aa8a0f5e1f
Merge pull request #606 from Neo23x0/devel
...
refactor: moved rues from 'apt' folder in respective folders
2020-02-01 18:25:19 +01:00
03ecb3b8dc
refactor: moved rues from 'apt' folder in respective folders
2020-02-01 17:59:26 +01:00
8c4aadb423
Merge branch 'master' into Renamed_Files
2020-01-31 08:49:10 +01:00
190afcac88
Missing ID, wrong tag
2020-01-31 07:32:28 +01:00
033ab26d5e
Added date
2020-01-31 07:21:02 +01:00
82cae6d63c
Merge pull request #604 from Neo23x0/devel
...
New tests, colorized test output and rule cleanup
2020-01-31 07:07:13 +01:00
d42e87edd7
fix: fixed casing and long rule titles
2020-01-30 17:26:09 +01:00
e79e99c4aa
fix: fixed missing date fields in remaining files
2020-01-30 16:07:37 +01:00
376092cfd3
Merge pull request #565 from RiccardoAncarani/master
...
Add Covenant default named pipe
2020-01-29 20:28:00 +01:00
d48fc9d1ff
fix: multiple false positive conditions
2020-01-28 10:11:09 +01:00
c24bbdcf81
Sigma queries for
...
-- terminating threads in a svchost process (InvokePhantom uses this technique to disable windows event logging)
-- GALLIUM threat intel IOCs in recent MSTIC blog/release.
2020-01-24 15:31:06 +01:00
4f29556a01
Update win_susp_winword_wmidll_load.yml
...
Update x2
2020-01-24 15:31:06 +01:00
48a071ad4e
Update win_susp_winword_wmidll_load.yml
...
Fix to error on incorrect mitre tags used.
2020-01-24 15:31:06 +01:00
4260d01ff0
Initial Upload
...
Submit Sigma Rule For Detecting Word Loading WMI DLL's.
2020-01-24 15:31:06 +01:00
b34bf98c61
Fixed rule: added condition
2020-01-07 15:20:16 +01:00
fd28a64591
rule: WCE
2019-12-31 09:27:38 +01:00
8b70cb6761
Add Covenant default named pipe
...
Covenant (https://github.com/cobbr/Covenant ) can use named pipes for peer to peer communication.
The default named pipe name is "\gruntsvc".
References: https://posts.specterops.io/designing-peer-to-peer-command-and-control-ad2c61740456
2019-12-18 15:19:47 +00:00
98aa4d4ecb
fix: fixed typo in rule for renamed procdump
2019-11-19 15:59:07 +01:00
2c855be9d3
fix: casing fix in renamed procdump rule
2019-11-18 15:57:14 +01:00
93f890b31d
rule: renamed procdump
2019-11-18 15:27:04 +01:00
0592cbb67a
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
5f6a4225ec
Unified line terminators of rules to Unix
2019-11-12 23:05:36 +01:00
d42cc78509
Converted rules Sysmon/1 parts to generic process_creation
2019-11-12 21:06:24 +01:00
0065e2420f
Merge branch 'oscd-qa'
2019-11-12 20:54:11 +01:00
b7c3f8da91
refactor: cleanup, single element lists, renamed files, level adjustments
2019-11-12 12:55:05 +01:00
038f205f0f
fix: FPs with UserInitMprLogonScript rule
2019-11-09 23:32:53 +01:00
fbe138ed90
rule: reduced level of rule to medium due to FPs
2019-11-09 23:24:31 +01:00
b176339da8
Merge pull request #479 from alexpetrov12/master
...
add rule
2019-11-08 02:16:22 +03:00
98f32e9098
Delete sysmon_mimikatz_сreds_dump.yml
...
merged with rules/windows/sysmon/sysmon_cred_dump_lsass_access.yml
2019-11-08 02:06:31 +03:00
6d61401b12
Delete sysmon_сreds_dump.yml
...
merged with rules/windows/sysmon/sysmon_cred_dump_lsass_access.yml
2019-11-08 02:06:20 +03:00
562e07de38
Delete cobalt_execute_assembly.yml
...
merged with existing [sysmon_cobaltstrike_process_injection.yml](https://github.com/Neo23x0/sigma/blob/oscd/rules/windows/sysmon/sysmon_cobaltstrike_process_injection.yml )
2019-11-08 01:42:42 +03:00
52d099a6e3
improve sysmon_cobaltstrike_process_injection.yml
2019-11-08 01:41:26 +03:00
6083d70975
Update sysmon_registry_persistence_key_linking.yml
2019-11-07 04:23:20 +03:00
ce849a1184
Merge branch 'master' into oscd
2019-11-04 20:48:19 +03:00
1f1fd68331
Merge pull request #472 from feedb/oscd
...
add 11 new rules:
- rules/linux/auditd/lnx_auditd_web_rce.yml
- rules/windows/process_creation/process_creation_susp_bginfo.yml
- rules/windows/process_creation/process_creation_susp_cdb.yml
- rules/windows/process_creation/process_creation_susp_devtoolslauncher.yml
- rules/windows/process_creation/process_creation_susp_dnx.yml
- rules/windows/process_creation/process_creation_susp_dxcap.yml
- rules/windows/process_creation/process_creation_susp_msoffice.yml
- rules/windows/process_creation/process_creation_susp_odbcconf.yml
- rules/windows/process_creation/process_creation_susp_openwith.yml
- rules/windows/process_creation/process_creation_susp_psr_capture_screenshots.yml
- rules/windows/sysmon/sysmon_webshell_creation_detect.yml
2019-11-04 20:40:58 +03:00
19396fd274
Update sysmon_webshell_creation_detect.yml
2019-11-04 19:23:52 +03:00
0117dac1db
fix: bound sysmon logon script rule to field
...
Fixed rule:
- rules/windows/sysmon/sysmon_logon_scripts_userinitmprlogonscript.yml
2019-11-02 11:47:20 +01:00
8ff85499c8
rule: svchost dll search order hijack
2019-10-28 12:03:03 +01:00
7aa804fe90
added new rules
...
Packet capture Windows command prompt, ODBCCONF execution dll, Windows Registry Persistence - COM key linking
2019-10-25 18:01:36 +03:00
cc998aa667
fix
2019-10-24 00:48:43 +03:00
f1ccf296f4
fix
2019-10-24 00:40:58 +03:00
d3715a508b
fix
2019-10-23 18:15:46 +03:00
4c84412944
added new rule
...
silenttrinity_stage_ use, sysmon_mimikatz_сreds_dump, sysmon_registry_persistence_key_linking, sysmon_сreds_dump
2019-10-23 18:08:30 +03:00
e38540a37f
fix
2019-10-23 13:28:04 +03:00
c1cfbacd24
fix
2019-10-23 13:18:57 +03:00
ad9b98541c
fix
2019-10-23 13:05:38 +03:00
fa4a8c974d
fix
2019-10-23 12:45:06 +03:00
f4ea01217e
fix
2019-10-23 02:47:04 +03:00
ebe4fe0377
fix
2019-10-23 02:42:37 +03:00
6c4f4ce309
fix
2019-10-23 02:25:04 +03:00
Florian Roth