8dba6ceee6
2nd review
2020-08-25 09:31:38 +03:00
1244cacfbf
Update lnx_auditd_create_account.yml
2020-08-25 09:20:27 +03:00
72fdf0da45
Update lnx_auditd_susp_cmds.yml
2020-08-04 20:00:30 +03:00
4e688233d7
ATT&CK mapping update suggestions for \linux\
2020-08-04 19:48:18 +03:00
1c63a93643
fix: wrong casing in tag
2020-07-13 16:20:51 +02:00
26f0d49772
Update lnx_shell_clear_cmd_history.yml
...
Renamed tags to match production MITRE: https://attack.mitre.org/techniques/T1070/003/
2020-07-13 14:06:14 +01:00
26d8810efb
Merge pull request #882 from Neo23x0/rule-devel
...
Rule devel
2020-07-03 15:33:55 +02:00
8a0262d1a2
fix: in linux keyword expression
2020-07-03 15:08:20 +02:00
5dd5b87f43
rule: guacamole exploitation detection
2020-07-03 13:20:03 +02:00
fa452bf3e5
Merge pull request #849 from omergunal/ogunal-1
...
Rules for detecting suspicious remote file copy
2020-07-03 11:59:45 +02:00
b9966a173c
Update lnx_file_copy.yml
2020-07-03 11:32:49 +02:00
4eb97ec43d
Update lnx_file_copy.yml
2020-06-22 21:35:50 +03:00
d17e0ae6eb
typo
2020-06-20 23:04:52 +03:00
93719d8a01
Merge pull request #1 from omergunal/omergunal-patch-1
...
Remote file copy
2020-06-18 23:56:29 +03:00
40a07a2d4f
Delete lnx_sudo_enumeration.yml
2020-06-18 23:55:24 +03:00
d87b0c95a4
Delete lnx_trap.yml
2020-06-18 23:55:16 +03:00
8db7c3207a
Delete lnx_sudo_caching.yml
2020-06-18 23:54:43 +03:00
5bc72b6cba
Delete lnx_space_after_filename.yml
2020-06-18 23:54:28 +03:00
f10440b9fa
Delete lnx_setuid_setgid.yml
2020-06-18 23:54:20 +03:00
6c8d104e7d
Delete lnx_disabling_security_tools.yml
2020-06-18 23:54:06 +03:00
84c4683607
Delete lnx_connection_proxy.yml
2020-06-18 23:53:43 +03:00
c6c455a3ec
Remote file copy
2020-06-18 23:37:49 +03:00
3a607abe33
Update lnx_trap.yml
2020-06-17 19:51:53 +03:00
7b86f4aefb
Update lnx_trap.yml
2020-06-17 19:47:31 +03:00
ebbd32d2e1
file extension
2020-06-17 19:43:57 +03:00
f989f7e155
file extension
2020-06-17 19:43:49 +03:00
772c03c49a
Connection Proxy
2020-06-17 19:39:55 +03:00
9d285ecf74
Trap
2020-06-17 19:39:00 +03:00
d0b66ab828
Space After Filename
2020-06-17 19:38:38 +03:00
3b8fb9e3d8
Disabling Security Tools
2020-06-17 19:38:10 +03:00
0fbfcc6ba9
Initial round of subtechnique updates
2020-06-16 14:46:08 -06:00
fd2429bd34
Update lnx_setuid_setgid.yml
2020-06-16 19:46:50 +02:00
06fe720165
Update lnx_sudo_enumeration.yml
2020-06-16 19:33:39 +02:00
545c05d4d3
Update lnx_setuid_setgid.yml
2020-06-16 19:31:34 +02:00
0027415fa2
Update lnx_setuid_setgid.yml
2020-06-16 20:26:50 +03:00
41b2309418
file type changed
2020-06-16 20:24:09 +03:00
0d0058da43
added id
2020-06-16 20:21:07 +03:00
bbcd506fb1
added id
2020-06-16 20:21:02 +03:00
ace575aaa6
added id
2020-06-16 20:20:42 +03:00
4b1557a587
Setuid and Setgid
...
Detects suspicious change of file privileges with chown and chmod commands
2020-06-16 20:12:24 +03:00
b7e1c6750c
sudo caching
...
attack.t1206
2020-06-16 19:31:02 +03:00
e43f13ed67
Update lnx_sudo_enumeration.yml
...
attack.t1169
2020-06-16 19:20:42 +03:00
52487159c5
Detect Sudo enumeration commands
2020-06-16 19:17:00 +03:00
74e16fdccd
Merge pull request #803 from gamma37/clear_cmd_history
...
Edit Clear Command History
2020-05-29 17:32:43 +02:00
537bda4417
Update lnx_shell_clear_cmd_history.yml
2020-05-28 10:56:35 +02:00
5a48934822
Edit Clear Command History
...
I suggest a new point of view to detect that bash_history has been cleared : Instead of trying to detect all the commands that can do that, we could monitor the size of the file and log whenever it has less than 1 line.
2020-05-28 10:52:17 +02:00
8321cc7ee1
Merge pull request #772 from gamma37/suspicious_activities
...
Create a rule for "suspicious activities"
2020-05-23 18:11:32 +02:00
e1a05dfc1c
Update lnx_auditd_susp_C2_commands.yml
2020-05-23 16:49:03 +02:00
71c507d8a9
remove space bedore colon
2020-05-18 11:34:53 +02:00
55eec46932
Create a rule for "suspicious activities"
2020-05-18 11:25:18 +02:00
Timur Zinniatullin