 Florian Roth
|
c007ecf90c
|
Merge pull request #585 from Neo23x0/devel
Devel
|
2019-12-30 15:08:43 +01:00 |
|
|
Florian Roth
|
5980cb8d0c
|
rule: copy from admin share - lateral movement
|
2019-12-30 14:25:43 +01:00 |
|
|
Florian Roth
|
86e6b92903
|
rule: SecurityXploded tool
|
2019-12-30 14:25:29 +01:00 |
|
|
Florian Roth
|
5ad793e04a
|
Merge pull request #582 from tvjust/patch-1
Added new sticky key attack binary
|
2019-12-30 14:14:20 +01:00 |
|
|
GelosSnake
|
f574c20432
|
Update win_system_exe_anomaly.yml
fixing to much original fork.
|
2019-12-29 18:02:49 +02:00 |
|
|
GelosSnake
|
7e7f6d1182
|
Update win_system_exe_anomaly.yml
Following sigma event I've noticed my twitter account was referenced:
https://twitter.com/GelosSnake/status/934900723426439170
Rule:
https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_system_exe_anomaly.yml
Seems like - '\SystemRoot\System32\\*' is missing and hence triggering an FP.
|
2019-12-29 18:01:19 +02:00 |
|
|
Justin Schoenfeld
|
a1f07cdb4b
|
Added new sticky key attack binary
|
2019-12-29 08:32:23 -05:00 |
|
|
david-burkett
|
4a65a25070
|
svchost spawned without cli
|
2019-12-28 10:28:08 -05:00 |
|
|
david-burkett
|
35b4806104
|
corrected logic
|
2019-12-28 09:55:39 -05:00 |
|
|
David Burkett
|
474a8617e5
|
Trickbot behavioral recon activity
|
2019-12-27 21:25:53 -05:00 |
|
|
Florian Roth
|
fc8607bbea
|
rule: whoami as local system
|
2019-12-22 18:50:26 +01:00 |
|
|
Florian Roth
|
fb76f2b9ac
|
rule: CreateMiniDump
|
2019-12-22 08:29:12 +01:00 |
|
|
Florian Roth
|
511229c0b6
|
rule: modified Bloodhound rule
|
2019-12-21 21:22:13 +01:00 |
|
|
Florian Roth
|
1fd4c26005
|
Merge pull request #569 from Neo23x0/devel
rule: improved bloodhound rule
|
2019-12-20 17:32:21 +01:00 |
|
|
Florian Roth
|
0fa5ba925e
|
rule :improved bloodhound rule
|
2019-12-20 17:23:40 +01:00 |
|
|
Florian Roth
|
cbebaf637f
|
Merge pull request #568 from Neo23x0/devel
Devel
|
2019-12-20 16:22:29 +01:00 |
|
|
Florian Roth
|
0e82dce2a0
|
fix: fixed wrong condition
|
2019-12-20 16:11:39 +01:00 |
|
|
Florian Roth
|
0000257371
|
rule: improved bloodhound rule
|
2019-12-20 16:08:26 +01:00 |
|
|
Florian Roth
|
3a933c38f2
|
rule: changed level of BloodHound rule
|
2019-12-20 15:37:58 +01:00 |
|
|
Florian Roth
|
68efeb909d
|
rule: false positive condition for BloodHound rule
|
2019-12-20 15:35:13 +01:00 |
|
|
Florian Roth
|
825b1edb0f
|
Merge pull request #567 from Neo23x0/devel
Devel
|
2019-12-20 15:32:56 +01:00 |
|
|
Florian Roth
|
708c17e2bc
|
rule: Bloodhound
|
2019-12-20 14:59:36 +01:00 |
|
|
Florian Roth
|
ab038d1ac7
|
style: minor changes
|
2019-12-20 14:59:26 +01:00 |
|
|
Florian Roth
|
0a26184286
|
Merge pull request #563 from Neo23x0/devel
Devel
|
2019-12-17 14:48:07 +01:00 |
|
|
Florian Roth
|
c8b6b5c556
|
rule: updating csc.exe rule
|
2019-12-17 13:45:40 +01:00 |
|
|
Florian Roth
|
7a3041c593
|
rule: improved csc.exe rule
|
2019-12-17 11:05:43 +01:00 |
|
|
Florian Roth
|
