 Florian Roth
|
9c8a649e6c
|
fix: FP with suspicious svchost.exe rule
|
2021-11-26 17:12:33 +01:00 |
|
|
Florian Roth
|
d91b925873
|
fix: FPs
|
2021-11-26 14:42:21 +01:00 |
|
|
Florian Roth
|
a6c9a8772c
|
Merge branch 'master' into aurora-false-positive-fixing
|
2021-11-26 00:09:09 +01:00 |
|
|
frack113
|
804c821d70
|
Merge pull request #2316 from redsand/HAWK_tags_enrichment
Hawk tags enrichment
|
2021-11-25 19:20:20 +01:00 |
|
|
Florian Roth
|
11fc576103
|
fix: FPs with rules
|
2021-11-25 19:04:27 +01:00 |
|
|
redsand (Tim Shelton)
|
2c79b4bb49
|
Merge branch 'SigmaHQ:master' into HAWK_tags_enrichment
|
2021-11-25 10:16:54 -06:00 |
|
|
Florian Roth
|
b8e0213d9c
|
Merge pull request #2315 from phantinuss/master
FPs found with Aurora
|
2021-11-25 16:27:58 +01:00 |
|
|
phantinuss
|
979a00c2f4
|
fix: FPs found with Aurora
|
2021-11-25 15:36:08 +01:00 |
|
|
frack113
|
c7753abb44
|
Merge pull request #2314 from phantinuss/master
fix: remove unneeded escape
|
2021-11-25 10:23:01 +01:00 |
|
|
phantinuss
|
271e8291a5
|
fix: remove unneeded escape
|
2021-11-25 09:24:04 +01:00 |
|
|
frack113
|
6f87ca8b54
|
Merge pull request #2308 from frack113/LOLBAS
Some Lolbas
|
2021-11-25 06:19:11 +01:00 |
|
|
frack113
|
bdb00f403f
|
fix rule
|
2021-11-24 19:24:16 +01:00 |
|
|
frack113
|
960a03eaf4
|
add lobas Binary
|
2021-11-24 19:17:00 +01:00 |
|
|
Florian Roth
|
3e8b43e324
|
Merge pull request #2307 from SigmaHQ/aurora-false-positive-fixing
Aurora false positive fixing
|
2021-11-24 17:31:44 +01:00 |
|
|
Florian Roth
|
b6bfb1074d
|
Merge pull request #2305 from phantinuss/master
rule: rundll calling shell32 with dll in suspicious location + Download via Certreq
|
2021-11-24 17:30:56 +01:00 |
|
|
Florian Roth
|
ce7d101b86
|
Merge branch 'master' into aurora-false-positive-fixing
|
2021-11-24 16:59:53 +01:00 |
|
|
Florian Roth
|
f60e8e5d17
|
fix: more false positive filters
|
2021-11-24 16:58:53 +01:00 |
|
|
phantinuss
|
eb8c9c046b
|
rule: download using certreq
|
2021-11-24 16:39:44 +01:00 |
|
|
Florian Roth
|
3ace3808a5
|
refactor: Shell File Write to Suspicious Folder rule
|
2021-11-24 15:54:42 +01:00 |
|
|
Florian Roth
|
fd6e3bb572
|
fix: dbghelp/dbgcore DLL load FP
|
2021-11-24 13:47:30 +01:00 |
|
|
Florian Roth
|
5e91d30e29
|
Merge pull request #2306 from SigmaHQ/rule-devel
refactor: change rule for CVE-2021-42321 exploitation
|
2021-11-24 13:42:17 +01:00 |
|
|
Florian Roth
|
88cc418b98
|
Merge branch 'rule-devel' into aurora-false-positive-fixing
|
2021-11-24 13:42:00 +01:00 |
|
|
Florian Roth
|
ed021f1bd4
|
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
|
2021-11-24 12:37:55 +01:00 |
|
|
Florian Roth
|
236b69e6f7
|
Update win_exchange_cve_2021_42321.yml
|
2021-11-24 12:37:51 +01:00 |
|
|
phantinuss
|
b807aba67a
|
fix: key/value
|
2021-11-24 11:41:02 +01:00 |
|
|
phantinuss
|
30b57f33ed
|
rule: rundll calling shell32 with dll in suspicious location
|
2021-11-24 10:56:58 +01:00 |
|
|
Florian Roth
|
