 Florian Roth
|
1702c057c6
|
Merge branch 'master' into rule-devel
|
2021-11-26 20:02:40 +01:00 |
|
|
Florian Roth
|
ed73510b48
|
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
|
2021-11-26 20:00:56 +01:00 |
|
|
Florian Roth
|
03cddbba29
|
fix: FPs
|
2021-11-26 20:00:55 +01:00 |
|
|
Florian Roth
|
91f0e03481
|
Merge pull request #2319 from SigmaHQ/aurora-false-positive-fixing
fix: FP with suspicious svchost.exe rule
|
2021-11-26 18:40:05 +01:00 |
|
|
Florian Roth
|
9c8a649e6c
|
fix: FP with suspicious svchost.exe rule
|
2021-11-26 17:12:33 +01:00 |
|
|
Florian Roth
|
8228c77f4e
|
Merge pull request #2317 from SigmaHQ/aurora-false-positive-fixing
fix: FPs with rules
|
2021-11-26 16:18:52 +01:00 |
|
|
Florian Roth
|
d91b925873
|
fix: FPs
|
2021-11-26 14:42:21 +01:00 |
|
|
frack113
|
06d0fd02cc
|
Merge pull request #2310 from austinsonger/kubernetes_cronjobs
Updating azure_kubernetes_cronjob.yml
|
2021-11-26 06:51:48 +01:00 |
|
|
frack113
|
1e85356f4f
|
Merge pull request #2309 from austinsonger/admission-controllers
Kubernetes Admission Controllers
|
2021-11-26 06:51:23 +01:00 |
|
|
Florian Roth
|
a6c9a8772c
|
Merge branch 'master' into aurora-false-positive-fixing
|
2021-11-26 00:09:09 +01:00 |
|
|
Florian Roth
|
11fc576103
|
fix: FPs with rules
|
2021-11-25 19:04:27 +01:00 |
|
|
phantinuss
|
979a00c2f4
|
fix: FPs found with Aurora
|
2021-11-25 15:36:08 +01:00 |
|
|
frack113
|
a507848834
|
Update azure_kubernetes_cronjob.yml
|
2021-11-25 10:21:39 +01:00 |
|
|
phantinuss
|
271e8291a5
|
fix: remove unneeded escape
|
2021-11-25 09:24:04 +01:00 |
|
|
frack113
|
34626e41de
|
Update gcp_kubernetes_admission_controller.yml
|
2021-11-25 09:11:09 +01:00 |
|
|
Austin Songer
|
0873483e25
|
Update gcp_kubernetes_admission_controller.yml
|
2021-11-25 00:14:52 -06:00 |
|
|
Austin Songer
|
a4969fe5d8
|
Update azure_kubernetes_admission_controller.yml
|
2021-11-25 00:12:55 -06:00 |
|
|
Austin Songer
|
55190e32ca
|
Update azure_kubernetes_cronjob.yml
|
2021-11-25 00:11:07 -06:00 |
|
|
Austin Songer
|
9a5f3b415e
|
Update gcp_kubernetes_admission_controller.yml
|
2021-11-25 00:06:36 -06:00 |
|
|
Austin Songer
|
f54b618cd4
|
Update gcp_kubernetes_admission_controller.yml
|
2021-11-25 00:05:54 -06:00 |
|
|
Austin Songer
|
fd5ad4b940
|
Update azure_kubernetes_admission_controller.yml
|
2021-11-25 00:05:43 -06:00 |
|
|
Austin Songer
|
2d58a3c8f9
|
Update azure_kubernetes_admission_controller.yml
|
2021-11-25 00:00:28 -06:00 |
|
|
Austin Songer
|
47fb21fae6
|
Create azure_kubernetes_admission_controller.yml
|
2021-11-24 23:58:33 -06:00 |
|
|
Austin Songer
|
8d50ab9e5f
|
Create gcp_kubernetes_admission_controller.yml
|
2021-11-24 23:53:57 -06:00 |
|
|
frack113
|
bdb00f403f
|
fix rule
|
2021-11-24 19:24:16 +01:00 |
|
|
frack113
|
960a03eaf4
|
add lobas Binary
|
2021-11-24 19:17:00 +01:00 |
|
|
Florian Roth
|
3e8b43e324
|
Merge pull request #2307 from SigmaHQ/aurora-false-positive-fixing
