 Florian Roth
|
66f829c371
|
rule: CsExec
|
2022-08-22 17:43:49 +02:00 |
|
|
Nasreddine Bencherchali
|
fb1deb7fb2
|
Update pipe_created_psexec_default_pipe_from_susp_location.yml
|
2022-08-04 19:18:42 +01:00 |
|
|
Nasreddine Bencherchali
|
307f9c6a35
|
New rules
|
2022-08-04 19:11:16 +01:00 |
|
|
Nasreddine Bencherchali
|
2d46263054
|
Renamed rule filename for conformity
|
2022-08-04 15:57:43 +01:00 |
|
|
Nasreddine Bencherchali
|
df74e42243
|
Add missing definition for named pipe rules
|
2022-08-04 15:56:47 +01:00 |
|
|
Nasreddine Bencherchali
|
48a90c6342
|
DiagTrackEoP rules
|
2022-08-03 15:45:39 +01:00 |
|
|
Florian Roth
|
6dde3012cc
|
refactor: some changes
|
2022-07-11 19:55:54 +02:00 |
|
|
Nasreddine Bencherchali
|
238e0ecd7d
|
Update Ref+Selection
|
2022-07-11 14:11:53 +01:00 |
|
|
Nasreddine Bencherchali
|
d2f08cca5d
|
New Rules
|
2022-07-11 10:22:45 +01:00 |
|
|
phantinuss
|
9475153292
|
fix: FPs found in testing environment
|
2022-06-20 16:17:54 +02:00 |
|
|
Florian Roth
|
accf27b771
|
fix: FPs
|
2022-06-20 13:39:47 +02:00 |
|
|
frack113
|
8de0027ca3
|
refactor condition
|
2022-06-03 15:35:24 +02:00 |
|
|
phantinuss
|
13e31e8383
|
fix: FPs found in win2022 domain controller baseline
|
2022-04-21 10:48:59 +02:00 |
|
|
Paul Hager
|
68659cf5fd
|
new susp service installation rules
|
2022-03-18 16:08:40 +01:00 |
|
|
phantinuss
|
b23eee6ebf
|
fix: unknown --> Unknown
|
2022-03-16 13:43:54 +01:00 |
|
|
frack113
|
7fb8272f94
|
Name Normalization
Name Normalization
|
2022-02-27 10:58:14 +01:00 |
|
|
Florian Roth
|
05763aea3f
|
docs: level adjusted
|
2022-02-17 13:02:18 +01:00 |
|
|
Florian Roth
|
57271c3c00
|
fix: bugs in rules
|
2022-02-16 17:26:57 +01:00 |
|
|
Florian Roth
|
51bbe21c70
|
fix: more Aurora FP fixes
|
2022-02-16 17:16:50 +01:00 |
|
|
Florian Roth
|
2500c16aea
|
fix: FPs noticed with Aurora
|
2022-02-16 17:00:27 +01:00 |
|
|
Florian Roth
|
d6af219bed
|
Merge branch 'master' into pr/2573
|
2022-01-19 19:42:49 +01:00 |
|
|
frack113
|
4631d0c482
|
remove invalid tag
|
2022-01-19 18:23:30 +01:00 |
|
|
Tim Shelton
|
37243f5902
|
Updating formatting for more accurate mssql sqlps.exe detection
|
2022-01-19 14:49:00 +00:00 |
|
|
Tim Shelton
|
dc1e150a46
|
adding support for mssql sqlps.exe
|
2022-01-18 23:55:04 +00:00 |
|
|
Tim Shelton
|
ec51cf6698
|
Allow wmi service to also perform, since winrm is being allowed
|
2022-01-18 22:20:55 +00:00 |
|
|
Tim Shelton
|
a0983a3659
|
Allow dsac to perform powershell execution over named pipes. DSAC - Active Directory Admin Client
|
2022-01-18 19:55:00 +00:00 |
|
|
Florian Roth
|
e055ec1d52
|
refactor: change all " of them" expressions
|
