ad59c90b29
Capitalization in Title
2019-09-28 10:30:16 +02:00
0eb5fd75e1
Merge pull request #446 from EccoTheFlintstone/eventclear
...
move wevtutil / fsutil events from ransomware to dedicated rules
2019-09-28 10:29:03 +02:00
29c5a9dc8e
Merge pull request #458 from EccoTheFlintstone/psexec
...
fix: PsExec false positives
2019-09-28 10:15:23 +02:00
5a15687c6c
fix rule: task manager as parent: task manager can be run with higher privileges (show processes from all users --> UAC) and its parent is still the old taskmgr
2019-09-27 11:06:21 -04:00
7a1d48cccd
fix: PsExec false positives
2019-09-26 04:50:43 -04:00
e77657db2f
Merge pull request #451 from EccoTheFlintstone/sysmon_clean
...
sysmon rules cleanup and move to process_creation
2019-09-25 17:28:23 +02:00
c2868f6e03
remove TAB from cli escape as it's currently unsupported in sigmac
2019-09-23 04:46:10 -04:00
0c96777f6a
sysmon rules cleanup and move to process_creation
2019-09-11 10:24:43 -04:00
b410710338
move wevtutil / fsutil events from ransomware to dedicated rules
2019-09-06 10:57:03 -04:00
fcbae16cc8
rule: image debugger
2019-09-06 10:28:20 +02:00
afe6668fbd
Merge pull request #438 from duzvik/master
...
Escaped '\*' to '\*' where required
2019-09-05 10:57:25 +02:00
f9f5558ae1
Merge pull request #392 from TareqAlKhatib/shim
...
Fixed commandline to detect any shim install from any location
2019-09-05 10:28:50 +02:00
bdf8f99fdb
fix typo
2019-09-04 11:31:00 -04:00
7bef822da7
rule: minor improvement to susp ps enc cmd
2019-09-04 16:31:49 +02:00
774be4d008
Escaped '\*' to '\*' where required
2019-09-04 14:05:58 +03:00
fc89804f34
rule: impacket framework lateralization detection
2019-09-03 10:28:59 -04:00
8cad0c638e
add comcvcs.dll memdump method
2019-09-02 07:49:19 -04:00
dca5a7a248
Merge pull request #432 from EccoTheFlintstone/master
...
add/modify powershell Empire rules
2019-09-02 11:40:36 +02:00
5f30e52739
add/modify powershell Empire rules
2019-09-02 05:04:44 -04:00
ace0cc36c6
rule: improved csc rule
2019-08-31 08:44:09 +02:00
70a26a6132
fix: fixed MITRE tags
2019-08-24 13:58:54 +02:00
c321fc2680
rule: csc.exe suspicious source folder
2019-08-24 13:53:15 +02:00
b32ed3c817
rules: encoded FromBase64String keyword
2019-08-24 13:53:05 +02:00
87ce52f6fe
fix: fixed wrong MITRE tag
2019-08-23 23:19:39 +02:00
5bd242cb21
rule: encoded IEX
2019-08-23 23:13:36 +02:00
cc01f76e99
docs: minor changes
2019-08-22 14:22:55 +02:00
d0a24f4409
filter NULL values to remove false positives
2019-08-20 05:10:41 -04:00
4fcb52d098
fix: removed mmc susp rule due to many FPs
2019-08-07 14:26:15 +02:00
f6fd1df6f4
Rule: separate Ryuk rule created for VBurovs strings
2019-08-06 10:33:46 +02:00
a8b738e346
Merge pull request #380 from vburov/patch-5
...
Ryuk Ransomware commands from real case
2019-08-06 10:29:00 +02:00
42e6c9149b
Remove unneeded event code
2019-08-05 19:13:39 +02:00
0e3cc042f4
Add more exclusions to mmc process rule
2019-08-05 18:53:33 +02:00
5caa951b8f
Add new rule for detecting MMC spawning a shell
...
Add (analog to win_mshta_spawn_shell.yml) a dedicated rule for dedecting MMC spawning a shell. See https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_mshta_spawn_shell.yml . And it should cover the (removed) cmd part from the existing rule https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_susp_mmc_source.yml .
2019-08-05 18:42:31 +02:00
cfe44ad17d
Fix win_susp_mmc_source to match what title says
...
Remove cmd.exe filter to match what title and rule says: detect all processes created by MMC. A new dedicated rule will be created for detecting shells spawned by MMC.
2019-08-05 16:21:56 +02:00
6a8adc72ac
rule: reworked vssadmin rule
2019-08-04 11:27:17 +02:00
d32fc2b2cf
fix: fixing rule win_cmstp_com_object_access
...
https://github.com/Neo23x0/sigma/issues/408
2019-07-31 14:16:52 +02:00
0657f29c99
Rule: reworked win_susp_powershell_enc_cmd
2019-07-30 14:36:30 +02:00
d08a993159
Fixed commandline to detect any shim install from any location
2019-07-08 12:31:18 +03:00
0b883a90b6
fix: null value in separate expression
2019-07-02 20:14:45 +02:00
ce43d600e3
fix: added null value / application to 4688 problem
2019-07-02 10:51:48 +02:00
2f123f64a7
Added command that stops services.
2019-06-28 19:46:34 +03:00
3813d277a6
Ryuk Ransomware commands from real case
2019-06-28 19:26:05 +03:00
ad386474bf
fix: removed unusable extensions in proc exec context
2019-06-26 17:03:01 +02:00
708f3ef002
fix: fixed duplicate element in new double extension rule
2019-06-26 16:00:58 +02:00
41dc076959
Rule: suspicious double extension
2019-06-26 15:57:25 +02:00
39b5eddfc7
Rule: Suspicious userinit.exe child process
2019-06-23 13:27:06 +02:00
26036e0d35
fix: fixed image in taskmgr rule
2019-06-21 17:15:53 +02:00
ff7128209e
Adjusted level
2019-06-20 00:03:48 +02:00
0f8849a652
Rule fixes
...
* tagging
* removed spaces
* converted to generic log source
* typos/case
2019-06-20 00:01:56 +02:00
429c29ed5a
Merge pull request #363 from yugoslavskiy/win_kernel_and_3rd_party_drivers_exploits_token_stealing
...
rule added: Windows Kernel and 3rd-party drivers exploits. Token stea…
2019-06-19 23:43:10 +02:00
Florian Roth