 Florian Roth
|
7ce7095c2c
|
fix: title with lower case letters
|
2021-05-27 15:01:32 +02:00 |
|
|
Florian Roth
|
3cd2730a26
|
rule: process hacker priv esc
|
2021-05-27 12:49:54 +02:00 |
|
|
Florian Roth
|
c0b93a010c
|
NCCGroup rules from rclone blog post
https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
|
2021-05-27 12:49:40 +02:00 |
|
|
Florian Roth
|
7812a4217c
|
rule: regedit as trustedinstaller
|
2021-05-27 11:36:05 +02:00 |
|
|
Florian Roth
|
b5352ac5f7
|
fix: duplicate UUIDs
|
2021-05-27 10:29:21 +02:00 |
|
|
Florian Roth
|
ffeda2a2a2
|
Merge pull request #1492 from frack113/es_rule_uuid
Fix errors when import es-rule ndjson to KIBANA
|
2021-05-27 10:24:39 +02:00 |
|
|
Florian Roth
|
f98716c672
|
Merge pull request #1500 from frack113/sigmac_add_time_filter
Sigmac add new filter
|
2021-05-27 10:16:19 +02:00 |
|
|
Florian Roth
|
fb07b204b4
|
Merge pull request #1510 from SigmaHQ/rule-devel
CobaltStrike Pipe Rule Changes
|
2021-05-26 18:30:34 +02:00 |
|
|
Florian Roth
|
a5fe7af25f
|
Cobalt Strike Service Installation
|
2021-05-26 18:05:38 +02:00 |
|
|
Florian Roth
|
c1cebe627a
|
refactor: reworked CS pipe rule
|
2021-05-26 17:22:34 +02:00 |
|
|
Florian Roth
|
d06f2bcf14
|
fix: sysmon backend "startswith"
|
2021-05-26 15:42:16 +02:00 |
|
|
Florian Roth
|
ba12057919
|
Merge pull request #1505 from WojciechLesicki/master
Update rule regarding other named pipe
|
2021-05-26 14:35:22 +02:00 |
|
|
Florian Roth
|
bb71860fb2
|
Merge pull request #1509 from vastlimits/feature/update-6.1
Updated uberAgent backend to support version 6.1.
|
2021-05-26 13:08:08 +02:00 |
|
|
Florian Roth
|
8aabb58eca
|
Merge pull request #1498 from w0rk3r/otrf
Update broken OTRF Threat Hunter Playbook References
|
2021-05-26 13:06:16 +02:00 |
|
|
WojciechLesicki
|
8b707bc948
|
Added also \status_ pipe.
|
2021-05-25 21:58:22 +02:00 |
|
|
WojciechLesicki
|
f1a0308e73
|
Add one more pipe, references etc.
|
2021-05-25 21:07:23 +02:00 |
|
|
WojciechLesicki
|
38552e98cf
|
Adding some pipes
|
2021-05-25 15:47:34 +02:00 |
|
|
Florian Roth
|
5e62cc2094
|
Merge pull request #1503 from frack113/fix_typo
Fix some typo
|
2021-05-25 15:03:28 +02:00 |
|
|
frack113
|
3717c68bb7
|
fix typo of level
|
2021-05-24 10:45:58 +02:00 |
|
|
frack113
|
104a004b3d
|
fix typo of tags
|
2021-05-24 10:41:17 +02:00 |
|
|
frack113
|
afb3d63900
|
fix typo of fields
|
2021-05-24 10:37:14 +02:00 |
|
|
frack113
|
1fcd0bf951
|
fix typo of fields
|
2021-05-24 10:34:56 +02:00 |
|
|
frack113
|
a1bddf51e7
|
fix typo of falsepositives
|
2021-05-24 10:31:28 +02:00 |
|
|
frack113
|
466bb88ab5
|
Merge branch 'SigmaHQ:master' into sigmac_add_time_filter
|