2022-01-11 10:59:57 +01:00 |
|
|
Florian Roth
|
c7c4130c04
|
Update sysmon_alternate_powershell_hosts_pipe.yml
|
2021-12-17 12:31:08 +01:00 |
|
|
Tim Shelton
|
0dea125a82
|
Adding filter for calls using \WINDOWS\System32\sdiagnhost.exe, used rule 867613fb-fa60-4497-a017-a82df74a172c as filter reference
|
2021-12-03 16:53:20 +00:00 |
|
|
frack113
|
01dc930c17
|
Change status for old rules
|
2021-11-27 11:33:14 +01:00 |
|
|
Florian Roth
|
11fc576103
|
fix: FPs with rules
|
2021-11-25 19:04:27 +01:00 |
|
|
frack113
|
f47d0da3f7
|
add missing MITRE Techniques
|
2021-11-20 12:26:01 +01:00 |
|
|
David André
|
7ad901fce1
|
Corrected typo in HyperBro malware name
|
2021-11-12 08:36:13 +01:00 |
|
|
frack113
|
e51dab10c2
|
fix logsources
|
2021-11-07 09:55:02 +01:00 |
|
|
frack113
|
9f7d4a832e
|
Update sysmon_mal_namedpipes.yml
|
2021-10-31 07:03:27 +01:00 |
|
|
David André
|
0de88e2f30
|
Added four other named pipes and corrected one missing slash
|
2021-10-29 16:33:07 +02:00 |
|
|
David André
|
8c57d29561
|
Added turla hyperstack named pipe
|
2021-10-29 15:49:04 +02:00 |
|
|
WojciechLesicki
|
ad0bcebe9c
|
Adding some additional details about sysmon config and also way to test detection.
|
2021-10-25 21:30:33 +02:00 |
|
|
WojciechLesicki
|
6c86500414
|
Description changes acording to https://github.com/SwiftOnSecurity/sysmon-config/pull/151
|
2021-10-18 21:34:05 +02:00 |
|
|
Roberto Rodriguez
|
7f17eaeb87
|
added rule to detect suspicious named pipe connections to an AD FS server
|
2021-10-08 01:57:22 -04:00 |
|
|
frack113
|
318f8b714e
|
split global win_tool_psexec.yml
|
2021-09-21 10:10:48 +02:00 |
|
|
Thomas Patzke
|
143744bc12
|
Various fixes
* Backslashes in regular expressions
* Casing of condition operators
* Further small errors
|
2021-09-07 23:38:07 +02:00 |
|
|
Austin Songer
|
fa5554660c
|
Update sysmon_mal_cobaltstrike_re.yml
|
2021-09-04 17:33:05 -05:00 |
|
|
frack113
|
a048403089
|
Merge pull request #1973 from klingerko/cs_namedpipe_updates
Remove duplicate and regex improvements
|
2021-09-02 15:25:01 +02:00 |
|
|
klingerko
|
15e25f9635
|
update modifed date
|
2021-09-02 14:50:14 +02:00 |
|
|
Florian Roth
|
0603581111
|
Merge pull request #1969 from SigmaHQ/rule-devel
More Named Pipe Rules and WMI rule refactoring
|
2021-09-02 10:15:00 +02:00 |
|
|
Konstantin Klinger
|
457da818a4
|
regex optimisations
|
2021-09-01 17:06:55 +02:00 |
|
|
Konstantin Klinger
|
e83ee55573
|
remove duplicate
|
2021-09-01 17:05:36 +02:00 |
|
|
Florian Roth
|
2f7f050ad8
|
fix: removed tags
|
2021-09-01 16:32:27 +02:00 |
|
|
Florian Roth
|
8761927e8c
|
rule: susp scrcons.exe creating named pipe
|
2021-09-01 13:57:17 +02:00 |
|