 frack113
|
18e9704e2c
|
Merge pull request #3964 from YamatoSecurity/master
update pw spraying via explicit creds rules
|
2023-01-28 07:59:00 +01:00 |
|
|
frack113
|
6928cdf702
|
Update win_security_susp_failed_logons_explicit_credentials.yml
|
2023-01-28 07:53:37 +01:00 |
|
|
frack113
|
1033b3f404
|
change status to test
|
2023-01-27 06:48:34 +01:00 |
|
|
Yamato Security
|
3a4d447d1e
|
update pw spraying via explicit creds rules
|
2023-01-27 10:51:43 +09:00 |
|
|
Nasreddine Bencherchali
|
ef0c3d35c4
|
fix: filter fp found in testing
|
2023-01-20 11:39:08 +01:00 |
|
|
Nasreddine Bencherchali
|
0cb78e498a
|
fix: more fp found in testing
|
2023-01-18 20:16:34 +01:00 |
|
|
Nasreddine Bencherchali
|
02e4a5112d
|
fix: fp found in testing
|
2023-01-18 18:41:07 +01:00 |
|
|
Nasreddine Bencherchali
|
85fb255bc9
|
feat: new rules and updates
|
2023-01-17 01:00:44 +01:00 |
|
|
Nasreddine Bencherchali
|
8707345be7
|
fix: add related metadata
|
2023-01-13 17:21:21 +01:00 |
|
|
Nasreddine Bencherchali
|
28a3413aa7
|
feat: updates and enhancements
|
2023-01-11 01:03:52 +01:00 |
|
|
frack113
|
4023bf2c83
|
Remove mitre url
|
2023-01-10 18:09:04 +01:00 |
|
|
Nasreddine Bencherchali
|
81f75c1d2e
|
feat: updates and enhancements
|
2023-01-10 00:13:37 +01:00 |
|
|
frack113
|
756a248032
|
update logsource
|
2023-01-04 18:52:24 +01:00 |
|
|
Nasreddine Bencherchali
|
a25027fef8
|
fix: rename links from old repo to SigmaHQ
|
2022-12-27 21:05:16 +01:00 |
|
|
frack113
|
7060db3d47
|
Promotion rules (#3821)
* Promotion rules
* fix missing null
* fix: modified date
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-12-27 12:29:10 +01:00 |
|
|
Nasreddine Bencherchali
|
e6baac1bf2
|
fix: exclude teamviewer fp & reduce severity
|
2022-12-23 20:50:38 +01:00 |
|
|
Nasreddine Bencherchali
|
21f5bf8536
|
feat: new rules related to rat software based on #2841
|
2022-12-23 20:42:51 +01:00 |
|
|
Nasreddine Bencherchali
|
03cc78e916
|
feat: filename test enhancements (#3812)
|
2022-12-23 09:25:16 +01:00 |
|
|
Qasim Qlf
|
29377ddfff
|
fix: updated targetUserName and ipAddress
|
2022-12-22 14:16:25 +05:00 |
|
|
Nasreddine Bencherchali
|
beccf416da
|
feat: add two new rules
|
2022-12-20 23:44:44 +01:00 |
|
|
Nasreddine Bencherchali
|
681c720509
|
fix: fp in user_driver_loaded rule
|
2022-12-12 22:30:08 +01:00 |
|
|
Nasreddine Bencherchali
|
7c7057d9d3
|
fix: rename .net etw tamper rules
|
2022-12-09 18:06:58 +01:00 |
|
|
Nasreddine Bencherchali
|
89e44d46cb
|
feat: update .net etw tamper rules
|
2022-12-09 18:06:20 +01:00 |
|
|
Nasreddine Bencherchali
|
559b4c4e97
|
Merge branch 'nasbench-rule-devel' of https://github.com/nasbench/sigma into nasbench-rule-devel
|
2022-12-09 13:41:21 +01:00 |
|
|
Florian Roth
|
356ab98ada
|
fix: FPs with Important Scheduled Task Deleted
|
2022-12-09 12:55:41 +01:00 |
|
|
Nasreddine Bencherchali
|
6f6cb9648d
|
fix: fp found in testing
|
2022-12-09 10:33:52 +01:00 |
|
|
Nasreddine Bencherchali
|
