91c4c4ecc5
refactor: slightly improved Greenbug rule
2020-05-21 13:38:11 +02:00
9a3b6c1c77
docs: added MITRE ATT&CK group tag
2020-05-21 09:44:11 +02:00
344eb713c5
rule: Greenbug campaign
2020-05-21 09:39:57 +02:00
fd386fe8eb
standardize rules with Image and CommandLine instead of NewProcessName and ProcessCommandLine
2020-05-15 12:35:32 -04:00
8e082283f0
Merge pull request #754 from Neo23x0/rule-devel
...
Rule devel
2020-05-15 12:07:04 +02:00
54cf535dbc
remove false positives with cmd as child of services.exe (not specifically related to meterpreter/cobaltstrike)
2020-05-15 04:45:25 -04:00
ab950fb89d
fix: removed rules missing in master
2020-05-14 15:53:09 +02:00
7652813c2c
Merge pull request #752 from zaphodef/fix/win_susp_script_execution_false_negatives
...
Widen the search as it gives too many false negatives
2020-05-13 21:02:12 +02:00
78a5c743f2
Widen the search as it gives too many false negatives
2020-05-13 16:20:23 +02:00
78a8266a1b
Merge pull request #749 from teddy-ROxPin/patch-6
...
Create win_advanced_ip_scanner.yml
2020-05-13 14:09:12 +02:00
220a14f31c
fix: typo in contains
2020-05-13 12:38:54 +02:00
a1856c5743
Update win_advanced_ip_scanner.yml
2020-05-13 11:56:25 +02:00
a9ef7ef382
Fix a bad CommandLine search
2020-05-13 11:32:05 +02:00
bb17fd74ee
Create win_advanced_ip_scanner.yml
...
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
2020-05-12 21:43:01 -06:00
1104044f53
fix: delete duplicate rules
2020-05-11 10:55:02 +02:00
2b18b66c16
Merge branch 'master' into rule-devel
2020-05-11 10:50:10 +02:00
4366a95024
rule: Maze ransomware
2020-05-11 10:46:26 +02:00
f96c3a5fd4
Merge branch 'master' into rule-devel
...
# Conflicts:
# rules/proxy/proxy_ua_suspicious.yml
# rules/windows/process_creation/win_install_reg_debugger_backdoor.yml
# rules/windows/process_creation/win_susp_csc_folder.yml
2020-05-11 10:44:19 +02:00
2d38cb7b52
fix incorrect use of global
2020-05-06 23:00:45 +02:00
c71e10a7f3
Merge pull request #717 from Karneades/renamedbinary
...
Add netsh to renamed binary rule
2020-05-02 14:12:34 +02:00
b4b9b0155f
Merge pull request #716 from Karneades/patch-1
...
Add rule to detect wifi creds harvesting using netsh
2020-05-02 14:12:10 +02:00
4600bf73dc
Update rules to follow the Sigma state specification
...
The [Sigma specification's status component](https://github.com/Neo23x0/sigma/wiki/Specification#status-optional ) states the following:
> Declares the status of the rule:
> - stable: the rule is considered as stable and may be used in production systems or dashboards.
> - test: an almost stable rule that possibly could require some fine tuning.
> - experimental: an experimental rule that could lead to false results or be noisy, but could also identify interesting events.
However the Sigma Rx YAML specification states the following:
> ```yaml
> status:
> type: //any
> of:
> - type: //str
> value: stable
> - type: //str
> value: testing
> - type: //str
> value: experimental
> ```
The specification confuses the `test` and `testing` state. This commit changes the `test` state into the `testing` state which is already used in the code-base:
- [`sigma/sigma-schema.rx.yml`](https://github.com/Neo23x0/sigma/blob/a805d18bbae60d3e4f291c8a18304104ed2e71c7/sigma-schema.rx.yml#L49 )
- [`sigma/tools/sigma/filter.py`](https://github.com/Neo23x0/sigma/blob/f3c60a63099f80296c8750aaba667e98ac71a4f7/tools/sigma/filter.py#L26 )
- [`sigma/tools/sigmac`](https://github.com/Neo23x0/sigma/blob/4e42bebb3480720966a59528cd8482c6271e603c/tools/sigmac#L98 )
Although not modifyable through a PR, the specification should furthermore be updated to use the `testing` state.
