aa1eff5419
fix FP on rmdir matching dir
2020-02-24 05:23:23 -05:00
bfab143c7c
Merge pull request #632 from EccoTheFlintstone/fp_fix
...
fix false positive on taskkill.exe not related to service stop at all
2020-02-24 09:58:33 +01:00
f807dae69a
fix false positive on taskkill.exe not related to service stop at all
2020-02-24 03:03:46 -05:00
1703b725d3
fix non ascii character in rule
2020-02-24 02:58:34 -05:00
48d95f027c
Merge branch 'oscd'
2020-02-20 23:11:57 +01:00
373424f145
Rule fixes
...
Made tests pass the new CI tests. Added further allowed lower case words
in rule test.
2020-02-20 23:00:16 +01:00
6413730810
fix: fixing too restrictive rule
...
https://twitter.com/Hexacorn/status/1229702521679118336
2020-02-18 10:43:22 +01:00
04b97bd84c
fix: character in filename
2020-02-18 10:19:48 +01:00
cd607d4fed
rule: process dump via rundll32 and comsvcs.dll's MiniDumpW
2020-02-18 10:04:55 +01:00
73dfc847fc
rule: changed lsass process dump to level high
2020-02-18 10:03:25 +01:00
b9c745a1b2
New Koadic detection rule
2020-02-16 16:48:49 +01:00
d0e284ae18
fix typo (duplicates)
2020-02-16 18:19:25 +03:00
f118839664
Further fixes and deduplications
...
From suggestions of @yugoslavskiy in issue #554 .
2020-02-16 14:03:07 +01:00
77c927bc14
Revert "Moved rules with enrichments into unsupported"
...
This reverts commit ba83b8862a
2020-02-15 22:52:06 +01:00
080532d20c
logsource change
...
I've swapped the lines in the logsource section to make it clearer that the category "process_creation" covers all sources that generate process creation logs on the windows platform.
2020-02-07 15:47:27 +01:00
f70f847524
additional gallium ttp
...
sha1 process creation only makes sense for sysmon
2020-02-07 14:08:40 +00:00
7fdd6f7bce
Swapped accidental deletion of older rule duplicate
2020-02-06 23:41:05 +01:00
d7bd90cb24
Merge branch 'master' into oscd
2020-02-03 23:13:16 +01:00
f7394d09e0
Deduplication
2020-02-03 22:41:55 +01:00
815c562a17
Merge branch 'master' into oscd
2020-02-02 13:40:08 +01:00
ba83b8862a
Moved rules with enrichments into unsupported
2020-02-02 12:46:03 +01:00
593abb1cce
OSCD QA wave 3
2020-02-02 12:41:12 +01:00
0d7f55948c
additional execution observed
2020-02-02 08:07:00 +01:00
aa8a0f5e1f
Merge pull request #606 from Neo23x0/devel
...
refactor: moved rues from 'apt' folder in respective folders
2020-02-01 18:25:19 +01:00
03ecb3b8dc
refactor: moved rues from 'apt' folder in respective folders
2020-02-01 17:59:26 +01:00
6ea861da53
Merge pull request #605 from Neo23x0/devel
...
Winnti rule and helpful message in test script
2020-02-01 15:51:16 +01:00
a752e6c95f
rule: winnti group campaign against HK universities
2020-02-01 15:43:30 +01:00
848e0c90e4
Merge branch 'master' into master
2020-01-31 14:45:29 +01:00
82cae6d63c
Merge pull request #604 from Neo23x0/devel
...
New tests, colorized test output and rule cleanup
2020-01-31 07:07:13 +01:00
ae2c186872
rule: wsreset.exe UAC bypass
2020-01-30 18:05:47 +01:00
d42e87edd7
fix: fixed casing and long rule titles
2020-01-30 17:26:09 +01:00
e79e99c4aa
fix: fixed missing date fields in remaining files
2020-01-30 16:07:37 +01:00
30d872f98f
Merge pull request #492 from booberry46/master
...
Bypass Windows Defender
2020-01-30 14:27:30 +01:00
d2122b6b83
Merge pull request #594 from sreemanshanker/master
...
Sigma rule to Monitor for writing of malicious files to system32 and syswow64 folders
2020-01-30 09:14:58 +01:00
a01773681a
fix: filename
2020-01-30 08:18:29 +01:00
529e95e3a5
Fixed everything
...
This rule had a lot of errors and problems.
- title
- file name
- status stable > experimental
- field order
- indentation
- unnecessary use of regular expressions
- interesting fields incomplete
- missing date
- missing id
- reference not as list
2020-01-30 08:17:46 +01:00
4c90e636b1
changed file name
2020-01-30 08:07:56 +01:00
a935cea665
fix: condition
2020-01-30 08:06:53 +01:00
d5c7b4795d
Add files via upload
2020-01-30 11:29:01 +08:00
a816f4775f
rule: FromBase64String command line
2020-01-29 16:05:12 +01:00
7786edac29
rule: dctask64.exe evasion techniques
...
https://twitter.com/gN3mes1s/status/1222088214581825540
2020-01-28 11:29:24 +01:00
5f0589b787
rule: mstsc shadowing
2020-01-24 16:18:19 +01:00
e24ea159f3
rule: split up renamed binary rule
2020-01-24 15:31:07 +01:00
8fbe08d5fa
Update win_system_exe_anomaly.yml
...
fixing to much original fork.
2020-01-24 15:31:06 +01:00
9f3672fdc0
Update win_system_exe_anomaly.yml
...
Following sigma event I've noticed my twitter account was referenced:
https://twitter.com/GelosSnake/status/934900723426439170
Rule:
https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_system_exe_anomaly.yml
Seems like - '\SystemRoot\System32\\*' is missing and hence triggering an FP.
2020-01-24 15:31:06 +01:00
5f8b152166
Added new sticky key attack binary
2020-01-24 15:31:06 +01:00
5d04c76f68
svchost spawned without cli
2020-01-24 15:31:06 +01:00
032c382184
corrected logic
2020-01-24 15:31:06 +01:00
991e3b8a51
Trickbot behavioral recon activity
2020-01-24 15:31:06 +01:00
9bb50f3d60
OSCD QA wave 2
...
* Improved rules
* Added filtering
* Adjusted severity
2020-01-17 15:46:28 +01:00
ecco