 Thomas Patzke
|
2715c44173
|
Converted first Sysmon rule to generic process_execution rule
|
2018-08-14 21:34:54 +02:00 |
|
|
Thomas Patzke
|
2c0e76be3d
|
Escaped * where required
|
2018-08-10 13:53:08 +02:00 |
|
|
Lurkkeli
|
7cdc13ef11
|
Update
|
2018-08-08 17:05:51 +02:00 |
|
|
Lurkkeli
|
392351af25
|
Adding ATT&CK tag
|
2018-08-08 16:43:54 +02:00 |
|
|
Lurkkeli
|
4d721f1803
|
Updating fps
|
2018-08-08 16:42:26 +02:00 |
|
|
Lurkkeli
|
b9f433414d
|
hiding files with attrib.exe
|
2018-08-08 16:19:39 +02:00 |
|
|
Thomas Patzke
|
92c0e0321a
|
Merge pull request #144 from samsson/patch-7
Added att&ck tags
|
2018-08-07 11:19:36 +02:00 |
|
|
Lurkkeli
|
a245820519
|
added att&ck tag
|
2018-08-07 08:54:53 +02:00 |
|
|
Lurkkeli
|
294677a2cc
|
added att&ck tag
|
2018-08-07 08:50:01 +02:00 |
|
|
Lurkkeli
|
a57e87b345
|
added att&ck tag
|
2018-08-07 08:49:05 +02:00 |
|
|
Lurkkeli
|
99253763af
|
added att&ck tag
|
2018-08-07 08:45:58 +02:00 |
|
|
Lurkkeli
|
0bff27ec21
|
added att&ck tactic
added att&ck tactic, no specific techniques applicable
|
2018-08-07 08:37:51 +02:00 |
|
|
Lurkkeli
|
198cb63182
|
added att&ck tactic
added att&ck tactic, no specific techniques applicable
|
2018-08-07 08:36:53 +02:00 |
|
|
Thomas Patzke
|
518e21fcd2
|
Merge pull request #134 from nikseetharaman/sysmon_cmstp_com_object_access
Add CMSTP UAC Bypass via COM Object Access
|
2018-08-07 08:33:33 +02:00 |
|
|
Thomas Patzke
|
b9fdf07926
|
Extended tagging
|
2018-08-07 08:33:18 +02:00 |
|
|
Lurkkeli
|
b50c13dd1f
|
Update att&ck tag
|
2018-08-07 08:27:24 +02:00 |
|
|
Thomas Patzke
|
5d5d42eb9b
|
Merge pull request #140 from yt0ng/master
Possible Shim Database Persistence via sdbinst.exe
|
2018-08-07 08:22:32 +02:00 |
|
|
Thomas Patzke
|
80eaedab8b
|
Fixed tag and date
|
2018-08-07 08:22:11 +02:00 |
|
|
Thomas Patzke
|
3509fbd201
|
Merge pull request #142 from samsson/patch-5
Added ATT&CK tag
|
2018-08-07 08:20:22 +02:00 |
|
|
Thomas Patzke
|
b049210641
|
Fixed tags
|
2018-08-07 08:20:09 +02:00 |
|
|
Lurkkeli
|
3456f9a74d
|
Update sysmon_susp_wmi_execution.yml
|
2018-08-07 08:19:58 +02:00 |
|
|
Thomas Patzke
|
64fa3b162d
|
Tag fixes
|
2018-08-07 08:18:16 +02:00 |
|
|
Lurkkeli
|
6472be5e19
|
Update sysmon_uac_bypass_sdclt.yml
|
2018-08-07 08:08:53 +02:00 |
|
|
Lurkkeli
|
21bee17ffd
|
Update sysmon_uac_bypass_eventvwr.yml
|
2018-08-07 08:07:49 +02:00 |
|
|
yt0ng
|
fc091fe3d7
|
Added ATTCK Mapping
|
2018-08-05 14:00:22 +02:00 |
|
|
yt0ng
|
b65cb5eaca
|
Possible Shim Database Persistence via sdbinst.exe
|
2018-08-05 13:55:04 +02:00 |
|
|
Nik Seetharaman
|
b938fdb0a3
|
Add CMSTP UAC Bypass via COM Object Access
|
2018-07-27 02:28:28 -05:00 |
|
|
James Dickenson
|
5fc118dcac
|
added a few mitre attack tags to windows sysmon rules
|
2018-07-26 21:15:07 -07:00 |
|
|
Florian Roth
|
a9fcecab88
|
Merge pull request #130 from samsson/patch-4
Fixed typo / Created a rule
|
2018-07-26 22:34:46 +02:00 |
|
|
Florian Roth
|
089498b0b3
|
Merge pull request #131 from yt0ng/master
Possible SafetyKatz Dump of debug.bin
|
2018-07-25 07:41:38 +02:00 |
|
|
Florian Roth
|
dd857c4470
|
Cosmetics
If it's only 1 value we write it like this to avoid it being interpreted as a list with 1 element and to avoid an extra line.