e8d92fab0c
|
rule: ryuk ransomware
|
2019-12-16 20:33:12 +01:00 |
|
|
Florian Roth
|
da06e5bc1c
|
Merge pull request #562 from Neo23x0/devel
Improved PowerShell Encoded Command Rule
|
2019-12-16 19:31:15 +01:00 |
|
|
Florian Roth
|
bbaa9df217
|
rule: better JAB rule
|
2019-12-16 19:08:51 +01:00 |
|
|
Florian Roth
|
f83eb2268e
|
rule: improved JAB expression
|
2019-12-16 19:04:05 +01:00 |
|
|
Florian Roth
|
bd7c996588
|
rule: suspicious PS rule modified to cover newest malware campaigns
|
2019-12-16 19:02:57 +01:00 |
|
|
Thomas Patzke
|
1369b3a2dc
|
Merge pull request #537 from webhead404/webhead404-contrib-sigma
Added sigma rule to detect external devices or USB drive
|
2019-12-13 21:50:01 +01:00 |
|
|
Thomas Patzke
|
7a280ae092
|
Merge pull request #557 from robrankin/fix_dupe_rule_name
Elastalert error, duplicate rule titles
|
2019-12-13 21:46:58 +01:00 |
|
|
Florian Roth
|
9c59e3cf13
|
Merge branch 'master' into devel
|
2019-12-12 09:40:02 +01:00 |
|
|
Florian Roth
|
c25b902add
|
Merge pull request #558 from vburov/patch-7
Added svchost.exe as a parent image
|
2019-12-10 20:17:22 +01:00 |
|
|
Vasiliy Burov
|
977551c69d
|
Added some suspicious locations
Added 'C:\Windows\Tasks' and 'C:\Windows\System32\Tasks' as suspicious locations accordingly article: https://github.com/ThreatHuntingProject/ThreatHunting/blob/master/hunts/suspicious_process_creation_via_windows_event_logs.md
|
2019-12-10 20:17:40 +03:00 |
|
|
Vasiliy Burov
|
0dd4324aba
|
Added svchost.exe as a parent image
Added svchost.exe as a parent image accordingly this article (https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/) and my investigations.
|
2019-12-10 19:31:12 +03:00 |
|
|
Rob Rankin
|
e251568760
|
Data Compressed duplciate titles
|
2019-12-09 16:24:10 +00:00 |
|
|
Florian Roth
|
e1244acf49
|
rule: fixed and extended bitsadmin rule
|
2019-12-06 13:39:04 +01:00 |
|
|
Florian Roth
|
c1647ca4b7
|
Merge branch 'master' into devel
|
2019-12-06 13:38:29 +01:00 |
|
|
Florian Roth
|
c8e29da7ec
|
fix: simplified rule with RE
|
2019-12-03 11:24:06 +01:00 |
|
|
Florian Roth
|
fc09533f56
|
style: fixed title
|
2019-12-03 11:24:06 +01:00 |
|
|
Florian Roth
|
39293d5f2b
|
rule: another reference for CVE-2019-1388 rule
|
2019-11-20 15:09:30 +01:00 |
|
|
Florian Roth
|
f9e6a929ba
|
rule: made it more specific - command line must contain URL
|
2019-11-20 09:23:04 +01:00 |
|
|
Florian Roth
|
55e66b1843
|
rule: added status
|
2019-11-20 09:21:42 +01:00 |
|
|
Florian Roth
|
4022e3251b
|
rule: changed title
|
2019-11-20 09:16:00 +01:00 |
|
|
Florian Roth
|
158f6b3065
|
rule: exploitation of CVE-2019-1388
|
2019-11-20 09:12:02 +01:00 |
|
|
Florian Roth
|
da05c9bb82
|
fix: line break in description
|
2019-11-18 15:26:55 +01:00 |
|
|
Florian Roth
|
ff3ed04405
|
rule: Exploiting SetupComplete.cmd CVE-2019-1378
|
2019-11-15 00:26:18 +01:00 |
|
|
Florian Roth
|
2b7699cc15
|
fix: fixed broken condition
|
2019-11-14 10:15:18 +01:00 |
|