cb55ed9f93
Merge pull request #3496 from krestinichev/add-new-rule
...
Add new rule: proc_creation_disable_SEP
2022-09-16 10:37:02 +02:00
c2256845b2
refactor: renamed and changed title
2022-09-16 09:45:56 +02:00
b4376ea580
refactor: CRLF to LF
2022-09-16 09:22:21 +02:00
6d9d08e1de
Update proc_creation_disable_SEP.yml
2022-09-16 09:18:27 +02:00
c1293c3365
Merge pull request #3495 from nasbench/nasbench-rule-devel
...
Rule Dev (Updates)
2022-09-16 06:32:53 +02:00
eb4247fdb4
Add missing modified field
2022-09-14 15:03:50 +02:00
02cfd972ed
Add files via upload
2022-09-14 15:37:51 +03:00
653ad66f21
Updates
2022-09-14 12:29:57 +02:00
67bca96744
fix: wrong image selection
2022-09-13 13:13:16 +02:00
3b4fc8c3fd
VS Code Filter Fix - Undo the last commit
...
Previous Filter of Image was wrong. Image can't endsWith (Code.exe and attrib.exe) at the same time. Same condition with other scenario.
CommandLine filter is good.
2022-09-13 16:02:17 +05:00
8a504bee9e
Add %tmp% env variable
2022-09-13 10:49:14 +02:00
0caeaaa122
Update rules
2022-09-13 10:02:32 +02:00
d0286e210e
Merge pull request #3492 from SigmaHQ/rule-devel
...
Rule devel
2022-09-13 08:50:37 +02:00
2d7e545cad
fix: list with one element
2022-09-13 08:38:57 +02:00
c22974205f
Merge branch 'master' into rule-devel
2022-09-13 08:07:35 +02:00
72aa55f1c7
Merge branch 'master' into aurora-false-positive-fixing
2022-09-13 08:07:26 +02:00
61422ca237
rule: UAC Bypass via ICMLuaUtil
2022-09-13 08:07:15 +02:00
072a9d73eb
fix: changes to existing rules
2022-09-13 08:07:03 +02:00
5f164ebe12
style: indentation
2022-09-12 13:30:14 +02:00
0bbb679e38
fix: FPs with veam backup shell
2022-09-12 13:29:51 +02:00
1eaad811b6
tag added
2022-09-12 14:15:48 +05:00
93da67b593
Update proc_creation_win_renamed_vmnat.yml
...
Added accidentaly removed falsepositives
2022-09-11 13:13:58 +02:00
5656a3a50b
Merge branch 'SigmaHQ:master' into add_renamed_vmnat
2022-09-11 13:06:21 +02:00
d73aac41d3
Changes based on advice
2022-09-11 12:44:54 +02:00
21435629a0
Merge pull request #3482 from nasbench/nasbench-rule-devel
...
Rule Devel (New+Update)
2022-09-10 12:34:26 +02:00
e7084eee04
Merge pull request #3487 from SigmaHQ/aurora-false-positive-fixing
...
fix: fixing multiple FPs with the use of VSCode
2022-09-10 12:07:01 +02:00
0a5cfb93b3
fix: condition
2022-09-10 11:53:42 +02:00
7dbdd4d1c6
fix: fixing multiple FPs with the use of VSCode
2022-09-10 11:42:44 +02:00
a053be791c
Update proc_creation_win_user_discovery_get_aduser.yml
2022-09-10 09:49:14 +02:00
a616647b08
lowered score of scheduled task + SYSTEM rule
2022-09-10 09:48:50 +02:00
2552b75e72
Delete proc_creation_win_net_add_local_user.yml
2022-09-09 23:11:28 +02:00
6182b43279
Add rule for renamed vmnat.exe
2022-09-09 16:40:17 +02:00
14db9c9fb1
Update proc_creation_win_wmic_computersystem_recon.yml
2022-09-09 15:43:07 +02:00
a71ce185d7
Fix
2022-09-09 15:32:03 +02:00
b75fb5abf5
Renamed suspicious in rules file names to susp
2022-09-09 15:12:47 +02:00
051397b533
Update proc_creation_win_susp_schtasks_delete_all.yml
2022-09-09 15:10:49 +02:00
c8fc1cf21e
Update proc_creation_win_user_discovery_get_aduser.yml
2022-09-09 15:04:36 +02:00
70f9ff61ca
Big Update
2022-09-09 15:02:31 +02:00
fbc7733078
Update proc_creation_win_susp_reg_add.yml
2022-09-08 22:52:24 +02:00
dd67c4fd73
Dev
2022-09-08 22:50:57 +02:00
358e8a567e
Merge pull request #3474 from SigmaHQ/aurora-false-positive-fixing
...
fix: schtasks in suspicious parents rule
2022-09-08 09:09:26 +02:00
de68bf5559
fix: schtasks in suspicious parents rule
2022-09-08 09:00:58 +02:00
6813043323
Merge pull request #3468 from nasbench/nasbench-rule-devel
...
Rule Devel
2022-09-08 06:29:36 +02:00
6fea0e2c79
Merge pull request #3471 from qasimqlf/patch-5
...
Update proc_creation_win_bad_opsec_sacrificial_processes.yml
2022-09-08 06:28:25 +02:00
b70ac17676
Fix
2022-09-07 21:58:22 +02:00
43b56fed23
Merge pull request #3472 from SigmaHQ/rule-devel
...
rules: SysmonEnte, SharpEvtMute, sdelete rework
2022-09-07 21:06:03 +02:00
a69d256367
rule: SharpEvtMute
2022-09-07 16:33:52 +02:00
2ac92283e6
indentation and new hashes
2022-09-07 16:05:48 +02:00
88e9794a74
Update proc_creation_win_system_exe_anomaly.yml
2022-09-07 14:15:10 +02:00
bdccc5440a
Update proc_creation_win_bad_opsec_sacrificial_processes.yml
2022-09-07 15:28:06 +05:00
Florian Roth