 frack113
|
abcaf00aee
|
Merge pull request #1818 from frack113/split_1802_net
Correct lists with only 1 value
|
2021-08-13 10:17:24 +02:00 |
|
|
Florian Roth
|
852d7a8b22
|
fix: typo in description
|
2021-08-12 10:11:17 +02:00 |
|
|
Florian Roth
|
a9ad4eda4a
|
rules: ProxyShell refactoring and new rule
|
2021-08-09 17:57:34 +02:00 |
|
|
frack113
|
fc64b8b937
|
Split PR 1802 fix net rules
|
2021-08-09 17:23:15 +02:00 |
|
|
Florian Roth
|
af1e43f3c1
|
more generic
|
2021-08-08 23:05:56 +02:00 |
|
|
Florian Roth
|
a80f9f280c
|
refactor: feedback from Rich Warren
|
2021-08-08 23:05:23 +02:00 |
|
|
Florian Roth
|
5443298092
|
rule: ProxyShell improved
|
2021-08-08 18:52:49 +02:00 |
|
|
Florian Roth
|
0a8904a61e
|
fix: issues with new rule
|
2021-08-07 10:10:12 +02:00 |
|
|
Florian Roth
|
1ac49a2055
|
rule: ProxyShell patterns
|
2021-08-07 09:22:24 +02:00 |
|
|
G Y
|
544ec5861b
|
Update web_nginx_core_dump.yml
Fixed typo in description field.
|
2021-07-03 10:39:37 +08:00 |
|
|
Florian Roth
|
f438039af9
|
Update web_cve_2021_22893_pulse_secure_rce_exploit.yml
|
2021-07-01 09:49:01 +02:00 |
|
|
Sittikorn S
|
c9ce298b2e
|
Update web_cve_2021_22893_pulse_secure_rce_exploit.yml
remove http response
|
2021-06-29 17:49:01 +07:00 |
|
|
Sittikorn S
|
14d1c68cc8
|
Update web_cve_2021_22893_pulse_secure_rce_exploit.yml
|
2021-06-29 15:19:22 +07:00 |
|
|
Sittikorn S
|
67f483e6a9
|
Update web_cve_2021_22893_pulse_secure_rce_exploit.yml
|
2021-06-29 14:17:27 +07:00 |
|
|
Sittikorn S
|
c446c519cf
|
Update web_cve_2021_22893_pulse_secure_rce_exploit.yml
|
2021-06-29 13:59:08 +07:00 |
|
|
Sittikorn S
|
f3c1d78615
|
Create web_cve_2021_22893_pulse_secure_rce_exploit.yml
|
2021-06-29 13:56:30 +07:00 |
|
|
Florian Roth
|
ab73dd4dd6
|
rule: nginx core dump
|
2021-05-31 10:49:42 +02:00 |
|
|
Florian Roth
|
02323043d7
|
Create web_cve_2021_26814_wzuh_rce.yml
|
2021-05-22 15:45:38 +02:00 |
|
|
Florian Roth
|
3cf1be9e8d
|
rule: exchange vulnerability CVE-2021-28480
|
2021-05-14 10:08:41 +02:00 |
|
|
Josh Brower
|
af09dd8e3c
|
Clean up: Webshell ReGeorg Detection
|
2021-04-05 13:01:10 -04:00 |
|
|
Florian Roth
|
428db0c74a
|
Merge pull request #1382 from d4rk-d4nph3/master
Added rule for CVE-2021-21978 in VMware View Planner
|
2021-03-29 11:22:56 +02:00 |
|
|
Bhabesh Rai
|
a58c5ed7cc
|
Added rule for CVE-2021-21978 in VMware View Planner
|
2021-03-10 18:05:15 +05:45 |
|
|
Florian Roth
|
dca5c870d7
|
Merge pull request #1374 from hieuttmmo/master
Detect HAFNIUM operations
|
2021-03-09 09:16:52 +01:00 |
|
|
Florian Roth
|
62b65a3578
|
Merge pull request #1375 from SigmaHQ/rule-devel
fix: description
|
2021-03-04 17:35:53 +01:00 |
|
|
Florian Roth
|
bea2f226c6
|
fix: description
|
2021-03-04 17:35:25 +01:00 |
|
|
Tran Trung Hieu
|
5f74a58081
|
Detect HAFNIUM operations
|
2021-03-04 00:01:54 +07:00 |
|
|
Florian Roth
|
