 Florian Roth
|
cdf0894e6a
|
Corrected error in certutil rules (-f means force overwrite, not file)
> the -urlcache is the relevant command
|
2017-07-20 12:54:55 -06:00 |
|
|
Florian Roth
|
3a55b31da2
|
certutil file download - more generic approach
|
2017-07-20 12:48:47 -06:00 |
|
|
Florian Roth
|
b85d96e458
|
certutil detections (renamed, extended)
see https://twitter.com/subTee/status/888102593838362624
|
2017-07-20 12:38:10 -06:00 |
|
|
Florian Roth
|
8f525d2f01
|
Wannacry Rules Reorg and Renaming
|
2017-06-28 09:08:53 +02:00 |
|
|
Florian Roth
|
576981820b
|
Moved PlugX rule & used builtin ID 4688 for another rule
|
2017-06-12 11:02:49 +02:00 |
|
|
Florian Roth
|
371b41acd9
|
Improved regsvr32.exe whitelisting bypass rule
thanks to Nick Carr https://twitter.com/ItsReallyNick/status/872409920938946560
|
2017-06-07 13:46:36 +02:00 |
|
|
Florian Roth
|
e5ad1b2f84
|
Improved regsvr32 whitelisting bypass rule
|
2017-06-07 12:02:55 +02:00 |
|
|
Florian Roth
|
1fd7a92e87
|
Regsvr32.exe anomalies (bugfix and new selection)
|
2017-06-07 11:43:25 +02:00 |
|
|
Florian Roth
|
0c222134b9
|
Extended malware script dropper rule
|
2017-05-25 14:59:16 +02:00 |
|
|
Florian Roth
|
0685e297c8
|
Improved Suspicious Net.exe Execution Rule
|
2017-05-25 12:44:56 +02:00 |
|
|
Florian Roth
|
6ad5f82248
|
Corrected rule
|
2017-05-25 12:06:23 +02:00 |
|
|
dimi
|
0b8c82b75b
|
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading
2) correct typo in dns server rule
|
2017-05-15 20:58:31 +02:00 |
|
|
Florian Roth
|
75e55d647b
|
Fixed and added strings
|
2017-05-13 18:33:51 +02:00 |
|
|
Florian Roth
|
46643324a8
|
Wannacrypt Update
|
2017-05-13 10:40:41 +02:00 |
|
|
Florian Roth
|
c40c592fb5
|
Changed rule as "m.vbs" isn't stable
|
2017-05-13 08:32:30 +02:00 |
|
|
Florian Roth
|
7c56992de5
|
Reference in WannaCrypt rule
|
2017-05-12 23:02:13 +02:00 |
|
|
Florian Roth
|
b7837d4cdb
|
Fixed WannaCrypt rule
|
2017-05-12 22:32:40 +02:00 |
|
|
Florian Roth
|
5cdb2b013b
|
WannaCrypt Ransomware
|
2017-05-12 21:57:53 +02:00 |
|
|
Florian Roth
|
16ac2337a4
|
Suspicious DNS Server Config Error - Sysmon Rule
|
2017-05-08 13:39:50 +02:00 |
|
|
Florian Roth
|
c7cc2a00d3
|
WScript/CScript Dropper
|
2017-05-05 17:30:46 +02:00 |
|
|
Florian Roth
|
a5c3f424c1
|
regsvr32 Anomalies
|
2017-04-16 12:02:29 +02:00 |
|
|
Florian Roth
|
769156a83b
|
Minor fix > list to single value
|
2017-04-16 12:01:03 +02:00 |
|
|
Florian Roth
|
8363b25888
|
Suspicious Control Panel DLL Load
|
2017-04-15 23:32:26 +02:00 |
|
|
Florian Roth
|
89e43c1059
|
Improved MSHTA rule
|
2017-04-13 09:25:34 +02:00 |
|
|
Florian Roth
|
059cfbf15a
|
Removed duplicate
|
