ecdd32c462
Update lnx_auditd_hidden_files_directories.yml
...
Fixing typo.
2022-06-29 13:24:24 -04:00
926d72f7c2
fix: missing upper tick
2022-06-22 07:07:38 +02:00
e04003577f
Update proc_creation_lnx_susp_history_recon.yml
2022-06-22 07:05:03 +02:00
fe72dbf62f
Update proc_creation_lnx_susp_history_delete.yml
2022-06-22 07:04:30 +02:00
8096f06c18
fix: condition
2022-06-21 17:55:49 +02:00
ffbe19404e
fix: two rules
2022-06-21 17:45:50 +02:00
3f189e52c1
fix: typo in status
2022-06-21 17:21:44 +02:00
d2e86f9001
rule: Linux cmdline rules
2022-06-21 08:26:23 +02:00
f728893364
refactor: rule level adjustments - critical to high
2022-06-18 17:43:22 +02:00
143d70a959
Renamed CVE rule 5
2022-06-14 22:06:07 +01:00
5bf7b49671
Renamed More Rules
2022-06-14 19:28:27 +01:00
21c363cec9
Merge pull request #3102 from securepeacock/patch-25
...
Create proc_creation_lnx_nohup.yml
2022-06-07 10:47:34 +02:00
cc67d69360
Merge pull request #3100 from hazedav/dd-endswith
...
fix(rule): lnx_dd_file_overwrite /bin symlinks
2022-06-07 10:45:56 +02:00
9d4822b400
Update proc_creation_lnx_nohup.yml
2022-06-07 10:35:08 +02:00
e7b47c9069
Create proc_creation_lnx_nohup.yml
2022-06-06 23:22:50 -04:00
bc26970596
fix(rule): lnx_dd_file_overwrite /bin symlinks
...
This rule is subject to false negatives for *nix distros which
alias /bin to /usr/bin. By using endswith we can catch dd usage
for either /bin or /usr/bin.
2022-06-06 09:27:27 -05:00
1641eddaeb
Create proc_creation_lnx_susp_chmod_directories.yml
2022-06-03 19:24:02 -04:00
c2c1a2dcb7
Merge pull request #3090 from frack113/refractor_condition
...
Refactor condition
2022-06-03 17:02:31 +02:00
8de0027ca3
refactor condition
2022-06-03 15:35:24 +02:00
8bdd2562fb
fix: avoid regex, not actually needed
2022-06-03 14:55:09 +02:00
1cb985487c
windows and linux python pty spawning
2022-06-03 12:17:33 +02:00
984b0e553c
chore: reduce rule level
2022-06-03 12:17:33 +02:00
777b123ad0
Update proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
2022-06-03 08:38:24 +01:00
b2b070b516
Quick Update
2022-06-03 08:31:53 +01:00
66e0c405c8
Update proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
2022-06-03 08:09:14 +01:00
bb41bb6905
Update proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
2022-06-03 01:25:59 +01:00
8f947693ec
Update proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
2022-06-03 01:24:09 +01:00
0a0418615c
Create proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
2022-06-03 01:13:40 +01:00
b9a0c7e437
Mitre Update
2022-05-26 18:39:42 +02:00
7a33aac1ed
Update lnx_auditd_keylogging_with_pam_d.yml
...
adding missing uuid
2022-05-24 17:15:54 +02:00
89d88288d6
New detection - Linux Keylogging
2022-05-24 17:05:38 +02:00
112b715dd6
chore: test rules: reactivate single value list check
2022-05-10 17:13:04 +02:00
b4fdb13e8a
chore: test rules: check for unused selections
2022-05-10 11:07:40 +02:00
b991a5be52
chore: test rules: warn on errors or invalid FP reasons
...
also adapted the existing rules to pass the tests
2022-05-09 16:07:55 +02:00
a305a0be45
Merge pull request #2983 from d4rk-d4nph3/master
...
Added rule for Nimbuspwn exploitation
2022-05-05 20:41:30 +02:00
a70e96355c
Beautify the rule
2022-05-05 23:48:41 +05:45
7f2ad6df89
Fix for error
2022-05-05 11:24:20 +05:45
46827e2655
Added rule for Nimbuspwn exploitation
2022-05-04 20:30:40 +05:45
0bb96b323d
Update lnx_crontab_file_modification.yml
2022-04-19 19:47:12 +02:00
4212e24424
Update lnx_crontab_file_modification.yml
...
fixing title
2022-04-16 17:44:43 +02:00
c1db0b4fed
Adding Linxu crontab rule
2022-04-16 17:36:11 +02:00
3114433944
fix: product unix > linux
2022-03-24 11:40:51 +01:00
fb7d0b5469
refactor: move macos rules to separate dir
2022-03-24 09:17:05 +01:00
043747822f
fix: more falsepositives harmonization
2022-03-16 14:57:06 +01:00
6ae28b7a1c
fix: legitimate --> Legitimate
2022-03-16 14:35:19 +01:00
8d3f8acb60
fix: none --> Unknown
2022-03-16 14:19:21 +01:00
b23eee6ebf
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
9beafefe52
rules: suspicious linux patterns
2022-03-14 12:01:52 +01:00
7fb8272f94
Name Normalization
...
Name Normalization
2022-02-27 10:58:14 +01:00
ec7319be21
Name Normalization
...
Name Normalization
2022-02-27 07:39:46 +01:00
securepeacock