9e921115bc
|
Merge pull request #1373 from SigmaHQ/rule-devel
HAFNIUM rule
|
2021-03-03 10:34:08 +01:00 |
|
|
Florian Roth
|
d8ded5ebdc
|
refactor: changed symbols after feedback from Volexity
|
2021-03-03 10:15:45 +01:00 |
|
|
Florian Roth
|
e17986ebd3
|
rule: HAFNIUM Exchange exploitation
|
2021-03-03 09:58:43 +01:00 |
|
|
Florian Roth
|
73a3a1e5cd
|
Merge pull request #1360 from d4rk-d4nph3/master
Added sigma rule for vSphere RCE CVE-2021-21972
|
2021-03-03 09:32:05 +01:00 |
|
|
Florian Roth
|
8c95f90075
|
Update web_vsphere_cve_2021_21972_unauth_rce_exploit.yml
|
2021-03-03 09:08:24 +01:00 |
|
|
Bhabesh Rai
|
e1dff01cea
|
Added sigma rule for vSphere RCE CVE-2021-21972
|
2021-02-24 23:48:08 +05:45 |
|
|
Florian Roth
|
96803a5a27
|
Merge pull request #1355 from Neo23x0/rule-devel
Rule devel
|
2021-02-22 17:46:21 +01:00 |
|
|
Florian Roth
|
aea03076c2
|
rule: simplified rule
|
2021-02-22 17:19:14 +01:00 |
|
|
Florian Roth
|
43b2ad580f
|
rule: DEWMODE webshell
|
2021-02-22 17:15:32 +01:00 |
|
|
Florian Roth
|
f62fc2e889
|
Merge pull request #1341 from d4rk-d4nph3/master
Added rule for TerraMaster TOS CVE-2020-28188
|
2021-02-18 11:17:48 +01:00 |
|
|
Bhabesh Rai
|
a8d33171d7
|
Fixed c-uri
|
2021-02-02 10:23:47 +05:45 |
|
|
Florian Roth
|
6b9eef58da
|
Merge pull request #1338 from Neo23x0/rule-devel
Improved UNC2452 activity rules
|
2021-01-25 14:36:44 +01:00 |
|
|
Florian Roth
|
a4bec724a6
|
rule: SonicWall exploitation
|
2021-01-25 11:54:23 +01:00 |
|
|
Bhabesh Rai
|
465ab713b0
|
Added rule for TerraMaster TOS CVE-2020-28188
|
2021-01-25 13:01:27 +05:45 |
|
|
Bhabesh Rai
|
dac229a8bb
|
Added rule for Oracle WebLogic Exploit CVE-2021-2109
|
2021-01-20 14:28:18 +05:45 |
|
|
Florian Roth
|
30dcc28a1f
|
Cisco ASA FTD Exploit CVE-2020-3452
|
2021-01-07 13:17:58 +01:00 |
|
|
Florian Roth
|
0a83f91386
|
Merge pull request #1321 from d4rk-d4nph3/master
Fixed typo in file format
|
2020-12-28 09:13:48 +01:00 |
|
|
Bhabesh Rai
|
bf77c8266a
|
Fixed typo in file format
|
2020-12-28 11:46:02 +05:45 |
|
|
Florian Roth
|
896fc21911
|
Merge pull request #1320 from d4rk-d4nph3/master
Added rule for CVE-2020-10148 SolarWinds Orion API Authentication Bypass
|
2020-12-27 20:37:36 +01:00 |
|
|
Florian Roth
|
a6212a4490
|
style: some minor style changes
|
2020-12-27 20:06:19 +01:00 |
|
|
Bhabesh Rai
|
1cfad987b0
|
Added rule for CVE-2020-10148 SolarWinds Orion API Authentication Bypass
|
2020-12-27 17:34:49 +05:45 |
|
|
Florian Roth
|
821af35557
|
Merge pull request #1313 from Neo23x0/rule-devel
Rule devel
|
2020-12-23 13:57:11 +01:00 |
|
|
Florian Roth
|
e67d17a967
|
rule: improved solarwinds webshell rule
|
2020-12-22 10:36:34 +01:00 |
|
|
Florian Roth
|
e78d7e6aee
|
Merge pull request #1296 from mat-gas/fix-references
fix "references" field + add test for references in plural form
|
2020-12-21 18:25:35 +01:00 |
|