2021-05-22 18:18:23 +02:00 |
|
|
Florian Roth
|
51771b0d67
|
Merge pull request #1499 from SigmaHQ/rule-devel
Rule devel
|
2021-05-22 16:28:12 +02:00 |
|
|
Florian Roth
|
211bf35640
|
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
|
2021-05-22 15:45:40 +02:00 |
|
|
Florian Roth
|
02323043d7
|
Create web_cve_2021_26814_wzuh_rce.yml
|
2021-05-22 15:45:38 +02:00 |
|
|
Florian Roth
|
576e047e76
|
Delete win_susp_Register_cimprovider.yml
|
2021-05-22 15:43:41 +02:00 |
|
|
Florian Roth
|
4c281d117c
|
fix: bug in rule syntax
|
2021-05-22 15:31:23 +02:00 |
|
|
Florian Roth
|
9b7fb0c0f3
|
Update win_susp_shell_spawn_from_winrm.yml
|
2021-05-22 15:28:50 +02:00 |
|
|
Florian Roth
|
7e1ac347ef
|
Merge branch 'master' into rule-devel
|
2021-05-22 15:27:32 +02:00 |
|
|
Florian Roth
|
c0d58cb7f9
|
PAExec and PSexec rules
|
2021-05-22 10:52:01 +02:00 |
|
|
frack113
|
0e688d8dd0
|
Add the 'logsource!=' filter
|
2021-05-22 09:04:30 +02:00 |
|
|
frack113
|
f213226eb4
|
Add the 'tag!=' filter
|
2021-05-22 08:57:42 +02:00 |
|
|
frack113
|
8aa3ea15d7
|
change to the more revealing name "inlastday"
|
2021-05-22 08:44:30 +02:00 |
|
|
Jonhnathan
|
687f2d67fc
|
Update Threat Hunter Playbook Reference
|
2021-05-22 01:09:30 -03:00 |
|
|
Jonhnathan
|
7f335cbb4a
|
Update Threat Hunter Playbook Reference
|
2021-05-22 01:08:23 -03:00 |
|
|
Jonhnathan
|
34e2a81371
|
Update Threat Hunter Playbook Reference
|
2021-05-22 01:04:53 -03:00 |
|
|
Jonhnathan
|
89cfef9d49
|
Update Threat Hunter Playbook Reference
|
2021-05-22 01:04:20 -03:00 |
|
|
Jonhnathan
|
26ecbea0ba
|
Update Threat Hunter Playbook Reference
|
2021-05-22 01:03:49 -03:00 |
|
|
Jonhnathan
|
4ebdcf2f1d
|
Update Threat Hunter Playbook Reference
|
2021-05-22 01:03:23 -03:00 |
|
|
Jonhnathan
|
c7f7eb6698
|
Update Threat Hunter Playbook Reference
|
2021-05-22 01:02:43 -03:00 |
|
|
Jonhnathan
|
5f6c19f203
|
Update Threat Hunter Playbook Reference
|
2021-05-22 01:02:19 -03:00 |
|
|
Jonhnathan
|
627a83914a
|
Update Threat Hunter Playbook Reference
|
2021-05-22 01:01:33 -03:00 |
|
|
Jonhnathan
|
3853d71c56
|
Update Threat Hunter Playbook Reference
|
2021-05-22 01:01:07 -03:00 |
|
|
Jonhnathan
|
e218c32a4c
|
Update Threat Hunter Playbook Reference
|
2021-05-22 01:00:39 -03:00 |
|
|
Jonhnathan
|
1b32a5c0f3
|
Update Threat Hunter Playbook Reference
|
2021-05-22 00:59:54 -03:00 |
|
|
Jonhnathan
|
93087d2130
|
Update Threat Hunter Playbook Reference
|
2021-05-22 00:59:35 -03:00 |
|
|
Jonhnathan
|
d3afed53ac
|
Update Threat Hunter Playbook Reference
|
2021-05-22 00:59:04 -03:00 |
|
|
Jonhnathan
|
7007287832
|
Update Threat Hunter Playbook Reference
|
2021-05-22 00:58:23 -03:00 |
|