2020-04-24 20:50:31 +02:00
7d437c2969
Add netsh to renamed binary rule
2020-04-20 17:12:25 +02:00
d4e9606266
Improve netsh wifi rule another time due to arg shortcut
2020-04-20 16:40:03 +02:00
af498d8a8c
Improve rule to detect argument shortcut in netsh wlan rule
2020-04-20 16:32:25 +02:00
ba541c3952
Fix title for new netsh wifi rule
2020-04-20 16:20:45 +02:00
d9e5274c9e
Add rule to detect wifi creds harvesting using netsh
2020-04-20 16:14:44 +02:00
3889be6255
Replace reference link for win_susp_netsh_dll_persistence
2020-04-10 01:05:10 -05:00
82db80bee6
Remove wrong mitre technique
2020-04-10 01:02:43 -05:00
72b821e046
Update win_susp_netsh_dll_persistence.yml
2020-04-09 11:16:18 -05:00
551a94af04
Merge branch 'master' of https://github.com/tileo/sigma into pr-658
2020-04-08 22:43:48 +02:00
4e3985866b
Update and rename sysmon_win_chm.yml to win_html_help_spawn.yml
2020-04-03 16:50:48 +02:00
81d0f82272
Create new rule T1223
...
Suspicious Compiled HTML File
2020-04-03 16:56:26 +03:00
c0ab9c5745
Merge pull request #671 from HarishHary/powershell_downgrade_attack
...
Powershell downgrade attack (small improvements)
2020-04-03 09:31:33 +02:00
fe5dbece3d
Date typos...more than I thought...
2020-04-02 10:00:00 +02:00
97c0872c81
Date typo.
2020-04-02 09:53:09 +02:00
95e0b12d88
Fixed date typo - by the looks of the commit date the month/date were swapped.
2020-04-01 18:18:13 +02:00
fe5b5a7782
Merge pull request #673 from j91321/rules-minor-fixes
...
Minor fixes to several rules
2020-03-28 13:27:05 +01:00
bbb10a51f4
Update win_powershell_downgrade_attack.yml
2020-03-28 13:17:58 +01:00
0e94eb9e86
Update win_powershell_downgrade_attack.yml
2020-03-28 13:12:07 +01:00
dabc759136
Eliminate title collision
...
Fixing the problem described in HELK here: https://github.com/Cyb3rWard0g/HELK/issues/442 where when running sigmac to generate elastalert rules, this rule has a title collision with another rule in the same directory and causes elastalert to fail to start.
2020-03-26 09:13:52 -05:00
28953a2942
fix: MITRE tags in rule
2020-03-25 18:11:04 +01:00
6584729a0d
rule: powershell downloadfile
2020-03-25 14:58:14 +01:00
35e43db7a7
fix: converted CRLF line break to LF
2020-03-25 14:36:34 +01:00
17297193c7
Merge branch 'master' into devel
2020-03-25 14:18:11 +01:00
50b0d04ee8
rule: Exploited CVE-2020-10189 Zoho ManageEngine
2020-03-25 14:02:53 +01:00
28d8b87a0f
rule: extended web shell spawn rule
2020-03-25 14:02:39 +01:00
1d86e0b4a5
Change falsepositives to array
2020-03-24 19:59:54 +01:00
c784adb10b
Wrong indentation falsepositives
2020-03-24 19:55:41 +01:00
98a633e54c
Add missing status and falsepositives
2020-03-24 19:53:41 +01:00
Florian Roth