 Florian Roth
|
c0b93a010c
|
NCCGroup rules from rclone blog post
https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
|
2021-05-27 12:49:40 +02:00 |
|
|
Florian Roth
|
7812a4217c
|
rule: regedit as trustedinstaller
|
2021-05-27 11:36:05 +02:00 |
|
|
Florian Roth
|
b5352ac5f7
|
fix: duplicate UUIDs
|
2021-05-27 10:29:21 +02:00 |
|
|
Florian Roth
|
8aabb58eca
|
Merge pull request #1498 from w0rk3r/otrf
Update broken OTRF Threat Hunter Playbook References
|
2021-05-26 13:06:16 +02:00 |
|
|
frack113
|
afb3d63900
|
fix typo of fields
|
2021-05-24 10:37:14 +02:00 |
|
|
frack113
|
1fcd0bf951
|
fix typo of fields
|
2021-05-24 10:34:56 +02:00 |
|
|
Florian Roth
|
576e047e76
|
Delete win_susp_Register_cimprovider.yml
|
2021-05-22 15:43:41 +02:00 |
|
|
Florian Roth
|
4c281d117c
|
fix: bug in rule syntax
|
2021-05-22 15:31:23 +02:00 |
|
|
Florian Roth
|
7e1ac347ef
|
Merge branch 'master' into rule-devel
|
2021-05-22 15:27:32 +02:00 |
|
|
Florian Roth
|
c0d58cb7f9
|
PAExec and PSexec rules
|
2021-05-22 10:52:01 +02:00 |
|
|
Jonhnathan
|
7f335cbb4a
|
Update Threat Hunter Playbook Reference
|
2021-05-22 01:08:23 -03:00 |
|
|
Jonhnathan
|
34e2a81371
|
Update Threat Hunter Playbook Reference
|
2021-05-22 01:04:53 -03:00 |
|
|
Jonhnathan
|
89cfef9d49
|
Update Threat Hunter Playbook Reference
|
2021-05-22 01:04:20 -03:00 |
|
|
Florian Roth
|
a0efd7a4dc
|
Merge pull request #1494 from Karneades/patch-1
Add keyword WinRM to remote powershell rules
|
2021-05-21 10:35:18 +02:00 |
|
|
Andreas Hunkeler
|
e58c59dcfd
|
Update modified field in WinRM rule
|
2021-05-21 09:29:11 +02:00 |
|
|
Florian Roth
|
a30391f3b4
|
Merge pull request #1495 from SigmaHQ/rule-devel
rule refactoring: Cobalt Strike service start
|
2021-05-20 17:43:29 +02:00 |
|
|
Andreas Hunkeler
|
93241e7fc6
|
Add keyword WinRM to remote powershell process rule
|
2021-05-20 17:03:32 +02:00 |
|
|
Andreas Hunkeler
|
3763e54b99
|
Add keyword WinRM to remote powershell process rule
|
2021-05-20 17:00:25 +02:00 |
|
|
Florian Roth
|
ebac8a098f
|
rule refactoring: Cobalt Strike service start
|
2021-05-20 10:05:12 +02:00 |
|
|
Florian Roth
|
5a3af872d8
|
Merge pull request #1479 from SigmaHQ/rule-devel
Rule devel, Trademark test
|
2021-05-15 13:42:34 +02:00 |
|
|
Florian Roth
|
a655c5c1a0
|
update ngrok rule
|
2021-05-14 17:44:53 +02:00 |
|
|
Florian Roth
|
e4a1ce4498
|
rule: ngrok rdp port exposure
|
2021-05-14 17:34:52 +02:00 |
|
|
frack113
|
ecc0fcb082
|
process_creation is a category
|
2021-05-12 08:57:57 +02:00 |
|
|
frack113
|
cf0a710b4d
|
process_creation is a category
|
2021-05-12 08:55:35 +02:00 |
|
|
Florian Roth
|
7bc733a3cf
|
Merge pull request #1473 from frack113/master
Correct the sysmon case-sensitive Key
|
2021-05-11 14:59:20 +02:00 |
|
|
Florian Roth
|
0fcbce9932
|
Merge pull request #1465 from austinsonger/win_susp_certutil_command.yml
Got Rid of References that are no longer valid.
