d82df83ef1
Merge pull request #369 from TareqAlKhatib/refactors
...
Refactors
2019-06-19 23:16:19 +02:00
07e2ee474c
sigma/Add sysmon_renamed_binary
2019-06-15 20:20:52 +10:00
1d26708887
sigma/Add sysmon_renamed_binary
2019-06-15 20:19:35 +10:00
d7443d71a4
Create win_pass_the_hash_2.yml
...
alternative detection methods
2019-06-14 18:08:36 +03:00
f70549ec54
First Pass
2019-06-13 23:15:38 -05:00
2d22a3fe02
Add detection for recent Mimikatz versions
...
GrantedAccess is 0x1010 not 0x1410 in recent versions of mimikatz.
This modification should address both
2019-06-12 12:13:31 +03:00
a23f15d42b
Converted rule to generic log source
2019-06-11 13:20:15 +02:00
5715413da9
Usage of Channel field name in ELK Windows config
2019-06-11 13:15:43 +02:00
3bcfc53905
Corrected Typo
2019-06-10 09:54:37 +03:00
fce2a45dac
Corrected Typo
2019-06-10 09:51:34 +03:00
eae7e3ab10
Web Source Code Enumeration via .git
2019-06-08 22:40:28 -04:00
407d8214f7
Added APT40 Dropbox exfiltration proxy rule
2019-06-07 14:03:41 +02:00
5827165c2d
event id deleted
2019-06-03 15:51:54 +02:00
cf947e3720
changed to process_creation category
2019-06-03 15:47:24 +02:00
6a39b4fb41
date added
2019-06-03 15:42:02 +02:00
10db09c596
rule added: Windows Kernel and 3rd-party drivers exploits. Token stealing
2019-06-03 15:37:41 +02:00
a0c9f1594e
Rule: renamed file - name was too generic
2019-06-02 10:57:44 +02:00
491c519d1f
Rule: added wmic SHADOWCOPY DELETE
2019-06-02 10:56:13 +02:00
80560dc12f
Rule: Scanner PoC for CVE-2019-0708 RDP RCE vuln
2019-06-02 09:52:18 +02:00
5e7ae0590c
Rule: Split up WanaCry rule into two separate rules
2019-06-02 09:52:18 +02:00
2163208e9c
update correct process name
...
incorrect process name. accidentally had fsutil, should be bcdedit.
thanks to https://twitter.com/INIT_3 for pointing this out
2019-06-01 09:50:50 -04:00
4e96666c04
Merge pull request #336 from petermat/added_rule_T1156
...
added rule .bash_profile and .bashrc T1156
2019-05-30 22:43:33 +02:00
60bc5253cf
win_disable_event_logging.yml: typo in audit policy name;
2019-05-29 15:43:44 +03:00
7c1e856095
Merge pull request #353 from lprat/master
...
Add rule for CVE-2019-0708
2019-05-27 09:11:17 +02:00
323a7313fd
FP adjustments
...
We have checked the False Positive rate in different environments and noticed these event IDs in cases in which systems had bad network connections / we accessed via VPN. Therefore we reduced the level to "high" and added that note to the "False Positives" list.
2019-05-27 08:54:18 +02:00
241d814221
Merged WannaCry rules
2019-05-24 22:17:36 +02:00
f65f693a88
Add rule for CVE-2019-0708
2019-05-24 10:01:19 +02:00
7b63c92fc0
Rule: applying recommendation
...
https://twitter.com/SwiftOnSecurity/status/1131464234901094400
2019-05-23 09:44:25 +02:00
b60cfbe244
Added password flag
2019-05-22 13:20:26 +02:00
346022cfe8
Transformed to process creation rule
2019-05-22 12:50:49 +02:00
4a775650a2
Rule Windows 10 scheduled task SandboxEscaper 0-day
2019-05-22 12:36:03 +02:00
e675cdf9c4
Rule Windows 10 scheduled task SandboxEscaper 0-day
2019-05-22 12:32:07 +02:00
544dfe3704
Rule Windows 10 scheduled task SandboxEscaper 0-day
2019-05-22 12:28:42 +02:00
c937fe3c1b
Rule: Terminal Service Process Spawn
2019-05-22 10:38:27 +02:00
74ca0eeb88
Rule: Renamed PsExec
2019-05-21 09:49:40 +02:00
2d0c08cc8b
Added wildcards to rule values
...
These values appear somewhere in a log message, therefore wildcards are
required.
2019-05-21 01:03:20 +02:00
c163dcbe05
Update sysmon_mimikatz_trough_winrm.yml
...
Deleted tab character (\t)
2019-05-20 13:22:36 +02:00
a9faa3dc33
Create sysmon_mimikatz_trough_winrm.yml
...
Detects usage of mimikatz through WinRM protocol
2019-05-20 12:25:58 +02:00
694fa567b6
Reformatted
2019-05-15 20:22:53 +02:00
1c36bfde79
Bugfix - Swisscom in Newline
2019-05-15 15:03:55 +02:00
d5f49c5777
Fixed syntax
2019-05-15 14:50:57 +02:00
508d1cdae0
Removed double back slashes
2019-05-15 14:46:45 +02:00
13522b97a7
Adjusting Newline
2019-05-15 12:15:41 +02:00
275896dbe6
Suspicious Outbound RDP Rule likely identifying CVE-2019-0708
2019-05-15 11:47:12 +02:00
b6c4e64a9b
fixed attack category number 2->3
2019-05-12 11:59:13 +02:00
2778558ae3
added rule .bash_profile and .bashrc T1156
2019-05-12 02:07:13 +02:00
1ca57719b0
fix: fixed reference list, otherwise it's not valid string list
2019-05-10 10:37:12 +02:00
6585c83077
fix: fixed reference list, otherwise it's not valid string list
2019-05-10 10:13:35 +02:00
25c0330dca
Added filter
2019-05-10 00:20:56 +02:00
995c03eef9
Merge branch 'patch-1' of https://github.com/Karneades/sigma into Karneades-patch-1
2019-05-10 00:15:51 +02:00
Thomas Patzke