94bb7dd77f
fix: issues
2020-02-13 09:17:21 +01:00
21e4aa33dc
rule modification: fixed filter condition on zeek suspicious rc4 traffic
2020-02-12 21:27:36 -08:00
93367d725d
rule: zeek suspicious kerberos RC4 traffic
2020-02-12 21:21:46 -08:00
a4c210ed16
rule: remove keywords in powershell rule prone to FPs
2020-02-11 16:26:17 +01:00
bf98d286f9
Merge pull request #615 from Neo23x0/devel
...
fix: dumpert rule with wrong sysmon event id
2020-02-08 20:03:28 +01:00
d9645af840
rule: added Emotet UA
...
https://twitter.com/webbthewombat/status/1225827092132179968
2020-02-08 10:37:56 +01:00
080532d20c
logsource change
...
I've swapped the lines in the logsource section to make it clearer that the category "process_creation" covers all sources that generate process creation logs on the windows platform.
2020-02-07 15:47:27 +01:00
f70f847524
additional gallium ttp
...
sha1 process creation only makes sense for sysmon
2020-02-07 14:08:40 +00:00
be9b80d6ab
fix: dumpert rule with wrong sysmon event id
2020-02-07 13:14:18 +01:00
1a80b180fd
Merge pull request #613 from Neo23x0/devel
...
rule: dumpert process dump tool
2020-02-04 23:07:07 +01:00
10490a6cee
rule: reworked dumpert rule
2020-02-04 22:56:04 +01:00
1f44969afd
rule: avoiding build issues with sysmon event id 1
2020-02-04 22:50:46 +01:00
535e2d149b
rule: improved dumpert rule
2020-02-04 22:46:16 +01:00
8f8b977c85
rule: dumpert process dump tool
2020-02-04 22:38:06 +01:00
0d7f55948c
additional execution observed
2020-02-02 08:07:00 +01:00
aa8a0f5e1f
Merge pull request #606 from Neo23x0/devel
...
refactor: moved rues from 'apt' folder in respective folders
2020-02-01 18:25:19 +01:00
03ecb3b8dc
refactor: moved rues from 'apt' folder in respective folders
2020-02-01 17:59:26 +01:00
6ea861da53
Merge pull request #605 from Neo23x0/devel
...
Winnti rule and helpful message in test script
2020-02-01 15:51:16 +01:00
a752e6c95f
rule: winnti group campaign against HK universities
2020-02-01 15:43:30 +01:00
7a222920df
added 'date'
2020-01-31 15:27:30 +01:00
913c839780
added 'id'
2020-01-31 15:26:43 +01:00
848e0c90e4
Merge branch 'master' into master
2020-01-31 14:45:29 +01:00
1213712978
Merge branch 'master' into patch-1
2020-01-31 14:32:27 +01:00
afecca3c13
Merge pull request #511 from 4A616D6573/patch-3
...
Created win_susp_local_anon_logon_created.yml
2020-01-31 14:30:54 +01:00
8c4aadb423
Merge branch 'master' into Renamed_Files
2020-01-31 08:49:10 +01:00
190afcac88
Missing ID, wrong tag
2020-01-31 07:32:28 +01:00
e3d61d5579
Missing ID
2020-01-31 07:31:56 +01:00
033ab26d5e
Added date
2020-01-31 07:21:02 +01:00
82cae6d63c
Merge pull request #604 from Neo23x0/devel
...
New tests, colorized test output and rule cleanup
2020-01-31 07:07:13 +01:00
ae2c186872
rule: wsreset.exe UAC bypass
2020-01-30 18:05:47 +01:00
d42e87edd7
fix: fixed casing and long rule titles
2020-01-30 17:26:09 +01:00
e79e99c4aa
fix: fixed missing date fields in remaining files
2020-01-30 16:07:37 +01:00
efd3af0812
fix: fixed missing date fields in other files
2020-01-30 15:32:39 +01:00
617ece1aa2
fix: fixed missing date fields in proxy rules
2020-01-30 15:20:52 +01:00
4ad71c44bc
chore: moved network device rules to the 'network' folder
2020-01-30 14:30:26 +01:00
5130072b04
Merge pull request #529 from c2defense/master
...
Network Device Analytics
2020-01-30 14:28:44 +01:00
30d872f98f
Merge pull request #492 from booberry46/master
...
Bypass Windows Defender
2020-01-30 14:27:30 +01:00
598b750f48
Minor change
2020-01-30 10:31:16 +01:00
8cef4b2941
fix: missing id
2020-01-30 10:14:18 +01:00
bf81ff90a8
fix: using a specific field
2020-01-30 10:13:33 +01:00
0207eeece4
fix: hyphen
2020-01-30 10:10:03 +01:00
2f1890b5e8
Update win_rdp_reverse_tunnel.yml
2020-01-30 10:09:41 +01:00
8ec0060938
fix: fixing bug
2020-01-30 10:09:22 +01:00
6ca100cabf
reverted changes
2020-01-30 10:08:25 +01:00
0a4d32c7c7
fix: fixing issues
2020-01-30 10:07:24 +01:00
9828d7f81d
re-added old reference
2020-01-30 10:03:09 +01:00
d90ea6d267
improved rule
2020-01-30 09:58:32 +01:00
d2122b6b83
Merge pull request #594 from sreemanshanker/master
...
Sigma rule to Monitor for writing of malicious files to system32 and syswow64 folders
2020-01-30 09:14:58 +01:00
6adc732d79
Merge pull request #603 from Neo23x0/devel
...
Colorized Testing
2020-01-30 09:14:25 +01:00
2c38c53829
fix: removed test rule
2020-01-30 08:52:33 +01:00
Florian Roth