2017-04-13 01:21:46 +02:00 |
|
|
Florian Roth
|
c2ed7bd9df
|
MSHTA Rule v1
|
2017-04-13 01:08:37 +02:00 |
|
|
Florian Roth
|
92b4a7ad93
|
Added reference
|
2017-04-07 15:42:08 +02:00 |
|
|
Florian Roth
|
0650aa3cbe
|
Rule: Suspicious cmd.exe combo with http and AppData
|
2017-04-03 10:41:10 +02:00 |
|
|
Florian Roth
|
fa90fb2fed
|
Improved WMIC process call create rule
|
2017-03-29 22:11:05 +02:00 |
|
|
Florian Roth
|
e6a81623a8
|
PowerShell Combo - False Positive with MOM
|
2017-03-29 22:10:28 +02:00 |
|
|
Florian Roth
|
f91f813b3f
|
Improved certutil.exe rules
|
2017-03-27 22:30:26 +02:00 |
|
|
Florian Roth
|
b0c8ffb051
|
Combined vssadmin rule
|
2017-03-26 01:27:26 +01:00 |
|
|
Florian Roth
|
800262a738
|
Renamed and double removed
|
2017-03-26 01:27:08 +01:00 |
|
|
Michael Haag
|
5ea6fad999
|
net.exe and wmic.exe
Suspicious execution of net and wmic
|
2017-03-25 06:48:23 -07:00 |
|
|
Florian Roth
|
10ee36f26c
|
Updated Eventvwr UAC evasion
|
2017-03-22 14:40:55 +01:00 |
|
|
Florian Roth
|
3bfa9ed121
|
Bugfix: Minor fix cause Sysmon uses SID as Software key
|
2017-03-21 10:44:53 +01:00 |
|
|
Florian Roth
|
b1da8c5b32
|
Bugfix: Fixed UAC bypass rules
|
2017-03-21 10:42:22 +01:00 |
|
|
Florian Roth
|
f9be5b99ad
|
Rule: Suspicious task creation description changed
|
2017-03-21 10:23:53 +01:00 |
|
|
Florian Roth
|
6f38a44ec1
|
Broader definition certutil.exe rule
|
2017-03-20 22:07:04 +01:00 |
|
|
Florian Roth
|
2817ea2605
|
Bugfix in UAC Rule
|
2017-03-19 19:46:19 +01:00 |
|
|
Florian Roth
|
b2c15c2cf7
|
Rule: UAC bypass via eventvwr, minor changes
|
2017-03-19 19:34:06 +01:00 |
|
|
Florian Roth
|
c82da0dc5c
|
Rules: Suspicious locations and back connect ports
|
2017-03-19 15:22:27 +01:00 |
|
|
Thomas Patzke
|
56f415e42c
|
Fixed rule
|
2017-03-17 22:09:53 +01:00 |
|
|
Omer Yampel
|
d3bd73aefb
|
Create sysmon_sdclt_uac_bypass.yml
UAC Bypass from https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/. Sorry in advance for not being 100% about the sysmon event ids / fields
|
2017-03-17 14:31:26 -04:00 |
|
|
Florian Roth
|
3a7652fff9
|
Added references to rule
|
2017-03-17 00:25:54 +01:00 |
|
|
Florian Roth
|
c6843d41bc
|
Rule: Vssadmin / NTDS.dit activity
|
2017-03-17 00:23:55 +01:00 |
|
|
Florian Roth
|
d00bbd9fb5
|
Rule: Windows recon activity
|
2017-03-16 18:59:17 +01:00 |
|
|
Florian Roth
|
140141b7a2
|
Rule: Suspicious PowerShell parent image combination
|
2017-03-16 18:58:59 +01:00 |
|
|
Florian Roth
|
091bb8fab7
|
Renamed and removed double space
|
2017-03-16 18:58:32 +01:00 |
|
|
Florian Roth
|
cb683a6b56
|
Rule: Suspicious executions in web folders / non-exe folders
|
2017-03-13 23:56:06 +01:00 |
|