4808f49e0d
More exact path
2019-04-17 23:45:15 +02:00
1a4a74b64b
fix: dot mustn't be escaped
2019-04-17 23:44:36 +02:00
76780ccce2
Too many different trusted cscript imphashes
2019-04-17 23:33:56 +02:00
7c5f985f6f
Modifications
2019-04-17 23:30:49 +02:00
4298abffb7
Modifications
2019-04-17 23:29:29 +02:00
615a802a8e
Modifications
2019-04-17 23:26:20 +02:00
0e8a46aaf7
Update win_subp_svchost rule
...
Adding rpcnet.exe as ParentImage
2019-04-16 15:00:06 +02:00
17470d1545
Rule: extended parent list for legitimate svchost starts
...
https://twitter.com/Sam0x90/status/1117768799816753153
2019-04-15 14:54:35 +02:00
612a7642d2
Added Local directory
2019-04-15 08:47:53 +02:00
1d3159bef0
Rule: Extended Office Shell rule
2019-04-15 08:13:35 +02:00
d872c52a43
Add restricted filters to notepad++ gup.exe rule
2019-04-15 08:12:12 +02:00
1e262f5055
Merge pull request #303 from Karneades/patch-1
...
Remove too loose filter in wmi spwns powershell rule
2019-04-14 23:11:57 +02:00
75d36165fc
Remove non-generic falsepositives
...
There are tons of FPs for that... :)
2019-04-11 12:55:24 +02:00
51e65be98b
Remove loose wildcard filter in powershell encoded cmd rule
2019-04-11 12:53:12 +02:00
89fb726875
added win_office_spawn_exe_from_users_directory.yml. Detects executable in users directory started via office program. Helpful for adversaries that tend to drop and execute renamed binaries in this location such as fin7
2019-04-09 09:45:07 -04:00
f0c8c428bb
added rules for renamed wscript, cscript and paexec. Added two directories to the existing sysmon_susp_prog_location_network_connection rule. These additions are all fin7 related.
2019-04-08 08:07:30 -04:00
97376c00de
Fix condition
2019-04-04 22:33:32 +02:00
766b8b8d18
Fix condition
2019-04-04 22:32:47 +02:00
788e75ef1b
Fix condition
2019-04-04 22:32:21 +02:00
840eb2f519
Remove too loose filter in notepad updater rule
2019-04-04 22:25:05 +02:00
eb690d8902
Remove too loose filter in mshta rule
2019-04-04 22:16:24 +02:00
1915561351
Remove to loose wildcard from wmi spwns powershell rule
2019-04-04 22:12:28 +02:00
e0459cec1c
renamed file
2019-04-03 17:39:17 +02:00
7e058e611c
WMI spawning PowerShell seen in various attacks
2019-04-03 16:56:45 +02:00
9ada22b8e0
adjusted link
2019-04-03 16:40:18 +02:00
d2e605fc5c
Auto stash before rebase of "Neo23x0/master"
2019-04-03 16:25:18 +02:00
e473efb7c3
Trying to fix ATT&CK framework tag
2019-04-01 10:36:35 +02:00
3f2ce4b71f
Lowered level to medium
2019-04-01 09:47:14 +02:00
51c42a15a7
Allow Incoming Connections by Port or Application on Windows Firewall
2019-04-01 08:16:56 +02:00
60c4fed2e0
Create win_etw_trace_evasion.yml
...
there are two versions of clear and two variations of set that can be used with something like wevtutil
`wevtutil cl | wevtutil clear-log | wevtutil sl | wevtutil set-log `
Also, I am adding a `*` match at the end, because there are other parameters that could be placed on the end -- so unless this was used on a general search on a text/analyzed field then the `*` is necessary.
example `wevtutil set-log Microsoft-Windows-WMI-Activity/Trace /e:disable /q:true`
2019-03-22 11:36:55 -04:00
ffac77fb37
Rule: extended LockerGoga description
2019-03-22 11:03:48 +01:00
1adb040e0b
Rule: LockerGoga
2019-03-22 10:59:31 +01:00
2ad2ba9589
fix: rule field fix in proc_creation rule
2019-03-22 10:59:18 +01:00
be25aa2c37
Added CAR tags
2019-03-16 00:37:09 +01:00
8512417de0
Incorporated MITRE CAR mapping from #55
2019-03-16 00:03:27 +01:00
5d54e9c8a1
nbstat.exe -> nbtstat.exe
2019-03-11 19:28:29 +01:00
3c1948f089
Merge pull request #277 from megan201296/patch-18
...
Remove invalid link
2019-03-07 23:49:13 +01:00
475113b1c1
fixed incorrect date format
2019-03-07 22:52:11 +01:00
c2a16591af
Remove invalid link
...
Cybereason link was broken. Couldn't find anything with a super similar file path. The below link might be a valid replacement but went better safe than sorry and just removed it completely. https://www.cybereason.com/hubfs/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty-Part1.pdf
2019-03-07 14:22:29 -06:00
cb7243de5d
fixed wrong tags
2019-03-06 06:18:38 +01:00
8bec627ff1
fixed multiple tags issue
2019-03-06 06:09:37 +01:00
5154460726
changed service to product
2019-03-06 05:57:01 +01:00
05cc7e455d
atc review
2019-03-06 05:25:12 +01:00
725ab99e90
Merge pull request #1 from AverageS/master
...
Fix rules
2019-03-06 04:31:01 +01:00
534f250c35
Merge branch 'master' of https://github.com/krakow2600/sigma
2019-03-06 00:45:16 +01:00
bb95347745
rules update
2019-03-06 00:43:42 +01:00
6232362f04
Missing tags
2019-03-06 00:16:40 +01:00
07807837ee
Missing tags
2019-03-06 00:02:37 +01:00
be108d95cc
Merge branch 'master' of https://github.com/AverageS/sigma
2019-03-06 01:57:38 +03:00
40241c1fdf
Fix 4 rules
2019-03-06 01:56:05 +03:00
Florian Roth