fa318243c2
|
Merge branch 'SigmaHQ:master' into nasbench-rule-devel
|
2022-12-08 19:22:11 +01:00 |
|
|
Nasreddine Bencherchali
|
0567ca8ca3
|
fix: fix unused selection
|
2022-12-08 11:57:40 +01:00 |
|
|
Nasreddine Bencherchali
|
f12975bc6b
|
fix: update description
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
|
2022-12-07 22:34:56 +01:00 |
|
|
Nasreddine Bencherchali
|
a425ef65e5
|
feat: update metadata and add more cases for rules
|
2022-12-07 02:26:21 +01:00 |
|
|
Nasreddine Bencherchali
|
a7bfb349ee
|
fix: fix fp found in testing
|
2022-12-07 02:25:52 +01:00 |
|
|
Nasreddine Bencherchali
|
42b99b165d
|
feat: new rules and fixes (#3759)
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
|
2022-12-06 12:13:20 +01:00 |
|
|
Nasreddine Bencherchali
|
9657446647
|
fix: apply suggestions from code review
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
|
2022-12-06 10:53:57 +01:00 |
|
|
Nasreddine Bencherchali
|
dbf114e7cb
|
feat: add rules related to scheduled tasks
|
2022-12-05 23:52:11 +01:00 |
|
|
frack113
|
54739006a9
|
Fix workflow warning
|
2022-12-04 15:29:08 +01:00 |
|
|
frack113
|
a674ee246b
|
Update Title (#3739)
|
2022-11-30 11:44:15 +01:00 |
|
|
frack113
|
c820216541
|
Update Title (#3733)
|
2022-11-28 06:43:17 +01:00 |
|
|
frack113
|
cd4121d966
|
Update Title (#3731)
Co-authored-by: Florian Roth <venom14@gmail.com>
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-11-27 19:19:27 +01:00 |
|
|
Qasim Qlf
|
ed54bf44a5
|
Minor Fix
|
2022-11-22 18:13:34 +05:00 |
|
|
Nasreddine Bencherchali
|
6603ca9202
|
fix: update rules to not use regex
|
2022-11-18 11:16:13 +01:00 |
|
|
Florian Roth
|
0fb1295157
|
fix: FPs noticed with Aurora
|
2022-11-13 20:26:03 +01:00 |
|
|
Yamato Security
|
5de1fd6f2d
|
Rule add: windows access token abuse (#3675)
Co-authored-by: Florian Roth <venom14@gmail.com>
|
2022-11-09 09:43:15 +01:00 |
|
|
frack113
|
8b749fb126
|
Order yaml field
|
2022-10-25 11:08:51 +02:00 |
|
|
frack113
|
f78e9e9034
|
Add rule
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-10-24 17:52:05 +02:00 |
|
|
Nasreddine Bencherchali
|
4a61f56c5f
|
Update win_security_susp_possible_shadow_credentials_added.yml
|
2022-10-19 19:06:00 +02:00 |
|
|
Nasreddine Bencherchali
|
87c0788fca
|
Update win_security_susp_possible_shadow_credentials_added.yml
|
2022-10-19 19:04:53 +02:00 |
|
|
Nasreddine Bencherchali
|
a6edfd6c21
|
Add more details to the definition section
Add more details to the definition section for events from the "Audit Directory Service Changes"
|
2022-10-18 17:35:02 +02:00 |
|
|
Nasreddine Bencherchali
|
2758e67185
|
Update win_security_susp_possible_shadow_credentials_added.yml
|
2022-10-18 17:08:09 +02:00 |
|
|
Nasreddine Bencherchali
|
18ed0ce02a
|
Update win_security_susp_possible_shadow_credentials_added.yml
|
2022-10-18 17:07:36 +02:00 |
|
|
Nasreddine Bencherchali
|
ce567a4d8d
|
Fix wording in definition + Add FP description
|
2022-10-18 16:02:41 +02:00 |
|