 frack113
|
89d2d00a5b
|
Redcannary
|
2022-12-11 16:46:32 +01:00 |
|
|
frack113
|
646d861471
|
Redcannary
|
2022-12-11 10:57:28 +01:00 |
|
|
Veramine
|
9662897442
|
Update proc_creation_win_susp_conhost_option.yml (#3763)
|
2022-12-09 21:13:58 +01:00 |
|
|
frack113
|
e1224b7fce
|
Merge pull request #3770 from qasimqlf/patch-16
fix: condition
|
2022-12-09 19:45:03 +01:00 |
|
|
Nasreddine Bencherchali
|
bacd8078c5
|
feat: update detection section
|
2022-12-09 19:18:09 +01:00 |
|
|
Florian Roth
|
356ab98ada
|
fix: FPs with Important Scheduled Task Deleted
|
2022-12-09 12:55:41 +01:00 |
|
|
Qasim Qlf
|
fb8e0894b0
|
fix: condition
|
2022-12-09 13:42:49 +05:00 |
|
|
Florian Roth
|
4013ee645e
|
Merge pull request #3767 from qasimqlf/patch-14
Added more FPs
|
2022-12-09 09:07:17 +01:00 |
|
|
Florian Roth
|
9afbf6d530
|
Merge pull request #3769 from qasimqlf/patch-15
Fix the filter
|
2022-12-09 09:07:04 +01:00 |
|
|
Qasim Qlf
|
868be248dd
|
Fix the filter
|
2022-12-09 11:27:28 +05:00 |
|
|
Nasreddine Bencherchali
|
fa318243c2
|
Merge branch 'SigmaHQ:master' into nasbench-rule-devel
|
2022-12-08 19:22:11 +01:00 |
|
|
Florian Roth
|
e78cb13cfd
|
Merge pull request #3764 from pbssubhash/master
Detection for LSASS Shtinkering
|
2022-12-08 17:36:18 +01:00 |
|
|
Florian Roth
|
ece1d01038
|
fix: syntax error, additional comma
|
2022-12-08 17:34:56 +01:00 |
|
|
Qasim Qlf
|
c18f634c02
|
Added more FPs
|
2022-12-08 21:08:01 +05:00 |
|
|
Nasreddine Bencherchali
|
80ef3b70dc
|
fix: broken single item lists
|
2022-12-08 16:23:58 +01:00 |
|
|
Nasreddine Bencherchali
|
18c3c8528d
|
fix: remove tamper protection value
|
2022-12-08 12:13:14 +01:00 |
|
|
Nasreddine Bencherchali
|
0567ca8ca3
|
fix: fix unused selection
|
2022-12-08 11:57:40 +01:00 |
|
|
Nasreddine Bencherchali
|
edc99c92a2
|
fix: enhance rules related to Lsass-Shtinkering
|
2022-12-08 11:02:56 +01:00 |
|
|
pbssubhash
|
bea46b2b9e
|
Update to modify FP and UUID
|
2022-12-08 12:13:25 +05:30 |
|
|
pbssubhash
|
4bb1df9f6e
|
Update to remove FP
|
2022-12-08 12:03:02 +05:30 |
|
|
pbssubhash
|
9ea5fac51c
|
Update proc_creation_lsass_shtinkering.yml
|
2022-12-08 11:56:40 +05:30 |
|
|
pbssubhash
|
d393b57c36
|
Detection for LSASS Shtinkering
|
2022-12-08 11:49:53 +05:30 |
|
|
Nasreddine Bencherchali
|
f12975bc6b
|
fix: update description
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
|
2022-12-07 22:34:56 +01:00 |
|
|
Nasreddine Bencherchali
|
b1a657b7de
|
fix: add spaces to avoid fp with other keys
|
2022-12-07 22:27:27 +01:00 |
|
|
Nasreddine Bencherchali
|
9a5a0fed20
|
feat: update test to include more cases
|
2022-12-07 22:21:05 +01:00 |
|
|
Nasreddine Bencherchali
|
b59566ad0f
|
fix: fix FP found in testing
|
2022-12-07 11:52:38 +01:00 |
|
|
Nasreddine Bencherchali
|
1d749cee54
|
fix: duplicate id
|
2022-12-07 02:44:31 +01:00 |
