security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,410 Commits 1 Branch 57 Tags
a0bad54dbda170d5369f54ccede5f11f999da4de
Commit Graph

2410 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Thomas Patzke ca53e937d9 Removed sigma.output from setup packages 2019-11-12 23:11:39 +01:00
Thomas Patzke 5f6a4225ec Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00
Thomas Patzke d16175fe35 Added id diff filter script 2019-11-12 23:05:27 +01:00
Thomas Patzke 3828f4a95c Merge branch 'uuid' into assign-ids 2019-11-12 22:46:54 +01:00
Thomas Patzke d42cc78509 Converted rules Sysmon/1 parts to generic process_creation 2019-11-12 21:06:24 +01:00
Thomas Patzke 0065e2420f Merge branch 'oscd-qa' 2019-11-12 20:54:11 +01:00
Anastasios Zouzias e7ed0fa9ea added unit test 2019-11-12 14:06:10 +01:00
Florian Roth b7c3f8da91 refactor: cleanup, single element lists, renamed files, level adjustments 2019-11-12 12:55:05 +01:00
Anastasios Zouzias 324005a126 [feature] extend es-dsl to support nested aggregations 2019-11-12 11:46:43 +01:00
Thomas Patzke ffdf312932 Added Ursnif user agents 2019-11-12 08:52:37 +01:00
Thomas Patzke 6d62d426c9 Added sigma-uuid tool 
* Moved SigmaYAMLDumper to new sigma.output module
 2019-11-11 23:35:16 +01:00
Florian Roth b6f94b1352 Merge pull request #522 from Neo23x0/devel 
fix: wrong mapping on thor.cfg
 2019-11-11 09:21:09 +01:00
Florian Roth e2628d6df6 fix: wrong mapping on thor.cfg 2019-11-11 09:20:20 +01:00
Thomas Patzke feb836cbf2 Sigmatools release 0.14 0.14 2019-11-10 00:09:59 +01:00
Florian Roth 8cc16d252a fix: more FP reductions 2019-11-09 23:36:29 +01:00
Florian Roth 038f205f0f fix: FPs with UserInitMprLogonScript rule 2019-11-09 23:32:53 +01:00
Florian Roth fbe138ed90 rule: reduced level of rule to medium due to FPs 2019-11-09 23:24:31 +01:00
Florian Roth faeccf0c3d Merge branch 'master' into devel 2019-11-09 22:42:16 +01:00
Florian Roth a0beda240c fix: fixed wrong field mapping in windows-audit source config 2019-11-09 22:42:00 +01:00
Florian Roth ef0af10747 Merge pull request #521 from Neo23x0/devel 
fix: fixed false positive in suspicious shell spawn rule
 2019-11-09 12:50:50 +01:00
Florian Roth 9835950f04 rule: SID to AD object rule level adjusted 2019-11-09 12:49:54 +01:00
Florian Roth be62fad5cc fix: fixed false positive in suspicious shell spawn rule 2019-11-09 10:45:46 +01:00
Thomas Patzke 2222550b6e Allow ignore of type errors with sigmac -I 2019-11-08 23:56:39 +01:00
Thomas Patzke 8f1974d7d3 Added regular expression support in es-dsl backend 2019-11-08 23:56:39 +01:00
Thomas Patzke 2078a1d4f2 Added changelog 2019-11-08 23:56:39 +01:00
Thomas Patzke 8ae824f09f Improved rules 
Reduced false positives
 2019-11-08 23:56:14 +01:00
Thomas Patzke 465e41bfbb Added regular expression support in es-dsl backend 2019-11-08 22:31:02 +01:00
Thomas Patzke 238adf9eea Improved rule test 
* Added ATT&CK technique
* Removed invalid tags
 2019-11-08 22:03:19 +01:00
Thomas Patzke 6e2fe09d24 Removed invalid tags 2019-11-08 22:02:12 +01:00
Thomas Patzke 5d995ad704 sigma-similarity: primary rule set for restriction of comparison 2019-11-08 21:15:13 +01:00
yugoslavskiy b176339da8 Merge pull request #479 from alexpetrov12/master 
add rule
 2019-11-08 02:16:22 +03:00
yugoslavskiy 00fc6c62b4 Delete renamed_binary_description.yml 
agreed on improvements. will be added later
 2019-11-08 02:16:01 +03:00
yugoslavskiy 98f32e9098 Delete sysmon_mimikatz_сreds_dump.yml 
merged with rules/windows/sysmon/sysmon_cred_dump_lsass_access.yml
 2019-11-08 02:06:31 +03:00
yugoslavskiy 6d61401b12 Delete sysmon_сreds_dump.yml 
merged with rules/windows/sysmon/sysmon_cred_dump_lsass_access.yml
 2019-11-08 02:06:20 +03:00
yugoslavskiy 562e07de38 Delete cobalt_execute_assembly.yml 
merged with existing [sysmon_cobaltstrike_process_injection.yml](https://github.com/Neo23x0/sigma/blob/oscd/rules/windows/sysmon/sysmon_cobaltstrike_process_injection.yml)
 2019-11-08 01:42:42 +03:00
yugoslavskiy 52d099a6e3 improve sysmon_cobaltstrike_process_injection.yml 2019-11-08 01:41:26 +03:00
yugoslavskiy 4443870577 Delete win_odbcconf_execution.yml 
merged with rules/windows/process_creation/win_odbcconf_execution.yml
 2019-11-08 01:36:03 +03:00
yugoslavskiy 3b34ed6150 add modifiers 2019-11-08 01:34:30 +03:00
Thomas Patzke 8b7560c2f4 Added changelog 2019-11-07 23:08:44 +01:00
yugoslavskiy 6083d70975 Update sysmon_registry_persistence_key_linking.yml 2019-11-07 04:23:20 +03:00
yugoslavskiy 82b185db6a Update win_sysmon_driver_unload.yml 2019-11-07 04:11:26 +03:00
yugoslavskiy 404a6d9915 Update win_netsh_packet_capture.yml 2019-11-07 03:37:41 +03:00
yugoslavskiy ddf24819ed Update silenttrinity_stage_use.yml 2019-11-07 03:33:12 +03:00
yugoslavskiy 0d8c64da86 duplicate rule deleted 
this rule already present in Sigma repo — [./rules/windows/process_creation/win_susp_comsvcs_procdump.yml](https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_susp_comsvcs_procdump.yml)
 2019-11-07 03:21:09 +03:00
yugoslavskiy 5513687e63 Merge branch 'master' of https://github.com/Neo23x0/sigma into oscd 2019-11-07 03:03:35 +03:00
webhead404 a704256632 Merge pull request #1 from webhead404/webhead404-patch-1 
Update and add another selection for regsvr32
 2019-11-06 15:51:30 -06:00
webhead404 f7a968e3d2 Update and add another selection for regsvr32 
Added cmd.exe to the detection after observing Atomic Red Team test 

https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1117/T1117.md#atomic-test-2---regsvr32-remote-com-scriptlet-execution
 2019-11-06 15:49:53 -06:00
Thomas Patzke ef14ee542d Added modifiers: startswith and endswith 2019-11-05 23:04:13 +01:00
Thomas Patzke 97d13660f7 Merge pull request #517 from Neo23x0/devel 
Firewall Deactivation Rule
 2019-11-05 22:54:50 +01:00
Thomas Patzke 7a81054cdd Merge pull request #518 from refractionPOINT/master 
LimaCharlie Productionization
 2019-11-05 22:54:01 +01:00