4a69c71b2f
|
Update lnx_shell_clear_cmd_history.yml
|
2021-11-24 09:31:12 +01:00 |
|
|
Florian Roth
|
94c61bf07a
|
Update lnx_shell_clear_cmd_history.yml
|
2021-11-24 09:29:48 +01:00 |
|
|
Florian Roth
|
9f14e70746
|
Merge pull request #2303 from secjunkie/master
Update lnx_shell_clear_cmd_history.yml
|
2021-11-24 09:28:06 +01:00 |
|
|
Florian Roth
|
2c07bd562f
|
Merge pull request #2301 from SigmaHQ/rule-devel
refactor: reworked psexec / paexec rules
|
2021-11-24 09:27:35 +01:00 |
|
|
frack113
|
a28154dba0
|
Merge pull request #2302 from frack113/fix_field
fix field name
|
2021-11-24 06:20:59 +01:00 |
|
|
frack113
|
a1db916851
|
Merge pull request #2299 from frack113/update_FP
Update detection win_system_defender_disabled.yml
|
2021-11-24 06:20:32 +01:00 |
|
|
frack113
|
bf9b3844a6
|
Merge pull request #2298 from austinsonger/kubernetes-cronjob
Kubernetes cronjob
|
2021-11-24 06:20:16 +01:00 |
|
|
Florian Roth
|
424bed1915
|
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
|
2021-11-24 00:27:45 +01:00 |
|
|
Florian Roth
|
37b445d3bb
|
fix: FPs that only show up in Aurora
Sysmon configs are often too restricted
|
2021-11-24 00:27:43 +01:00 |
|
|
secjunkie
|
b76d000f26
|
Update lnx_shell_clear_cmd_history.yml
cat and ln can use zero or null
chattr does not clear but stops further logging
|
2021-11-23 23:06:23 +00:00 |
|
|
Tim Shelton
|
fff12a3461
|
adding antivirus filter for vendor_type.. was matching against our fim data
|
2021-11-23 18:14:51 +00:00 |
|
|
frack113
|
b81b5666ce
|
fix field name
|
2021-11-23 18:47:42 +01:00 |
|
|
Florian Roth
|
33c5e027d3
|
refactor: psexec flags
|
2021-11-23 18:00:48 +01:00 |
|
|
Tim Shelton
|
ad75a9a5bf
|
updating hawk backend to provide additional tag enrichment. helps manage the state of each sigma rule, if experimental or not
|
2021-11-23 16:57:43 +00:00 |
|
|
Florian Roth
|
99fc5fc3cc
|
refactor: reworked psexec / paexec rules
|
2021-11-23 16:34:31 +01:00 |
|
|
Florian Roth
|
f1c31bda02
|
fix: FPs noticed in Suspicious System.Drawing Load
|
2021-11-23 12:33:11 +01:00 |
|
|
Florian Roth
|
653950e456
|
Merge pull request #2300 from SigmaHQ/aurora-false-positive-fixing
Aurora false positive fixing
|
2021-11-23 10:52:54 +01:00 |
|
|
Florian Roth
|
0a682f6fe0
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2021-11-23 09:37:23 +01:00 |
|
|
Florian Roth
|
614046c241
|
fix: missing filter in condition
|
2021-11-23 09:37:20 +01:00 |
|
|
frack113
|
b764153d4f
|
Update detection
|
2021-11-23 08:16:10 +01:00 |
|
|
Austin Songer
|
70d1e6d0f3
|
Update azure_kubernetes_cronjob.yml
|
2021-11-22 22:45:35 -06:00 |
|
|
Austin Songer
|
253ec56d1c
|
Create azure_kubernetes_cronjob.yml
|
2021-11-22 22:40:06 -06:00 |
|
|
Austin Songer
|
5c118eef46
|
Create gcp_kubernetes_cronjob.yml
|
2021-11-22 22:39:39 -06:00 |
|
|
Florian Roth
|
17c04919af
|
Merge pull request #2297 from SigmaHQ/aurora-false-positive-fixing
Aurora false positive fixing
|
2021-11-22 22:06:26 +01:00 |
|