d2122b6b83
Merge pull request #594 from sreemanshanker/master
...
Sigma rule to Monitor for writing of malicious files to system32 and syswow64 folders
2020-01-30 09:14:58 +01:00
a01773681a
fix: filename
2020-01-30 08:18:29 +01:00
529e95e3a5
Fixed everything
...
This rule had a lot of errors and problems.
- title
- file name
- status stable > experimental
- field order
- indentation
- unnecessary use of regular expressions
- interesting fields incomplete
- missing date
- missing id
- reference not as list
2020-01-30 08:17:46 +01:00
4c90e636b1
changed file name
2020-01-30 08:07:56 +01:00
a935cea665
fix: condition
2020-01-30 08:06:53 +01:00
d5c7b4795d
Add files via upload
2020-01-30 11:29:01 +08:00
a816f4775f
rule: FromBase64String command line
2020-01-29 16:05:12 +01:00
7786edac29
rule: dctask64.exe evasion techniques
...
https://twitter.com/gN3mes1s/status/1222088214581825540
2020-01-28 11:29:24 +01:00
5f0589b787
rule: mstsc shadowing
2020-01-24 16:18:19 +01:00
e24ea159f3
rule: split up renamed binary rule
2020-01-24 15:31:07 +01:00
8fbe08d5fa
Update win_system_exe_anomaly.yml
...
fixing to much original fork.
2020-01-24 15:31:06 +01:00
9f3672fdc0
Update win_system_exe_anomaly.yml
...
Following sigma event I've noticed my twitter account was referenced:
https://twitter.com/GelosSnake/status/934900723426439170
Rule:
https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_system_exe_anomaly.yml
Seems like - '\SystemRoot\System32\\*' is missing and hence triggering an FP.
2020-01-24 15:31:06 +01:00
5f8b152166
Added new sticky key attack binary
2020-01-24 15:31:06 +01:00
5d04c76f68
svchost spawned without cli
2020-01-24 15:31:06 +01:00
032c382184
corrected logic
2020-01-24 15:31:06 +01:00
991e3b8a51
Trickbot behavioral recon activity
2020-01-24 15:31:06 +01:00
9bb50f3d60
OSCD QA wave 2
...
* Improved rules
* Added filtering
* Adjusted severity
2020-01-17 15:46:28 +01:00
ba7c634f1a
More changes
2020-01-13 09:59:14 +01:00
7bd820c151
Changes
2020-01-13 09:56:49 +01:00
ffcfcb70ad
Add files via upload
2020-01-13 13:21:06 +08:00
ae6fcefbcd
Removed ATT&CK technique ids from titles and added tags
2020-01-11 00:33:50 +01:00
8d6a507ec4
OSCD QA wave 1
...
* Checked all rules against Mordor and EVTX samples datasets
* Added field names
* Some severity adjustments
* Fixes
2020-01-11 00:11:27 +01:00
48f5f480fd
fix: SCCM false positives with whoami.exe rule
2020-01-07 12:13:47 +01:00
c007ecf90c
Merge pull request #585 from Neo23x0/devel
...
Devel
2019-12-30 15:08:43 +01:00
5980cb8d0c
rule: copy from admin share - lateral movement
2019-12-30 14:25:43 +01:00
86e6b92903
rule: SecurityXploded tool
2019-12-30 14:25:29 +01:00
5ad793e04a
Merge pull request #582 from tvjust/patch-1
...
Added new sticky key attack binary
2019-12-30 14:14:20 +01:00
f574c20432
Update win_system_exe_anomaly.yml
...
fixing to much original fork.
2019-12-29 18:02:49 +02:00
7e7f6d1182
Update win_system_exe_anomaly.yml
...
Following sigma event I've noticed my twitter account was referenced:
https://twitter.com/GelosSnake/status/934900723426439170
Rule:
https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_system_exe_anomaly.yml
Seems like - '\SystemRoot\System32\\*' is missing and hence triggering an FP.
2019-12-29 18:01:19 +02:00
a1f07cdb4b
Added new sticky key attack binary
2019-12-29 08:32:23 -05:00
4a65a25070
svchost spawned without cli
2019-12-28 10:28:08 -05:00
35b4806104
corrected logic
2019-12-28 09:55:39 -05:00
474a8617e5
Trickbot behavioral recon activity
2019-12-27 21:25:53 -05:00
fc8607bbea
rule: whoami as local system
2019-12-22 18:50:26 +01:00
fb76f2b9ac
rule: CreateMiniDump
2019-12-22 08:29:12 +01:00
511229c0b6
rule: modified Bloodhound rule
2019-12-21 21:22:13 +01:00
1fd4c26005
Merge pull request #569 from Neo23x0/devel
...
rule: improved bloodhound rule
2019-12-20 17:32:21 +01:00
0fa5ba925e
rule :improved bloodhound rule
2019-12-20 17:23:40 +01:00
cbebaf637f
Merge pull request #568 from Neo23x0/devel
...
Devel
2019-12-20 16:22:29 +01:00
0e82dce2a0
fix: fixed wrong condition
2019-12-20 16:11:39 +01:00
0000257371
rule: improved bloodhound rule
2019-12-20 16:08:26 +01:00
3a933c38f2
rule: changed level of BloodHound rule
2019-12-20 15:37:58 +01:00
68efeb909d
rule: false positive condition for BloodHound rule
2019-12-20 15:35:13 +01:00
825b1edb0f
Merge pull request #567 from Neo23x0/devel
...
Devel
2019-12-20 15:32:56 +01:00
708c17e2bc
rule: Bloodhound
2019-12-20 14:59:36 +01:00
ab038d1ac7
style: minor changes
2019-12-20 14:59:26 +01:00
924e1feb54
UUIDs + moved unsupported logic
...
* Added UUIDs to all contributed rules
* Moved unsupported logic directory out of rules/ because this breaks CI
testing.
2019-12-19 23:56:36 +01:00
694d666539
Merge branch 'master' into oscd
2019-12-19 23:15:15 +01:00
0a26184286
Merge pull request #563 from Neo23x0/devel
...
Devel
2019-12-17 14:48:07 +01:00
c8b6b5c556
rule: updating csc.exe rule
2019-12-17 13:45:40 +01:00
Florian Roth