de5444a81e
Merge pull request #989 from oscd-initiative/master
...
[OSCD Initiative][ATT&CK tags update]
2020-09-08 13:27:58 +02:00
b9f7d58dbc
fix ADSI rule false positive
2020-09-06 09:17:53 -04:00
42c4079ed8
att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other
2020-08-25 01:09:17 +02:00
2b2bf34a64
add wmi persistence script event consumer false positive
2020-07-20 12:27:16 +08:00
dcf20e580d
Updated tags to include sub-techniques
2020-07-18 02:50:57 +01:00
23dd2e3cac
Updated to include sub-technique mapping
2020-07-18 02:29:58 +01:00
c758ca0eb9
Re-fix sysmon rules that are lost changes with category refactoring.
...
Several fixes for sysmon rules got lost when the rules were refactored to use
categories.
Re-add the fixes.
https://github.com/Neo23x0/sigma/commit/38afd8b5def24191616ff0f0c0324cfbb7f0d6d0
https://github.com/Neo23x0/sigma/commit/422b2bffd77b217e6cec9a67c496b0aa44711ece
https://github.com/Neo23x0/sigma/commit/dfae2a6df6f5bbc90a7b476c22fc9c8fedab47e9
2020-07-06 10:55:42 -04:00
1e9d0e9653
Fixes for rules in the sysmon file_event category
...
Fix a couple of typos
For sysmon_hack_dumpert:
Make sure the logsource is category file_event and not sysmon. Don't set
the category at the global level. Instead set in the individual document.
2020-07-03 16:22:29 -04:00
abf5f799d6
docs: more references
2020-07-03 13:19:44 +02:00
1f0b1e58a9
fix: bugs in rule and title
2020-07-03 09:54:10 +02:00
33fef8bcf5
DesktopImgDownLdr rules
2020-07-03 09:45:48 +02:00
9c0f9f398f
refactor: sysmon rule cleanup > generlization
2020-07-01 10:58:39 +02:00
154181c6c8
fix: renamed files and lien break change
2020-07-01 09:48:48 +02:00
d70b63b78c
rule: RedMimicry rules (modified)
2020-07-01 09:17:31 +02:00
f3fedef8f5
Changed category names and remove sysmon log source
2020-06-24 17:41:21 +02:00
Florian Roth