25d3a5a893
Remove "condition" from global rule.
...
The condition field in this rule was in the global section which overwrote the condition in sub-rules and generated FPs. For example, once Sigma read the rule, the bottom sub-rule's "condition" was overwritten with "1 of them".
2020-05-17 12:44:57 -07:00
a46e357874
Merge branch 'master' into rule-devel
2020-05-16 08:59:34 +02:00
d5e7d4e302
fix: missing condition in CVE-2020-1048 rule
2020-05-16 08:59:05 +02:00
0575fa8d81
fix CVE 2020-1048 rule
2020-05-15 07:25:05 -04:00
cc26b26377
Merge branch 'master' into rule-devel
...
# Conflicts:
# rules/windows/sysmon/sysmon_cve-2020-1048.yml
2020-05-15 12:09:47 +02:00
8e7caf0e4d
rule: CVE-2020-1048
2020-05-15 12:08:31 +02:00
5854cc4677
fix: small bug in new CVE-2020-1048 rule
2020-05-15 11:37:46 +02:00
e53a97fa2f
Update condition to filter out printer port
2020-05-14 18:22:49 +07:00
443bf09d27
Add author
2020-05-14 18:10:16 +07:00
e74970cea0
Suspicious network connection from notepad.exe
2020-05-14 18:08:30 +07:00
97b690d340
Change level from Critical to High
2020-05-14 09:02:54 +07:00
d0b1c98d5a
Reformat rule
2020-05-14 00:39:41 +07:00
3e5b33388b
New rule to detect possible CVE-2020-1048 exploitation
2020-05-14 00:24:36 +07:00
1104044f53
fix: delete duplicate rules
2020-05-11 10:55:02 +02:00
f96c3a5fd4
Merge branch 'master' into rule-devel
...
# Conflicts:
# rules/proxy/proxy_ua_suspicious.yml
# rules/windows/process_creation/win_install_reg_debugger_backdoor.yml
# rules/windows/process_creation/win_susp_csc_folder.yml
2020-05-11 10:44:19 +02:00
514bd8657b
Merge pull request #704 from Iveco/master
...
Detect Ghost-In-The-Logs (disabling/bypassing ETW)
2020-04-14 14:11:27 +02:00
3175a48bdc
Casing
2020-04-14 13:40:34 +02:00
ecdec93800
Casing
2020-04-14 13:39:58 +02:00
86c6891427
Add Windows Registry Persistence COM Search Order Hijacking
2020-04-14 12:59:29 +02:00
c5211eb94a
Update sysmon_susp_service_installed.yml
...
CI
2020-04-08 18:54:46 +02:00
4520082ef7
Update sysmon_susp_procexplorer_driver_created_in_tmp_folder.yml
...
CI
2020-04-08 18:54:37 +02:00
6d85650390
Update sysmon_susp_procexplorer_driver_created_in_tmp_folder.yml
...
Fixed Author
2020-04-08 18:41:33 +02:00
fc1febdebe
Update sysmon_susp_service_installed.yml
...
Fixed Author
2020-04-08 18:41:25 +02:00
3280a1dfb0
Update sysmon_susp_procexplorer_driver_created_in_tmp_folder.yml
...
Fixed CI
2020-04-08 18:23:29 +02:00
5e724a0a54
Update sysmon_susp_service_installed.yml
...
Fixed CI
2020-04-08 18:22:51 +02:00
e87f2705a7
Detect Ghost-In-The-Logs (disabling/bypassing ETW)
2020-04-08 18:01:04 +02:00
fe5dbece3d
Date typos...more than I thought...
2020-04-02 10:00:00 +02:00
18cdddb09e
Small typo
2020-03-31 15:22:00 +02:00
8ea6b12eed
Merge pull request #670 from 0xThiebaut/sysmon_susp_desktop_ini
...
Add "Suspicious desktop.ini Action" rule
2020-03-28 13:34:01 +01:00
fe5b5a7782
Merge pull request #673 from j91321/rules-minor-fixes
...
Minor fixes to several rules
2020-03-28 13:27:05 +01:00
e2b90220a2
Update sysmon_susp_desktop_ini.yml
2020-03-28 13:19:10 +01:00
55258e1799
Title capitalized
2020-03-26 17:04:08 +01:00
68c20dca20
Fixed title length
2020-03-26 16:56:46 +01:00
ddacde9e6b
add LDAPFragger detections
2020-03-26 15:13:36 +01:00
35e43db7a7
fix: converted CRLF line break to LF
2020-03-25 14:36:34 +01:00
78bfa950d7
Add WinPrvSE.exe to detection
2020-03-24 19:47:10 +01:00
dce18b23b7
Add "Suspicious desktop.ini Action" rule
2020-03-19 21:43:03 +01:00
2489b8534c
sysmon registry events fix
2020-03-09 12:02:04 -04:00
7e8b59abe6
Merge pull request #643 from grumo35/patch-2
...
Update sysmon_cred_dump_tools_dropped_files.yml
2020-03-07 10:39:35 +01:00
b9e4734087
fix sysmon registry rules with HKLM/HKU format as used since 02/2017 in sysmon
2020-03-04 12:47:42 -05:00
f98ad7a8df
fix: wrong identifier
2020-03-03 11:25:02 +01:00
7139bfb0cb
fix: avoiding FPs with Citrix software
...
writing C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_r23phtye.jsp.ps1
2020-03-03 11:01:42 +01:00
fdcba84fc8
fix: escaped backslash
2020-02-29 10:12:59 +01:00
0d932810b5
Update sysmon_cred_dump_tools_dropped_files.yml
...
Adding sysinternal's procdump utility more about this on : https://en.hackndo.com/remote-lsass-dump-passwords/
2020-02-28 15:16:18 +01:00
f88225dd2a
Merge pull request #640 from Neo23x0/devel
...
fix: broader exclusion for rule - OneDrive false positives
2020-02-26 18:41:52 +01:00
6bbd80a8ee
fix: broader exclusion for rule - OneDrive false positives
2020-02-26 18:31:58 +01:00
0ba6874645
Merge pull request #638 from Neo23x0/devel
...
Several false positives with new rules
2020-02-26 09:46:02 +01:00
4f3e3166d3
fixing false positives
2020-02-26 09:33:55 +01:00
82d2b1e6f0
Merge branch 'master' into devel
...
# Conflicts:
# rules/windows/process_creation/win_susp_squirrel_lolbin.yml
2020-02-26 09:27:48 +01:00
e7aff17e72
FP: OneDrive setup
2020-02-26 09:26:19 +01:00
Maxime Lamothe-Brassard