4a65a25070
svchost spawned without cli
2019-12-28 10:28:08 -05:00
5e59bbb3c3
Added MITRE ATT&CK Technique T1482
...
https://attack.mitre.org/techniques/T1482/
2019-12-28 16:02:26 +01:00
35b4806104
corrected logic
2019-12-28 09:55:39 -05:00
474a8617e5
Trickbot behavioral recon activity
2019-12-27 21:25:53 -05:00
3a3cd5a830
Merge branch 'master' into oscd
2019-12-28 03:27:13 +03:00
0b2f88d5df
Sigma converter for SQL format
...
Get the converted SQL query after the WHERE statement for any filtering on SQL platform.
Example:
https://github.com/fuseyjz/sigma-sql/blob/master/README.md
2019-12-24 10:42:25 +08:00
62bd2cc3ab
Merge pull request #572 from alessiodallapiazza/master
...
Add the ability to detect PowerUp - Invoke-AllChecks
2019-12-23 12:57:55 +01:00
0ff81cc693
Merge pull request #1 from alessiodallapiazza/alessiodallapiazza-patch-1
...
Add the ability to detect PowerUp - Invoke-AllChecks
2019-12-23 11:51:34 +01:00
f45587074b
Add the ability to detect PowerUp - Invoke-AllChecks
...
PowerUp allow attackers to check if is possible to have a local privilege escalation attacks against Windows systems. The main function is called "Invoke-AllChecks" and check possible path of escalation.
2019-12-23 11:50:57 +01:00
04afcccd2c
Merge pull request #571 from Neo23x0/devel
...
rule: whoami as local system
2019-12-22 19:23:50 +01:00
fc8607bbea
rule: whoami as local system
2019-12-22 18:50:26 +01:00
a7ca386a1b
Merge pull request #570 from Neo23x0/devel
...
CreateMiniDump
2019-12-22 08:40:45 +01:00
fb76f2b9ac
rule: CreateMiniDump
2019-12-22 08:29:12 +01:00
511229c0b6
rule: modified Bloodhound rule
2019-12-21 21:22:13 +01:00
530ac854df
Added sigma2attack to CI testing
2019-12-20 22:53:22 +01:00
781f53332b
Merge pull request #566 from christophetd/sigma2attack
...
Add sigma2attack
2019-12-20 21:57:02 +01:00
1fd4c26005
Merge pull request #569 from Neo23x0/devel
...
rule: improved bloodhound rule
2019-12-20 17:32:21 +01:00
0fa5ba925e
rule :improved bloodhound rule
2019-12-20 17:23:40 +01:00
cbebaf637f
Merge pull request #568 from Neo23x0/devel
...
Devel
2019-12-20 16:22:29 +01:00
0e82dce2a0
fix: fixed wrong condition
2019-12-20 16:11:39 +01:00
0000257371
rule: improved bloodhound rule
2019-12-20 16:08:26 +01:00
3a933c38f2
rule: changed level of BloodHound rule
2019-12-20 15:37:58 +01:00
68efeb909d
rule: false positive condition for BloodHound rule
2019-12-20 15:35:13 +01:00
825b1edb0f
Merge pull request #567 from Neo23x0/devel
...
Devel
2019-12-20 15:32:56 +01:00
5f061c15d0
fix: fixed missing condition
2019-12-20 15:18:05 +01:00
bb466407ee
rule: operation Wocao activity
2019-12-20 15:00:07 +01:00
708c17e2bc
rule: Bloodhound
2019-12-20 14:59:36 +01:00
ab038d1ac7
style: minor changes
2019-12-20 14:59:26 +01:00
9ca52259dd
Fixed identifier
2019-12-20 00:11:34 +01:00
924e1feb54
UUIDs + moved unsupported logic
...
* Added UUIDs to all contributed rules
* Moved unsupported logic directory out of rules/ because this breaks CI
testing.
2019-12-19 23:56:36 +01:00
694d666539
Merge branch 'master' into oscd
2019-12-19 23:15:15 +01:00
e99b0fe2d7
Add sigma2attack
2019-12-19 00:00:13 +01:00
8b70cb6761
Add Covenant default named pipe
...
Covenant (https://github.com/cobbr/Covenant ) can use named pipes for peer to peer communication.
The default named pipe name is "\gruntsvc".
References: https://posts.specterops.io/designing-peer-to-peer-command-and-control-ad2c61740456
2019-12-18 15:19:47 +00:00
0a26184286
Merge pull request #563 from Neo23x0/devel
...
Devel
2019-12-17 14:48:07 +01:00
c8b6b5c556
rule: updating csc.exe rule
2019-12-17 13:45:40 +01:00
7a3041c593
rule: improved csc.exe rule
2019-12-17 11:05:43 +01:00
397b3b8cc6
Updated rule test MITRE ATT&CK identifiers
2019-12-17 01:13:06 +01:00
e8d92fab0c
rule: ryuk ransomware
2019-12-16 20:33:12 +01:00
da06e5bc1c
Merge pull request #562 from Neo23x0/devel
...
Improved PowerShell Encoded Command Rule
2019-12-16 19:31:15 +01:00
bbaa9df217
rule: better JAB rule
2019-12-16 19:08:51 +01:00
f83eb2268e
rule: improved JAB expression
2019-12-16 19:04:05 +01:00
bd7c996588
rule: suspicious PS rule modified to cover newest malware campaigns
2019-12-16 19:02:57 +01:00
ef63a65efe
Converted to Unix line end
2019-12-15 23:30:42 +01:00
d19df2e4f7
fix issues with wrong tagging
2019-12-15 00:17:22 +01:00
9a511e5e62
fix issue with doubled detection section in apt_silence_downloader_v3.yml
2019-12-15 00:06:28 +01:00
7acfecbe66
Merge pull request #530 from bartblaze/master
...
Add scriptlets
2019-12-14 11:24:51 +01:00
d2a940a0a6
Merge branch 'devel' of https://github.com/Neo23x0/sigma
2019-12-13 22:01:40 +01:00
5930c1c290
Updated changelog
2019-12-13 22:00:40 +01:00
ee4138c48e
Merge pull request #526 from zouzias/hotfix_aggregate_count_distinct_groupby
...
[feature] extend es-dsl to support nested aggregations
2019-12-13 21:55:47 +01:00
a25b2ec361
Merge pull request #523 from refractionPOINT/lc-added-mtd
...
LC added FP metadata
2019-12-13 21:50:52 +01:00
david-burkett