 Florian Roth
|
ff8e3fe584
|
Merge pull request #9 from iliaselmatani/patch-1
Create win_pass_the_hash.yml
|
2017-03-13 16:16:55 +01:00 |
|
|
Florian Roth
|
a66955013c
|
Update win_pass_the_hash.yml
|
2017-03-13 16:16:34 +01:00 |
|
|
Florian Roth
|
a87d513efa
|
Rule: Suspicious executable downloads
|
2017-03-13 16:11:43 +01:00 |
|
|
IeM
|
9f5e5a2366
|
Update win_pass_the_hash.yml
Added placeholders for WorkstationName to detect network logons between Workstations.
|
2017-03-13 16:09:32 +01:00 |
|
|
Florian Roth
|
85c298c43c
|
Bugfix in rule
|
2017-03-13 15:09:48 +01:00 |
|
|
Florian Roth
|
606d74546a
|
Rule: PowerShell with network connections
|
2017-03-13 13:57:41 +01:00 |
|
|
Florian Roth
|
b8db4935e0
|
Rule: PowerShell UserAgent in Proxy Logs
|
2017-03-13 13:51:32 +01:00 |
|
|
Florian Roth
|
a0047f7c67
|
Sysmon as 'service' of product 'windows'
|
2017-03-13 09:23:08 +01:00 |
|
|
Florian Roth
|
9fd375c130
|
Bugfix: Added time frame to correlation rule
|
2017-03-12 17:11:29 +01:00 |
|
|
Florian Roth
|
4470c2f893
|
PowerShell Suspicious Invocation > Sysmon
|
2017-03-12 17:11:05 +01:00 |
|
|
Florian Roth
|
de689c32b5
|
Suspicious PowerShell Invocation
|
2017-03-12 17:06:53 +01:00 |
|
|
Florian Roth
|
d6957f1c2e
|
Merge pull request #10 from MHaggis/master
Sysmon
|
2017-03-09 08:05:22 +01:00 |
|
|
Michael Haag
|
c5f05dd829
|
bitsadmin & VSSAdmin
+Bitsadmin download
+VSSAdmin delete
|
2017-03-08 22:49:35 -08:00 |
|
|
IeM
|
4d5ded46e6
|
Update win_pass_the_hash.yml
|
2017-03-08 20:35:26 +01:00 |
|
|
Florian Roth
|
3507a5e644
|
Rule: Rare Windows Service Installs
|
2017-03-08 19:09:34 +01:00 |
|
|
IeM
|
381b85fd94
|
Update win_pass_the_hash.yml
Edited, added additional indicators.
Reference: https://www.binarydefense.com/bds/reliably-detecting-pass-the-hash-through-event-log-analysis/
|
2017-03-08 18:48:06 +01:00 |
|
|
IeM
|
e4d764ceba
|
Create win_pass_the_hash.yml
Rule to detects the attack technique pass the hash which is used to move laterally inside the network
|
2017-03-08 18:04:31 +01:00 |
|
|
Florian Roth
|
5484886932
|
Rule: Windows - Recon Activity (improved)
|
2017-03-07 13:06:38 +01:00 |
|
|
Florian Roth
|
fa6f76f276
|
Rule: Windows - Recon Activity
|
2017-03-07 12:01:39 +01:00 |
|
|
Florian Roth
|
b34d1b7565
|
Stonedrill rule enhancement
|
2017-03-07 10:22:14 +01:00 |
|
|
Florian Roth
|
7113b3aed9
|
Rule: APT StoneDrill Service Install
|
2017-03-07 09:24:12 +01:00 |
|
|
Florian Roth
|
aad892c834
|
Windows Built-In rules > LogSource definition
|
2017-03-05 23:55:52 +01:00 |
|
|
Florian Roth
|
16c5192ee9
|
Windows Malicious Password Dumper Service Installs
|
2017-03-05 23:52:02 +01:00 |
|
|
Florian Roth
|
7b815ef3e5
|
Sysmon PowerShell - Suspicious Param Combination
|
2017-03-05 23:51:39 +01:00 |
|
|
Florian Roth
|
294df21c56
|
Added expression
|
2017-03-05 22:45:54 +01:00 |
|
|
Florian Roth
|
7fae49b183
|
More PowerShell rules
|
2017-03-05 15:01:51 +01:00 |
|
|
Florian Roth
|
1e1cf9cb9e
|
PowerShell Rules Revision
|
2017-03-05 14:14:31 +01:00 |
|
|
Omer Yampel
|
97b4078d01
|
Update powershell_malicious_commandlets.yml
Added https://github.com/putterpanda/mimikittenz reference
|
2017-03-04 20:26:39 -05:00 |
|
|
Florian Roth
|
12535417d9
|
Typo
|
2017-03-05 01:47:37 +01:00 |
|
|
Florian Roth
|
d397ee9f68
|
First PowerShell Ruleset
|
2017-03-05 01:47:25 +01:00 |
|
|
Michael Haag
|
a3cd7123a8
|
wscript/cscript
WSF, JSE, JS, VBA and VBE file execution
|
2017-03-04 14:40:34 -08:00 |
|
|
Michael Haag
|
4ac5d86479
|
mshta shells
🐚 for all!
