1464ab4ab8
Renamed rule: recon activity > net recon activity - to be more specific
2017-12-11 09:31:54 +01:00
285f5bab4f
Removed duplicate string
2017-12-11 09:31:54 +01:00
78854b79c4
Rule: System File Execution Location Anomaly
2017-11-27 14:09:22 +01:00
93fbc63691
Rule to detect droppers exploiting CVE-2017-11882
2017-11-23 00:58:31 +01:00
2ec5919b9e
Fixed win_disable_event_logging by multiline description
2017-11-19 22:49:40 +01:00
a796ff329e
Create win_disable_event_logging
2017-11-15 21:56:30 -05:00
3a378f08ea
Bugfix in Adwind rule - typo in typo
2017-11-10 12:51:54 +01:00
6e4e857456
Improved Adwind Sigma rule
2017-11-10 12:39:08 +01:00
57d56dddb7
Improved Adwind RAT rule
2017-11-09 18:53:46 +01:00
b558f5914e
Added reference to Tom Ueltschie's slides
2017-11-09 18:30:50 +01:00
781db7404e
Updated Adwind RAT rule
2017-11-09 18:28:27 +01:00
970f01f9f2
Renamed file for consistency
2017-11-09 15:43:32 +01:00
a042105aa1
Rule: Adwind RAT / JRAT javaw.exe process starts in AppData folder
2017-11-09 15:43:32 +01:00
a0ac61229c
Rule: Detect plugged USB devices
2017-11-09 08:40:46 +01:00
59e5b3b999
Sysmon: Named Pipe detection for APT malware
2017-11-06 14:24:42 +01:00
37cea85072
Rundll32.exe suspicious network connections
2017-11-04 14:44:30 +01:00
5035c9c490
Converted Windows 4688-only rules into 4688 and Sysmon/1 collections
2017-11-01 22:12:14 +01:00
f3a809eb00
Improved admin logon rules and removed duplicates
2017-11-01 21:33:01 +01:00
0055eedb83
Merge pull request #54 from juju4/CAR-2016-04-005b
...
Admin user remote login
2017-11-01 21:22:09 +01:00
613f922976
Merge pull request #43 from juju4/master
...
New rules
2017-11-01 21:21:30 +01:00
118e8af738
Simplified rule collection
2017-11-01 10:00:35 +01:00
732f01878f
Sigma rule collection YAML action documents
2017-11-01 00:17:55 +01:00
d0b2bd9875
Multiple rules per file
...
* New wrapper class SigmaCollectionParser parses all YAML documents
contained in file and handles multiple SigmaParser instantiation.
* Exemplary extended one security/4688 rule to security/4688 + sysmon/1
2017-10-31 23:06:18 +01:00
9d96a998d7
Merge pull request #56 from juju4/CAR-2013-05-002b
...
Detects Suspicious Run Locations - MITRE CAR-2013-05-002
2017-10-30 00:27:56 +01:00
720c992573
Dropped within keyword
...
Covered by timeframe attribute.
Fixes issue #26 .
2017-10-30 00:25:56 +01:00
c865b0e9a8
Removed within keyword in rule
2017-10-30 00:15:01 +01:00
0df60fe004
Merge branch 'CAR-2013-04-002b' of https://github.com/juju4/sigma into juju4-CAR-2013-04-002b
2017-10-30 00:13:21 +01:00
27227855b5
Merge branch 'devel-sigmac'
2017-10-29 23:59:49 +01:00
012cb6227f
Added proper handling of null/not null values
...
Fixes issue #25
2017-10-29 23:57:39 +01:00
4b64fc1704
double quotes = escape
2017-10-29 14:42:40 -04:00
07185247cb
double quotes = escape
2017-10-29 14:32:52 -04:00
f5f20c3f75
Admin user remote login
2017-10-29 14:30:11 -04:00
19dd69140b
Detects Suspicious Run Locations - MITRE CAR-2013-05-002
2017-10-29 14:27:01 -04:00
ad27a0a117
Detects Quick execution of a series of suspicious commands - MITRE CAR-2013-04-002
2017-10-29 14:24:53 -04:00
9d968de337
Merge remote-tracking branch 'upstream/master'
2017-10-29 14:14:47 -04:00
b7e8000ccb
Improved Office Shell rule > added 'schtasks.exe'
2017-10-25 23:53:45 +02:00
d9f933fec9
Fixed the fixed PSAttack rule
2017-10-19 09:52:40 +02:00
0b0435bf7a
Fixed PSAttack rule
2017-10-18 21:49:38 +02:00
d7c659128c
Removed unneeded array
2017-10-18 15:12:29 +02:00
deea224421
Rule: New RUN Key Pointing to Suspicious Folder
2017-10-17 16:19:56 +02:00
e6661059c2
Merge remote-tracking branch 'upstream/master'
2017-10-15 11:58:01 -04:00
00baa4ed40
Executables Started in Suspicious Folder
2017-10-14 23:23:04 +02:00
358d1ffba0
Executables Started in Suspicious Folder
2017-10-14 23:22:20 +02:00
cbde0ee5e5
Merge remote-tracking branch 'upstream/master'
2017-09-16 10:03:18 -04:00
20f9dbb31c
CVE-2017-8759 - Winword.exe > csc.exe
2017-09-15 15:49:56 +02:00
986c9ff9b7
Added field names to first rules
2017-09-12 23:54:04 +02:00
68cb5e8921
Merge pull request #45 from secman-pl/patch-1
...
Update sysmon_susp_regsvr32_anomalies to detect wscript child process
2017-09-10 22:52:37 +02:00
e2213347ad
Merge remote-tracking branch 'upstream/master'
2017-09-09 11:33:18 -04:00
bfe8378455
Rule: Suspicious svchost.exe process
2017-08-31 11:07:45 +02:00
9768f275d0
Update sysmon_susp_regsvr32_anomalies
...
Rule to detect COM scriptlet invocation when wscript.exe is spawned from regsvr32.exe.
example: https://www.hybrid-analysis.com/sample/f34da6d84a9663928606894fbc494cd9bf2f03c98cf0c775462802558d3a50ef?environmentId=100
SCT script code:
var objShell = new ActiveXObject("WScript.shell");
2017-08-29 12:21:47 +02:00
Florian Roth