da46ff6e93
docs: descriptions for source configs
2020-06-25 13:59:51 +02:00
825bda397d
desc: better descriptions in help for backends and configurations
2020-06-25 13:21:43 +02:00
3decee07ba
fix: bugfix and cosmetics
2020-06-24 18:10:58 +02:00
07c0a6558e
fix: wording on sysmon mapping file
2020-06-24 17:49:42 +02:00
f3fedef8f5
Changed category names and remove sysmon log source
2020-06-24 17:41:21 +02:00
4224a6517d
Merge pull request #859 from Neo23x0/rule-devel
...
fix: duplicate IDs
2020-06-24 17:23:13 +02:00
6d7f991424
Merge pull request #853 from rtkbkish/fix-win_ad_object_writedac_access
...
Fix quoting for AD Object WriteDAC Access
2020-06-24 17:06:15 +02:00
c3ffa0b9d3
fix: duplicate IDs
2020-06-24 17:04:04 +02:00
d385cbfa69
Fix quoting for AD Object WriteDAC Access
...
The AccessMask field needs to be quoted so that it is compared correctly.
2020-06-22 15:31:03 -04:00
4eb97ec43d
Update lnx_file_copy.yml
2020-06-22 21:35:50 +03:00
e2a16087c9
Merge pull request #851 from ozirus/master
...
Update for new method
2020-06-22 20:11:39 +02:00
b091e3b1c4
Update for new method
...
Update for method mentioned in https://ired.team/offensive-security/code-execution/code-execution-through-control-panel-add-ins
2020-06-22 01:06:34 +03:00
d17e0ae6eb
typo
2020-06-20 23:04:52 +03:00
1ef81a36af
Merge pull request #850 from Neo23x0/rule-devel
...
K3chang and IE Registry Mods
2020-06-19 11:25:43 +02:00
912ad94771
fix: missing ATT&CK id in tests
2020-06-19 10:00:44 +02:00
e1225784f7
fix: fixed indentation
2020-06-19 09:54:08 +02:00
62632db818
refactor: added variant to IE rule
2020-06-19 09:53:35 +02:00
5cb6f5da9d
fix: title adjusted
2020-06-19 09:39:11 +02:00
b8a5cd4787
Disabled IE Security Features
2020-06-19 09:37:10 +02:00
da060bfb90
Ke3chang rule
2020-06-19 09:36:54 +02:00
b675c4c706
Merge branch 'master' into rule-devel
2020-06-19 09:24:26 +02:00
93719d8a01
Merge pull request #1 from omergunal/omergunal-patch-1
...
Remote file copy
2020-06-18 23:56:29 +03:00
40a07a2d4f
Delete lnx_sudo_enumeration.yml
2020-06-18 23:55:24 +03:00
d87b0c95a4
Delete lnx_trap.yml
2020-06-18 23:55:16 +03:00
8db7c3207a
Delete lnx_sudo_caching.yml
2020-06-18 23:54:43 +03:00
5bc72b6cba
Delete lnx_space_after_filename.yml
2020-06-18 23:54:28 +03:00
f10440b9fa
Delete lnx_setuid_setgid.yml
2020-06-18 23:54:20 +03:00
6c8d104e7d
Delete lnx_disabling_security_tools.yml
2020-06-18 23:54:06 +03:00
84c4683607
Delete lnx_connection_proxy.yml
2020-06-18 23:53:43 +03:00
c4a1e853bc
Remote file copy
2020-06-18 23:47:53 +03:00
c6c455a3ec
Remote file copy
2020-06-18 23:37:49 +03:00
9bfc3d6807
Delete lnx_file_copy.yml
2020-06-18 23:37:12 +03:00
a963630db8
Remote File Copy
2020-06-18 23:36:29 +03:00
203aa192c7
Fix multiple references to default field mapping in same rule
...
If there is a default mapping specified for a fieldmapping and that field is
referenced multiple times in the rule, the default mapping will be "pop"ped
and return the unmapped key on subsequent uses.
Don't pop the value. Just return the first entry.
2020-06-18 13:01:31 -04:00
4b0c80885f
Merge pull request #810 from EccoTheFlintstone/fp
...
add WMI module load false positives
2020-06-18 12:50:40 +02:00
32ecb81630
Merge pull request #845 from ikiril01/att&ck_subtechniques_v2
...
ATT&CK subtechniques v2
2020-06-18 09:10:09 +02:00
69760f6446
Added subtechniques to MITRE_TECHNIQUES
2020-06-17 11:51:48 -06:00
b343df2225
Further subtechnique updates
2020-06-17 11:31:40 -06:00
3a607abe33
Update lnx_trap.yml
2020-06-17 19:51:53 +03:00
99bfa14ae0
add 1 more FP
2020-06-17 12:49:27 -04:00
7b86f4aefb
Update lnx_trap.yml
2020-06-17 19:47:31 +03:00
ebbd32d2e1
file extension
2020-06-17 19:43:57 +03:00
f989f7e155
file extension
2020-06-17 19:43:49 +03:00
772c03c49a
Connection Proxy
2020-06-17 19:39:55 +03:00
9d285ecf74
Trap
2020-06-17 19:39:00 +03:00
d0b66ab828
Space After Filename
2020-06-17 19:38:38 +03:00
3b8fb9e3d8
Disabling Security Tools
2020-06-17 19:38:10 +03:00
0022705373
fix: filter not functional
...
since `UsrLogon.cmd` does appear only in `C:\Windows\system32\cmd.exe /c UsrLogon.cmd` command line
2020-06-17 16:09:44 +02:00
5c0bb0e94f
Fixed indentation
2020-06-16 15:01:13 -06:00
0fbfcc6ba9
Initial round of subtechnique updates
2020-06-16 14:46:08 -06:00
Florian Roth