09e754a8f9
Small Typo fix
2017-08-22 10:56:25 +02:00
edf2787402
Removed some spaces and added Win 10 WMI eventlog
2017-08-22 10:04:56 +02:00
59821d1bcb
Office Shell: Reference added to new entry
2017-08-22 10:04:22 +02:00
332f7d27da
Win WMI Persistence
...
http://blog.trendmicro.com/trendlabs-security-intelligence/cryptocurrency-miner-uses-wmi-eternalblue-spread-filelessly/
https://twitter.com/mattifestation/status/899646620148539397
2017-08-22 10:02:54 +02:00
8f4a780c3b
Added regsvr32.exe to suspicious child processes
2017-08-20 23:14:41 +02:00
e06cf6c43f
Service install - net user persistence
2017-08-16 15:16:57 +02:00
b109a1277e
Detects suspicious process related to rasdial.exe
2017-08-13 16:20:25 -04:00
012ed4cd7d
Detects execution of executables that can be used to bypass Applocker whitelisting
2017-08-13 16:20:01 -04:00
f861969e95
tentative rule to detect admin users remote login
2017-08-13 16:19:24 -04:00
d2ae98b0de
tentative rule to detect admin users interactive login
2017-08-13 16:18:58 -04:00
21b1c52d1e
forfiles, bash detection
2017-08-13 16:18:13 -04:00
238f27fa0d
Added OperationalError to relevant Python DB exceptions
2017-08-13 00:10:00 +02:00
33b2ff16cf
Rule for generic Python SQL exceptuons
...
according to PEP 249
2017-08-12 00:44:18 +02:00
7ba62b791c
Application security rules
...
* reorganization into separate folder
* adding category
* minor tweaks
2017-08-12 00:43:10 +02:00
ac5e6a3e83
Moved tests into Makefile
2017-08-07 14:05:55 +02:00
487ab99507
Changed sigmac error behavior on I/O errors
2017-08-07 08:54:18 +02:00
7307812152
Changed Travis status image URL to main repository
2017-08-07 08:38:07 +02:00
1d3b8e58bd
Fixed description
2017-08-06 23:22:31 +02:00
0795d14b41
Spring framework security exceptions rule
2017-08-06 23:21:53 +02:00
f0e6c28e8b
Added Ruby on Rails security-related exceptions rule
2017-08-06 22:57:52 +02:00
98f99cebc0
Added author attribute
2017-08-05 23:56:13 +02:00
d84f9dcc1c
Aggregation 'near' raises NotImplementedError in backends splunk and logpoint
2017-08-05 23:48:28 +02:00
685f32fdef
Added sigmac target list to Travis tests
2017-08-05 23:43:15 +02:00
9ba3c36f0e
Added tests for all backends in Travis CI config
2017-08-05 23:39:32 +02:00
f58c1b768b
Django security errors
2017-08-05 00:56:05 +02:00
4578756cfd
Merge remote-tracking branch 'origin/master'
2017-08-05 00:35:24 +02:00
03985288f6
Removed 'last' from timeframe
2017-08-05 00:32:24 +02:00
f5b07dc9af
Added semantic parsing of near expressions
2017-08-05 00:28:22 +02:00
edb52e098a
Extended hh.exe in Office Shell detection
...
https://www.hybrid-analysis.com/sample/6abc2b63f1865a847ff7f5a9d49bb944397b36f5503b9718d6f91f93d60f7cd7?environmentId=100
2017-08-04 09:18:55 +02:00
a5a2f21378
Merge branch 'travis-test' into travis-test-working
2017-08-03 00:15:17 +02:00
d17604d007
Merge branch 'master' into travis-test
2017-08-03 00:11:08 +02:00
36212fd5c2
Merge branch 'devel-sigmac'
2017-08-03 00:10:37 +02:00
5706361464
Parsing of "near ... within" aggregation operator
...
* Operator is only parsed. No processing or passing of parsed data to
backends.
* Changed rule sysmon_mimikatz_inmemory_detection.yml accordingly.
2017-08-03 00:05:48 +02:00
7706067540
Merge branch 'master' into travis-test
2017-08-02 23:32:40 +02:00
27e5d0c2b4
Fixed further parse error
2017-08-02 23:32:00 +02:00
0217cd5b1d
Merge branch 'master' into travis-test-working
2017-08-02 23:03:03 +02:00
167b1f0191
Merge branch 'master' into travis-test
2017-08-02 22:53:52 +02:00
f768bf3d61
Fixed parse errors
2017-08-02 22:49:15 +02:00
004d3933dc
Changed Travis CI config to use sigmac with different error behavior
2017-08-02 00:59:50 +02:00
52525236a5
sigmac: added parameter to control error behavior
...
* --defer-abort
* --ignore-not-implemented
2017-08-02 00:56:22 +02:00
bfcc119a7f
Merge branch 'master' into travis-test
2017-08-02 00:37:07 +02:00
6f5b9e183c
Merge branch 'master' into travis-test-working
2017-08-02 00:32:52 +02:00
3148660fa3
Removed build status image description
2017-08-02 00:28:09 +02:00
b82a6fdc51
Added wildcards to windows/builtin/win_susp_rundll32_activity.yml
2017-08-02 00:09:34 +02:00
84418d2045
Merged builtin/win_susp_certutil_activity.yml with Sysmon rule
2017-08-02 00:04:28 +02:00
c350a90b21
Merge branch 'master' into rules-juju4
2017-08-01 23:55:53 +02:00
3495bac9cb
sigmac: return error codes
2017-07-31 00:31:49 +02:00
ced98e269a
Changed URL for CI status in README
2017-07-31 00:24:34 +02:00
97ec999878
Temporary removed sigmac run from Travis configuration
...
* sigmac actually doesn't supports all features used in Sigma rules.
* It returns the wrong exit code on parse errors. Parse failures cause
passed builds.
2017-07-31 00:15:53 +02:00
86644cdc30
formatting
2017-07-30 11:48:34 -04:00
Hans-Martin Münch