7a33aac1ed
Update lnx_auditd_keylogging_with_pam_d.yml
...
adding missing uuid
2022-05-24 17:15:54 +02:00
89d88288d6
New detection - Linux Keylogging
2022-05-24 17:05:38 +02:00
662c13a720
Merge pull request #3035 from redsand/hawk_backend_cfg_update
...
Backend: adding additional entries to hawk.yml
2022-05-24 12:33:11 +02:00
522eb09635
Merge pull request #3037 from redsand/fp_powershell_ps_access_win_api
...
FP: filtering out Amaazon AWS header
2022-05-24 12:32:58 +02:00
3b360544a5
Merge pull request #3038 from redsand/hawk_backend_sys_update
...
Backend: because hawk splits up SYSTEM and NT AUTHORITY, additional t…
2022-05-24 12:32:34 +02:00
657e235420
Merge pull request #3040 from pH-T/master
...
added 'similar' related type to test_rules script
2022-05-24 11:11:37 +02:00
9b80dd990a
added 'similar' related type
2022-05-24 09:51:48 +02:00
b339901806
Backend: because hawk splits up SYSTEM and NT AUTHORITY, additional treatment is needed on some rules
2022-05-23 23:52:52 +00:00
0fb943dc2c
FP: fixing modifier
2022-05-23 21:43:43 +00:00
c807191ab7
FP: filtering out Amaazon AWS header
2022-05-23 21:41:13 +00:00
6ca03d741b
adding additional file hash column translation
2022-05-23 21:11:34 +00:00
605a0bc678
Backend: adding additional entries to hawk.yml
2022-05-23 18:46:50 +00:00
25edbeca69
Merge pull request #3034 from phantinuss/master
...
fix: FP found in testing environment
2022-05-23 17:18:25 +02:00
61c10d73e0
fix: FP found in testing environment
2022-05-23 16:45:27 +02:00
0053a35328
Merge pull request #3033 from martinspielmann/patch-1
...
Fix typo
2022-05-23 11:20:16 +02:00
86d11e62e8
Fix typo
2022-05-23 10:50:59 +02:00
bea6f18d35
Merge pull request #3024 from redsand/win_system_susp_eventlog_cleared
...
Making a derived detection for system/application/security event logs…
2022-05-20 20:56:00 +02:00
946e4582a3
Merge pull request #3030 from SigmaHQ/aurora-false-positive-fixing
...
fix: detection with Windows Defender
2022-05-20 20:05:43 +02:00
e86d007d35
Merge pull request #3027 from elhoim/rename_suspicious
...
Renamed suspicious in filenames to susp
2022-05-20 19:28:24 +02:00
e8f59c8d0f
fix: detection with Windows Defender
2022-05-20 19:27:48 +02:00
865f26a543
Merge pull request #3029 from tr0mb1r/patch-1
...
Update sysmon.yml
2022-05-20 15:28:24 +02:00
ab7d7dbed8
Update sysmon.yml
...
typo in config
2022-05-20 13:47:18 +04:00
94702f7f9e
Merge pull request #3028 from MatilJ/powershell_msxml_com
...
Fix on Powershell MsXml COM object
2022-05-19 20:48:25 +02:00
10f0a82b94
Fix detection
2022-05-19 21:09:47 +03:00
600a7cd0e8
Re-adding accidently removed entry
2022-05-19 17:16:39 +00:00
60e6a147b4
merging remote change
2022-05-19 16:11:58 +00:00
3f6cabcae8
Updating to include match on Channel
2022-05-19 16:08:34 +00:00
74b9f97b9c
Renamed suspicious in filenames to susp
2022-05-19 09:37:04 +02:00
79c4e769d2
Update README.md
2022-05-19 07:54:04 +02:00
003e5bee6d
Merge pull request #3018 from SigmaHQ/rule-devel
...
refactor: rule addition
2022-05-19 07:50:36 +02:00
a21adf8904
Update README.md
2022-05-19 07:45:01 +02:00
01ffec65fe
Merge pull request #2994 from ablescia/feat-hedera_backend
...
Hedera Backend - C# dynamic LINQ
2022-05-18 23:23:51 +02:00
3fe86e3b84
rule: grpconv execution
2022-05-18 17:56:26 +02:00
04a3dfeb01
Merge pull request #3025 from nasbench/master
...
Quick Updates and Fixes
2022-05-18 17:35:18 +02:00
7d296ef078
fix: change on deleted rule
2022-05-18 17:34:39 +02:00
99e81ea2eb
Merge branch 'pr/3023'
2022-05-18 17:33:10 +02:00
a55e8f2ac1
refactor: PoSh Defender Tampering
2022-05-18 17:29:38 +02:00
15cee5c0b1
Update proc_creation_win_susp_taskkill.yml
2022-05-18 17:28:26 +02:00
d620f11e84
Merge pull request #3021 from redsand/fix_err_in_assignment
...
User meant to use service vs category. currently no category assignme…
2022-05-18 17:16:30 +02:00
dcf236fede
Quick Updates and Fixes
...
- Added "Invoke-EventViewer.ps1" script to the rule "file_event_win_powershell_exploit_scripts"
- Added "OriginalFileName" to "proc_creation_win_susp_taskkill"
- Created rule for "winword" being used as a LOLBIN to download and load arbitrary DLLs
2022-05-18 12:50:59 +01:00
354e8ded4e
Merge pull request #3020 from nasbench/master
...
Rule Update (Batch 2)
2022-05-18 07:05:34 +02:00
28e0e157fe
Update win_system_susp_eventlog_cleared.yml
2022-05-17 21:32:00 +02:00
60a38a95ef
removing duplicate keywords entry
2022-05-17 18:54:01 +00:00
b5b7adcb9c
Making a derived detection for system/application/security event logs being cleared, vs any in general. fp due to custom applications clearing their eventlog
2022-05-17 18:49:54 +00:00
07a79acede
Update proc_creation_win_lolbas_extrac32.yml
2022-05-17 15:33:18 +01:00
389240855d
Update proc_creation_win_lolbas_extrac32.yml
2022-05-17 15:17:09 +01:00
3bbeab2a7b
Requested Changes
2022-05-17 15:04:26 +01:00
7ea6ed3db6
Merge pull request #3016 from frack113/ttdinjec
...
ttdinject lolbin
2022-05-17 06:28:22 +02:00
b49633d32b
#2902 : Remove t1547.006
2022-05-16 21:57:30 -05:00
4bafd1317b
User meant to use service vs category. currently no category assignment for "system". We need a unit test to detect new sections here, vs backends. this was untested in the field.
2022-05-16 22:18:35 +00:00
zakibro