308420bf7f
Update sysmon_dllhost_net_connections.yml
...
Fix @
2020-07-13 21:20:55 +02:00
007f62ba01
Add Dllhost WAN access
2020-07-13 21:12:37 +02:00
f12cb7309b
fix: references is not a list
2020-07-13 17:37:03 +02:00
437a567e4f
Merge pull request #917 from Neo23x0/rule-devel
...
New Empire Rules and Updates
2020-07-13 16:37:59 +02:00
557e8b0faf
rule: improved Empire detection
2020-07-13 15:47:53 +02:00
7e8aa7b12b
Merge pull request #915 from Neo23x0/rule-devel
...
rule: regsvr32 flags anomaly
2020-07-13 12:16:05 +02:00
7a63fd56da
rule: regsvr32 flags anomaly
2020-07-13 11:59:44 +02:00
25d978d9bd
Update powershell_shellcode_b64.yml logsource to use the correct Sigma schema values
2020-07-11 22:17:06 -04:00
3ab5eb97d8
Merge pull request #901 from brachera/master
...
rule: Leviathan registry key
2020-07-10 16:42:02 +02:00
49aa0b4621
Merge pull request #909 from EccoTheFlintstone/fp2
...
add WMI module load false positive
2020-07-10 15:45:53 +02:00
5de82628fa
Update sysmon_apt_leviathan.yml
2020-07-10 15:41:55 +02:00
168952840b
Merge pull request #910 from Neo23x0/rule-devel
...
Rule devel
2020-07-10 14:17:22 +02:00
268a28daed
rule: Evilnum Golden Chicken rule OCX
2020-07-10 13:02:52 +02:00
e30eaa0202
be more specific about file location
2020-07-09 13:33:59 -04:00
94e3bd9e6b
add WMI module load false positive
2020-07-09 13:32:21 -04:00
905f1b3823
add WMI and powershell false positives
2020-07-09 10:26:54 -04:00
7949729fa4
rule: PowerShell encoded character syntax
2020-07-09 08:52:32 +02:00
e3734aaa27
fix: missing upper tick
2020-07-08 15:53:04 +02:00
efae210556
adding google chrome to FP list
...
legitimate errors generated by Google Chrome are reported often.
Official google standpoint on this:
https://support.google.com/chrome/a/thread/15440066?hl=en
2020-07-08 16:44:41 +03:00
205b584e80
Merge branch 'pr-829'
2020-07-07 23:42:57 +02:00
3e17cc1900
Merge pull request #894 from caliskanfurkan/master
...
ditsnap, a credential access tool used in ransomware attacks
2020-07-07 23:21:36 +02:00
28013a15e1
Improved rule
2020-07-07 23:18:07 +02:00
90f09f7b12
Merge branch 'devel' of https://github.com/diskurse/sigma into pr-829
2020-07-07 23:15:39 +02:00
3c760fabc1
Merge pull request #745 from Rettila/master
...
Added new rules
2020-07-07 23:14:19 +02:00
7eb499ad85
Added rule id
2020-07-07 22:54:55 +02:00
360b5714a8
Splitted and improved new rule
2020-07-07 22:47:14 +02:00
0ce5f2cc75
Merge branch 'patch-2' of https://github.com/4A616D6573/sigma into pr-483
2020-07-07 22:37:11 +02:00
4762a59b89
Merge pull request #891 from rtkbkish/image-load-fixes
...
Fix typo for rule in image_load category
2020-07-07 22:31:32 +02:00
2032a1e7fd
Merge pull request #898 from rtkbkish/fix-uac-registry
...
Proposed fix for sysmon_uac_bypass_eventvwr
2020-07-07 22:29:39 +02:00
9e85731253
Merge pull request #899 from rtkbkish/refix-rules
...
Re-fix sysmon rules that lost changes with category refactoring.
2020-07-07 22:28:37 +02:00
90983dcc4b
add level field to rule
2020-07-07 14:28:18 +01:00
f549a14d9a
rule: Leviathan registry key
2020-07-07 13:27:57 +01:00
99ac4f1f3d
fix: FPs with RedMimicry rule
2020-07-07 10:11:58 +02:00
c758ca0eb9
Re-fix sysmon rules that are lost changes with category refactoring.
...
Several fixes for sysmon rules got lost when the rules were refactored to use
categories.
Re-add the fixes.
https://github.com/Neo23x0/sigma/commit/38afd8b5def24191616ff0f0c0324cfbb7f0d6d0
https://github.com/Neo23x0/sigma/commit/422b2bffd77b217e6cec9a67c496b0aa44711ece
https://github.com/Neo23x0/sigma/commit/dfae2a6df6f5bbc90a7b476c22fc9c8fedab47e9
2020-07-06 10:55:42 -04:00
7e06fd80fd
Proposed fix for sysmon_uac_bypass_eventvwr
...
Issue: https://github.com/Neo23x0/sigma/issues/888
The rules were not merged correctly with the transition to sysmon categories.
Split the rule into separate documents: one for the registry_event and one for
the process_creation
2020-07-06 09:20:34 -04:00
939156fa6d
Introduced dns_query log source category
2020-07-05 23:29:51 +02:00
0df21289a0
Merge branch 'dns-fixes' of https://github.com/rtkbkish/sigma into pr-893
2020-07-05 23:24:56 +02:00
c51b4d0524
Merge pull request #890 from rtkbkish/file-event-fixes
...
Fixes for rules in the sysmon file_event category
2020-07-05 13:13:24 +02:00
4a810dd136
Merge pull request #886 from Neo23x0/rule-devel
...
Windows Curl Rules
2020-07-05 13:12:41 +02:00
8ef82e48eb
ditsnap
2020-07-04 23:21:52 +03:00
8b3b312c4e
Proposed fix for https://github.com/Neo23x0/sigma/issues/889
...
This change removes dns events from the network connection category. The
one change is that sysmon_regsvr32_network_activity.yml needs to test
the network connection category separately from the DNS event id.
2020-07-03 16:28:19 -04:00
7031d9e2b8
Fix typo for rule in image_load category
...
image_load not image_loaded.
2020-07-03 16:23:17 -04:00
1e9d0e9653
Fixes for rules in the sysmon file_event category
...
Fix a couple of typos
For sysmon_hack_dumpert:
Make sure the logsource is category file_event and not sysmon. Don't set
the category at the global level. Instead set in the individual document.
2020-07-03 16:22:29 -04:00
4b31633355
Fixes for rules in new sysmon registry_event category
...
To be consistent with the behaviour of the other rules, the eventID should not
be specified as part of the rule. The category defines the eventID.
2020-07-03 16:20:37 -04:00
11517edbd7
rule: suspicious curl usage
2020-07-03 18:55:44 +02:00
c4267a4614
rule: suspicious curl file upload
2020-07-03 18:20:44 +02:00
80f15a1e50
Merge pull request #885 from Neo23x0/rule-devel
...
fix: trailing whitespace
2020-07-03 18:00:19 +02:00
4d9e2e8c16
fix: trailing white space
2020-07-03 17:59:50 +02:00
26d8810efb
Merge pull request #882 from Neo23x0/rule-devel
...
Rule devel
2020-07-03 15:33:55 +02:00
4dc818aafd
fix: rar flags rule caused too many FPs
2020-07-03 13:20:24 +02:00
Bart