Aurora false positive fixing
|
2021-11-24 17:31:44 +01:00 |
|
|
Florian Roth
|
b6bfb1074d
|
Merge pull request #2305 from phantinuss/master
rule: rundll calling shell32 with dll in suspicious location + Download via Certreq
|
2021-11-24 17:30:56 +01:00 |
|
|
Florian Roth
|
ce7d101b86
|
Merge branch 'master' into aurora-false-positive-fixing
|
2021-11-24 16:59:53 +01:00 |
|
|
Florian Roth
|
f60e8e5d17
|
fix: more false positive filters
|
2021-11-24 16:58:53 +01:00 |
|
|
phantinuss
|
eb8c9c046b
|
rule: download using certreq
|
2021-11-24 16:39:44 +01:00 |
|
|
Florian Roth
|
3ace3808a5
|
refactor: Shell File Write to Suspicious Folder rule
|
2021-11-24 15:54:42 +01:00 |
|
|
Florian Roth
|
fd6e3bb572
|
fix: dbghelp/dbgcore DLL load FP
|
2021-11-24 13:47:30 +01:00 |
|
|
Florian Roth
|
5e91d30e29
|
Merge pull request #2306 from SigmaHQ/rule-devel
refactor: change rule for CVE-2021-42321 exploitation
|
2021-11-24 13:42:17 +01:00 |
|
|
Florian Roth
|
88cc418b98
|
Merge branch 'rule-devel' into aurora-false-positive-fixing
|
2021-11-24 13:42:00 +01:00 |
|
|
Florian Roth
|
ed021f1bd4
|
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
|
2021-11-24 12:37:55 +01:00 |
|
|
Florian Roth
|
236b69e6f7
|
Update win_exchange_cve_2021_42321.yml
|
2021-11-24 12:37:51 +01:00 |
|
|
phantinuss
|
b807aba67a
|
fix: key/value
|
2021-11-24 11:41:02 +01:00 |
|
|
phantinuss
|
30b57f33ed
|
rule: rundll calling shell32 with dll in suspicious location
|
2021-11-24 10:56:58 +01:00 |
|
|
Florian Roth
|
4a69c71b2f
|
Update lnx_shell_clear_cmd_history.yml
|
2021-11-24 09:31:12 +01:00 |
|
|
Florian Roth
|
94c61bf07a
|
Update lnx_shell_clear_cmd_history.yml
|
2021-11-24 09:29:48 +01:00 |
|
|
Florian Roth
|
9f14e70746
|
Merge pull request #2303 from secjunkie/master
Update lnx_shell_clear_cmd_history.yml
|
2021-11-24 09:28:06 +01:00 |
|
|
Florian Roth
|
2c07bd562f
|
Merge pull request #2301 from SigmaHQ/rule-devel
refactor: reworked psexec / paexec rules
|
2021-11-24 09:27:35 +01:00 |
|
|
frack113
|
a28154dba0
|
Merge pull request #2302 from frack113/fix_field
fix field name
|
2021-11-24 06:20:59 +01:00 |
|
|
frack113
|
a1db916851
|
Merge pull request #2299 from frack113/update_FP
Update detection win_system_defender_disabled.yml
|
2021-11-24 06:20:32 +01:00 |
|
|
frack113
|
bf9b3844a6
|
Merge pull request #2298 from austinsonger/kubernetes-cronjob
Kubernetes cronjob
|
2021-11-24 06:20:16 +01:00 |
|
|
Florian Roth
|
424bed1915
|
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
|
2021-11-24 00:27:45 +01:00 |
|
|
Florian Roth
|
37b445d3bb
|
fix: FPs that only show up in Aurora
Sysmon configs are often too restricted
|
2021-11-24 00:27:43 +01:00 |
|
|
secjunkie
|
b76d000f26
|
Update lnx_shell_clear_cmd_history.yml
cat and ln can use zero or null
chattr does not clear but stops further logging
|
2021-11-23 23:06:23 +00:00 |
|
|
frack113
|
b81b5666ce
|
fix field name
|
2021-11-23 18:47:42 +01:00 |
|