|
|
Nasreddine Bencherchali
|
899b1606f8
|
fix: duplicate id
|
2022-12-07 02:38:19 +01:00 |
|
|
Nasreddine Bencherchali
|
a425ef65e5
|
feat: update metadata and add more cases for rules
|
2022-12-07 02:26:21 +01:00 |
|
|
Nasreddine Bencherchali
|
a7bfb349ee
|
fix: fix fp found in testing
|
2022-12-07 02:25:52 +01:00 |
|
|
Nasreddine Bencherchali
|
850d4fcd50
|
feat: update windefend rules
|
2022-12-07 00:20:56 +01:00 |
|
|
BlueTeamOps
|
8fa8a73551
|
Updated proc_creation_win_iis_service_account_password_dumped.yml (#3682)
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-12-06 13:10:58 +01:00 |
|
|
Nasreddine Bencherchali
|
42b99b165d
|
feat: new rules and fixes (#3759)
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
|
2022-12-06 12:13:20 +01:00 |
|
|
frack113
|
4b82b00ae9
|
Sysmoneop CMd shell (#3760)
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-12-06 12:12:43 +01:00 |
|
|
Florian Roth
|
1aab97e8f9
|
Merge pull request #3758 from SigmaHQ/aurora-false-positive-fixing
fix: missing modified date update
|
2022-12-05 20:40:05 +01:00 |
|
|
Florian Roth
|
2b769fcfc8
|
fix: missing modified date update
|
2022-12-05 19:58:10 +01:00 |
|
|
Florian Roth
|
e493a41bc6
|
Merge pull request #3757 from SigmaHQ/aurora-false-positive-fixing
fix: FPs noticed in Nextron testing CI
|
2022-12-05 18:54:31 +01:00 |
|
|
Florian Roth
|
1796502b90
|
fix: FPs noticed in Nextron testing CI
|
2022-12-05 17:39:42 +01:00 |
|
|
gs3cl
|
122cb47d71
|
Gs3cl patch 1 (#3753)
|
2022-12-05 10:39:58 +01:00 |
|
|
frack113
|
32160be8bf
|
Merge pull request #3755 from frack113/fix_sigma_warning
Fix workflow warning
|
2022-12-04 18:08:24 +01:00 |
|
|
frack113
|
53e04deae9
|
Merge pull request #3751 from fukusuket/refactor-remove-unnecessary-escape-regex
refactor: remove unnesessary escape(in |re block)
|
2022-12-04 18:00:37 +01:00 |
|
|
Florian Roth
|
9375fe95b4
|
Merge pull request #3748 from SigmaHQ/rule-devel
Rule refactoring, improvements
|
2022-12-04 17:55:14 +01:00 |
|
|
Florian Roth
|
d7a9fa9e1b
|
Merge pull request #3754 from SigmaHQ/aurora-false-positive-fixing
fix: FPs
|
2022-12-04 17:54:28 +01:00 |
|
|
frack113
|
54739006a9
|
Fix workflow warning
|
2022-12-04 15:29:08 +01:00 |
|
|
Florian Roth
|
6390915eb0
|
fix: FPs
|
2022-12-04 14:36:22 +01:00 |
|
|
Florian Roth
|
0db7f7f7cc
|
rule: SysmonEOP
|
2022-12-04 14:36:04 +01:00 |
|
|
Florian Roth
|
e3ba9ee336
|
Merge pull request #3750 from nasbench/nasbench-rule-devel
feat: general updates and fixes
|
2022-12-03 14:50:50 +01:00 |
|
|
fukusuket
|
9c76aac1fc
|
refactor: remove unnesessary escape.
|
2022-12-03 21:56:00 +09:00 |
|
|
frack113
|
3ab7ed6436
|
Update proc_creation_win_gpg4win_susp_usage.yml
|
2022-12-03 13:09:50 +01:00 |
|
|
Nasreddine Bencherchali
|
77b1234572
|
fix: apply code review changes
|
2022-12-03 11:55:54 +01:00 |
|