|
2017-03-04 14:33:09 -08:00 |
|
|
Michael Haag
|
1317fe9df2
|
Modifications
+ Added Sysmon detection of Office binaries spawning Windows shells
+ Additional web servers added for webshell detection
|
2017-03-04 14:22:44 -08:00 |
|
|
Florian Roth
|
a9d6295791
|
Rule: Sysmon Malware Shellcode in Verclsid Process
|
2017-03-04 10:38:23 +01:00 |
|
|
Florian Roth
|
15e61a9681
|
Rule: Certutil Decode in AppData
|
2017-03-02 11:28:34 +01:00 |
|
|
Florian Roth
|
b6459a00ab
|
Two new Sysmon rules for Office Macro/PS detection
|
2017-03-02 11:06:53 +01:00 |
|
|
Florian Roth
|
8559837aab
|
Removed Sysmon EventLog from selection > via 'logsource'
|
2017-03-02 11:06:20 +01:00 |
|
|
Florian Roth
|
b4f2a74371
|
Proposed changes to mimimkatz-inmemory aggregation
|
2017-03-01 10:16:43 +01:00 |
|
|
Florian Roth
|
9934a66a3c
|
Rule: ClamAV
|
2017-03-01 10:00:17 +01:00 |
|
|
Florian Roth
|
2e0632b05f
|
Rule: Linux: buffer overflows
|
2017-03-01 08:38:33 +01:00 |
|
|
Florian Roth
|
001bed0c45
|
ModSecurity rule: multiple blocks
|
2017-02-28 17:53:32 +01:00 |
|
|
Florian Roth
|
9c8ed4c0b1
|
Apache segmentation fault rule
|
2017-02-28 17:53:06 +01:00 |
|
|
Florian Roth
|
b1446f9b87
|
Removed 'last' keyword from 'timeframe' fields
|
2017-02-28 17:52:40 +01:00 |
|
|
Thomas Patzke
|
15c6f9411b
|
Rule review
* Typos
* Added false positive descriptions
|
2017-02-24 23:44:42 +01:00 |
|
|
Thomas Patzke
|
fdbadb8e6e
|
Rule fix
Fixed condition in webshell keyowrd rule.
|
2017-02-22 22:42:35 +01:00 |
|
|
Thomas Patzke
|
a4611d6dc6
|
Added new rules
From adsecurity.org:
* https://adsecurity.org/?p=1772
* https://adsecurity.org/?p=1714
|
2017-02-19 22:43:27 +01:00 |
|
|
Florian Roth
|
52d04e52ac
|
Removed lists from log source section
|
2017-02-19 11:08:40 +01:00 |
|
|
Florian Roth
|
166f207dc0
|
Sysmon rules 'logsource' change
|
2017-02-19 09:19:06 +01:00 |
|
|
Florian Roth
|
cd6e24c5ff
|
Added "logsource" sections and new rule
|
2017-02-19 00:31:59 +01:00 |
|
|
Thomas Patzke
|
9a38d6543f
|
Fixed type of condition
|
2017-02-16 23:49:34 +01:00 |
|