|
2018-07-25 07:37:17 +02:00 |
|
|
yt0ng
|
b415fc8d42
|
Possible SafetyKatz Dump of debug.bin
https://github.com/GhostPack/SafetyKatz
|
2018-07-24 23:51:46 +02:00 |
|
|
Lurkkeli
|
0e9c5bb14a
|
Update sysmon_rundll32_net_connections.yml
|
2018-07-24 20:01:47 +02:00 |
|
|
Thomas Patzke
|
01e7675e24
|
Merge pull request #124 from samsson/patch-1
ATT&CK tagging
|
2018-07-24 07:58:50 +02:00 |
|
|
Thomas Patzke
|
30d255ab6f
|
Fixed tag
|
2018-07-24 07:58:25 +02:00 |
|
|
Lurkkeli
|
1898157df5
|
ATT&CK tagging
Added tag for technique t1015
|
2018-07-23 23:57:15 +02:00 |
|
|
yt0ng
|
16160dfc80
|
added additional binaries and attack tactics/techniques
|
2018-07-23 15:47:56 +02:00 |
|
|
Suleyman Ozarslan
|
e6cbc17c12
|
ATT&CK tagging of Scheduled Task Creation
|
2018-07-22 15:56:47 +03:00 |
|
|
Suleyman Ozarslan
|
8d9b12be07
|
ATT&CK tagging of Default PowerSploit Schtasks Persistence
|
2018-07-22 15:53:56 +03:00 |
|
|
Suleyman Ozarslan
|
080892b5ab
|
ATT&CK tagging of MSHTA Spawning Windows Shell
|
2018-07-20 09:53:55 +03:00 |
|
|
Suleyman Ozarslan
|
76f277d5fe
|
ATT&CK tagging of Malicious Named Pipe rule
|
2018-07-20 09:41:54 +03:00 |
|
|
Suleyman Ozarslan
|
7e74527344
|
ATT&CK software tag is added to Bitsadmin Download rule
|
2018-07-20 09:35:35 +03:00 |
|
|
Florian Roth
|
1e61adfad1
|
rule: Changed Registry persistence Explorer RUN key rule
|
2018-07-19 16:27:19 -06:00 |
|
|
Florian Roth
|
83d6f12ce3
|
rule: Registry persistence in Explorer RUN key pointing to suspicious folder
|
2018-07-19 16:27:19 -06:00 |
|
|
Thomas Patzke
|
f98158f5ad
|
Further ATT&CK tagging
|
2018-07-19 23:36:13 +02:00 |
|
|
Suleyman Ozarslan
|
05b91847cd
|
ATT&CK tagging of Suspicious Certutil Command rule
|
2018-07-19 16:42:39 +03:00 |
|
|
Thomas Patzke
|
bdea097b80
|
ATT&CK tagging
|
2018-07-17 23:58:11 +02:00 |
|
|
Florian Roth
|
9e92b97661
|
Merge pull request #111 from nikseetharaman/cmstp_execution
Add sysmon_cmstp_execution
|
2018-07-17 14:39:56 -06:00 |
|
|
Florian Roth
|
3f0040b983
|
Removed duplicate status field
|
2018-07-16 15:55:31 -06:00 |
|
|
Florian Roth
|
429474b6d6
|
Merge pull request #113 from megan201296/patch-9
fixed typo
|
2018-07-16 15:38:52 -06:00 |
|