ca5b11c622
Merge pull request #456 from EccoTheFlintstone/pth
...
fix PtH rule : field name in event 4624 is SubjectUserSid with null S…
2019-09-25 17:26:22 +02:00
4c54e8322a
sysmon eventid 3: filter on outgoing connections (initiated: true) to avoid false positives
2019-09-25 11:11:22 -04:00
7b8b1db241
rule: proxy ua unknown zero day implant
2019-09-24 18:24:48 +02:00
a644b938a0
fix PtH rule : field name in event 4624 is SubjectUserSid with null SID value (S-1-0-0)
2019-09-23 05:44:26 -04:00
6a7f7e0f76
add microsoft reference for events fields names
2019-09-23 05:21:30 -04:00
d48b63a235
ruler rule field name fix for eventID 4776
2019-09-23 05:17:35 -04:00
c2868f6e03
remove TAB from cli escape as it's currently unsupported in sigmac
2019-09-23 04:46:10 -04:00
0c96777f6a
sysmon rules cleanup and move to process_creation
2019-09-11 10:24:43 -04:00
038900e2fe
fix: renamed powershell rule
2019-09-06 17:33:56 +02:00
ccdda5e82b
Update lnx_shell_priv_esc_prep.yml
2019-09-06 11:29:42 -04:00
23021aa110
Added Sticky Bits
...
Attackers may look to exploit binaries with the sticky bits enabled. By being able to run a binary as a different user or group, they may be able to run separate commands as an elevated user.
2019-09-06 11:25:48 -04:00
b410710338
move wevtutil / fsutil events from ransomware to dedicated rules
2019-09-06 10:57:03 -04:00
5ae46ac56d
rule: user added to local administrator: handle non english systems by using group sid instead of name
2019-09-06 06:21:42 -04:00
fe93d84015
fix FP : field null value can be '-'
2019-09-06 05:14:58 -04:00
7f1b6eb311
fix: duplicate rule
2019-09-06 10:30:47 +02:00
fcbae16cc8
rule: image debugger
2019-09-06 10:28:20 +02:00
01956f1312
powershell false positives
2019-09-06 03:54:19 -04:00
afe6668fbd
Merge pull request #438 from duzvik/master
...
Escaped '\*' to '\*' where required
2019-09-05 10:57:25 +02:00
f9f5558ae1
Merge pull request #392 from TareqAlKhatib/shim
...
Fixed commandline to detect any shim install from any location
2019-09-05 10:28:50 +02:00
bdf8f99fdb
fix typo
2019-09-04 11:31:00 -04:00
7bef822da7
rule: minor improvement to susp ps enc cmd
2019-09-04 16:31:49 +02:00
774be4d008
Escaped '\*' to '\*' where required
2019-09-04 14:05:58 +03:00
fc89804f34
rule: impacket framework lateralization detection
2019-09-03 10:28:59 -04:00
03d45d57de
rule: emissary panda activity
2019-09-03 15:35:33 +02:00
8cad0c638e
add comcvcs.dll memdump method
2019-09-02 07:49:19 -04:00
dca5a7a248
Merge pull request #432 from EccoTheFlintstone/master
...
add/modify powershell Empire rules
2019-09-02 11:40:36 +02:00
5f30e52739
add/modify powershell Empire rules
2019-09-02 05:04:44 -04:00
ace0cc36c6
rule: improved csc rule
2019-08-31 08:44:09 +02:00
7cc26e30b4
docs: renamed file name
2019-08-30 12:04:20 +02:00
f8785e722f
docs: changed title and description of rule
2019-08-30 12:03:42 +02:00
ba46d6b4de
docs: added reference to rule
2019-08-30 11:55:02 +02:00
398ef9c6aa
rules: teardown implant, apt28 ua
2019-08-30 11:53:55 +02:00
ca2019b57f
fix: typo in MITRE tag
2019-08-27 12:32:56 +02:00
6b7cd94197
Changes
2019-08-27 12:23:42 +02:00
d42a51372d
Control Panel Item, MITRE_ID=T1196
2019-08-27 14:55:55 +06:30
70a26a6132
fix: fixed MITRE tags
2019-08-24 13:58:54 +02:00
c321fc2680
rule: csc.exe suspicious source folder
2019-08-24 13:53:15 +02:00
b32ed3c817
rules: encoded FromBase64String keyword
2019-08-24 13:53:05 +02:00
87ce52f6fe
fix: fixed wrong MITRE tag
2019-08-23 23:19:39 +02:00
5bd242cb21
rule: encoded IEX
2019-08-23 23:13:36 +02:00
68fb56f503
Merge pull request #345 from ki11oFF/patch-1
...
Detection of usage mimikatz trough WinRM
2019-08-23 23:04:07 +02:00
945f45ebd7
Merge pull request #399 from yugoslavskiy/win_rdp_potential_cve-2019-0708_improvement
...
rules/windows/builtin/win_rdp_potential_cve-2019-0708.yml improved
2019-08-23 23:01:25 +02:00
fc08e3c5b7
Merge pull request #398 from yugoslavskiy/win_susp_add_sid_history_improvement
...
Win susp add sid history improvement
2019-08-23 22:58:46 +02:00
cc01f76e99
docs: minor changes
2019-08-22 14:22:55 +02:00
c291038ebe
rule: renamed powershell
2019-08-22 14:22:55 +02:00
d0a24f4409
filter NULL values to remove false positives
2019-08-20 05:10:41 -04:00
18bbec4bcd
improve(rule): add Empire links and userland match
...
Add default task name and powershell task command to match what the rule name says: detects default config.
2019-08-09 11:58:43 +02:00
4fcb52d098
fix: removed mmc susp rule due to many FPs
2019-08-07 14:26:15 +02:00
f6fd1df6f4
Rule: separate Ryuk rule created for VBurovs strings
2019-08-06 10:33:46 +02:00
a8b738e346
Merge pull request #380 from vburov/patch-5
...
Ryuk Ransomware commands from real case
2019-08-06 10:29:00 +02:00
Florian Roth