|
2021-05-11 14:32:47 +02:00 |
|
|
frack113
|
f07c368ae0
|
Correct cast-sensitive Key "OriginalFileName"
|
2021-05-11 11:18:01 +02:00 |
|
|
frack113
|
c4c720cc30
|
Correct cast-sensitive Key "OriginalFileName"
|
2021-05-11 11:16:12 +02:00 |
|
|
frack113
|
720dd24814
|
Correct cast-sensitive Key "OriginalFilename"
|
2021-05-11 11:13:33 +02:00 |
|
|
Florian Roth
|
67e807983c
|
Merge pull request #1470 from SigmaHQ/rule-devel
New CS rule for malformed UAs, FP fixes
|
2021-05-10 13:40:27 +02:00 |
|
|
Florian Roth
|
fcb7aa3bcf
|
fix: FPs with rules
|
2021-05-10 12:42:59 +02:00 |
|
|
Florian Roth
|
270aedfd62
|
Merge pull request #1469 from d4rk-d4nph3/master
Added rule for RClone usage for exfiltration
|
2021-05-10 10:50:35 +02:00 |
|
|
Bhabesh Rai
|
9c8b9756e5
|
Added rule for RClone usage for exfiltration
|
2021-05-10 14:06:53 +05:45 |
|
|
Austin Songer
|
39a21a9e89
|
Got Rid of References that are no longer valid.
|
2021-05-06 14:14:08 -05:00 |
|
|
Florian Roth
|
80c7899c56
|
rule: whoami priv
|
2021-05-05 14:27:36 +02:00 |
|
|
Florian Roth
|
ff50b5b659
|
Merge pull request #1451 from SigmaHQ/rule-devel
Different FP filters
|
2021-04-30 08:31:02 +02:00 |
|
|
Florian Roth
|
020e6c9e29
|
fix: FP with Edge and call by ordinal
|
2021-04-29 18:23:14 +02:00 |
|
|
Florian Roth
|
04709ab9f4
|
refactor: renamed procdump rule
|
2021-04-29 17:59:49 +02:00 |
|
|
Florian Roth
|
4b86d3f407
|
Merge pull request #1449 from SigmaHQ/rule-devel
Rule devel
|
2021-04-29 12:28:12 +02:00 |
|
|
Florian Roth
|
3e5f7aeb5e
|
rule: PowerShell Cmdlet Defender Exclusions
|
2021-04-29 09:56:26 +02:00 |
|
|
Florian Roth
|
9166167447
|
Merge pull request #1433 from d4rk-d4nph3/master
Added rule for Lazarus activity of Apr 2021
|
2021-04-26 20:34:51 +02:00 |
|
|
Florian Roth
|
3008e5b9e7
|
Merge pull request #1438 from ZikyHD/fix_process_creation_msdeploy
Fix typo on CommandLine field
|
2021-04-26 20:33:56 +02:00 |
|
|
Florian Roth
|
194b0af4d2
|
Merge pull request #1439 from ZikyHD/fix_win_manage-bde_lolbas
Fix typo on CommandLine field
|
2021-04-26 20:33:45 +02:00 |
|
|
Florian Roth
|
d24f0b8988
|
feat: generic registry events compatible with native audit logging
|
2021-04-26 09:31:36 +02:00 |
|
|
Cedric Hien
|
748005fc14
|
Fix typo on CommandLine field
|
2021-04-25 15:52:59 +02:00 |
|
|
Cedric Hien
|
c580db166c
|
Fix typo on CommandLine field
|
2021-04-25 15:50:44 +02:00 |
|
|
Florian Roth
|
1ff5e226ad
|
Merge pull request #1436 from SigmaHQ/rule-devel
Rule devel
|
2021-04-23 17:33:07 +02:00 |
|
|
Florian Roth
|
c7ce9154d1
|
Merge pull request #1030 from stevengoossensB/master
Updated sysmon config and rewrite rules to use categories
|
2021-04-23 16:52:25 +02:00 |
|
|
Florian Roth
|
a29ac79a3f
|
refactor: extended comsvcs.dll MiniDump rule
|
2021-04-23 16:46:04 +02:00 |
|
|
Florian Roth
|
6f12a1b099
|
docs: FPs and changed level
|
2021-04-23 16:45:52 +02:00 |
|