matsto/patch-1
Fixed transformation modifier for keywords
|
2021-09-01 14:02:10 +02:00 |
|
|
Florian Roth
|
505140d273
|
rule: extended WMI suspicious scripts rule
|
2021-09-01 13:57:48 +02:00 |
|
|
Florian Roth
|
e787420be1
|
rule: WMI filter content encoded executable
|
2021-09-01 13:57:36 +02:00 |
|
|
Florian Roth
|
8761927e8c
|
rule: susp scrcons.exe creating named pipe
|
2021-09-01 13:57:17 +02:00 |
|
|
Florian Roth
|
affc929c3b
|
LiquidSnake named pipe
|
2021-09-01 13:54:47 +02:00 |
|
|
Florian Roth
|
c8b3036949
|
Merge pull request #1968 from SigmaHQ/rule-devel
docs: note to improved sysmon config
|
2021-09-01 13:21:28 +02:00 |
|
|
Florian Roth
|
f102b2d9a1
|
docs: note to improved sysmon config
|
2021-09-01 13:07:18 +02:00 |
|
|
Florian Roth
|
8bba246205
|
refactor: better way to write it
|
2021-09-01 12:57:34 +02:00 |
|
|
frack113
|
2cb5f5e4c6
|
add missing tags
|
2021-09-01 12:54:21 +02:00 |
|
|
Florian Roth
|
c146bc44c7
|
Merge branch 'master' into patch-1
|
2021-09-01 12:48:51 +02:00 |
|
|
Bhabesh Rai
|
6859b6c38f
|
Added rule for detection of Atera RMM Agent installation
|
2021-09-01 15:24:47 +05:45 |
|
|
frack113
|
af599e4877
|
Merge pull request #1958 from phantinuss/master
Bulk of new rules, mainly UAC Bypasses
|
2021-09-01 10:53:02 +02:00 |
|
|
frack113
|
892c58270a
|
Update tags
|
2021-09-01 10:33:57 +02:00 |
|
|
frack113
|
4b8ffbc183
|
Update tags
|
2021-09-01 10:30:43 +02:00 |
|
|
phantinuss
|
9ffdced740
|
fix: implement suggestions from PR discussion
|
2021-09-01 10:21:37 +02:00 |
|
|
frack113
|
240c5584ff
|
update tags
|
2021-09-01 09:56:46 +02:00 |
|
|
frack113
|
6f3fc7036e
|
Update tags
|
2021-09-01 09:45:31 +02:00 |
|
|
frack113
|
3ed7d6e330
|
Merge pull request #1959 from frack113/update_ps
Update PowerShell rules
|
2021-09-01 08:06:31 +02:00 |
|
|
frack113
|
b8a1f4c63b
|
Merge pull request #1961 from SigmaHQ/rule-devel
SideWalk User-Agent used by Sparkling Goblin
|
2021-09-01 08:06:15 +02:00 |
|
|
frack113
|
9671d6c0db
|
Merge pull request #1960 from austinsonger/sysmon_dns_over_https_enabled.yml
sysmon_dns_over_https_enabled.yml
|
2021-08-31 18:37:29 +02:00 |
|
|
neu5ron
|
414e851108
|
Merge branch 'master' into qoutes_and_wildcards
Signed-off-by: neu5ron <neu5ron@users.noreply.github.com>
|
2021-08-31 12:06:20 -04:00 |
|
|
Florian Roth
|
9b20060275
|
SideWalk UA
|
2021-08-31 17:14:19 +02:00 |
|
|
frack113
|
cff572b752
|
Update sysmon_dns_over_https_enabled.yml
|
2021-08-31 17:11:04 +02:00 |
|
|
phantinuss
|
add1ad40f8
|
additional UAC bypass rule
|
2021-08-31 16:23:32 +02:00 |
|
|
phantinuss
|
59d8e0b866
|
add System IntegrityLevel to uac bypass rules, the level is not used most of the time, but might
|
2021-08-31 16:18:05 +02:00 |
|