 Omer Yampel
|
97b4078d01
|
Update powershell_malicious_commandlets.yml
Added https://github.com/putterpanda/mimikittenz reference
|
2017-03-04 20:26:39 -05:00 |
|
|
Florian Roth
|
12535417d9
|
Typo
|
2017-03-05 01:47:37 +01:00 |
|
|
Florian Roth
|
d397ee9f68
|
First PowerShell Ruleset
|
2017-03-05 01:47:25 +01:00 |
|
|
Florian Roth
|
15373d86f5
|
Set theme jekyll-theme-hacker
|
2017-03-05 01:06:36 +01:00 |
|
|
Thomas Patzke
|
f092333bb4
|
Sigmac configuration parsing
|
2017-03-05 00:56:45 +01:00 |
|
|
Thomas Patzke
|
e2e737091a
|
Merge branch 'devel-sigmac'
|
2017-03-05 00:40:25 +01:00 |
|
|
Michael Haag
|
c12b62e0e4
|
Merge remote-tracking branch 'Neo23x0/master'
|
2017-03-04 15:24:06 -08:00 |
|
|
Florian Roth
|
0cc3139176
|
Merge pull request #6 from MHaggis/master
Modifications and new adds
|
2017-03-05 00:16:26 +01:00 |
|
|
Michael Haag
|
a3cd7123a8
|
wscript/cscript
WSF, JSE, JS, VBA and VBE file execution
|
2017-03-04 14:40:34 -08:00 |
|
|
Thomas Patzke
|
4aaa22fd6d
|
Made not implemented sigmac features obvious
* added notes to help message
* error if not implemented option is used
|
2017-03-04 23:36:46 +01:00 |
|
|
Michael Haag
|
4ac5d86479
|
mshta shells
🐚 for all!
|
2017-03-04 14:33:09 -08:00 |
|
|
Michael Haag
|
1317fe9df2
|
Modifications
+ Added Sysmon detection of Office binaries spawning Windows shells
+ Additional web servers added for webshell detection
|
2017-03-04 14:22:44 -08:00 |
|
|
Florian Roth
|
a9d6295791
|
Rule: Sysmon Malware Shellcode in Verclsid Process
|
2017-03-04 10:38:23 +01:00 |
|
|
Florian Roth
|
47bfe82cc4
|
Splunk specifics
|
2017-03-04 10:37:40 +01:00 |
|
|
Florian Roth
|
9971192bff
|
Create README.md
|
2017-03-03 13:45:55 +01:00 |
|
|
Florian Roth
|
b984d83685
|
Typo in help text
|
2017-03-03 12:47:20 +01:00 |
|
|
Thomas Patzke
|
8f3541f0a0
|
Added Splunk backend
|
2017-03-02 23:34:12 +01:00 |
|
|
Thomas Patzke
|
2dd1c7cd12
|
Deactivated not implemented backends
|
2017-03-02 22:55:45 +01:00 |
|
|
Thomas Patzke
|
9556e73cd1
|
Fix: automatic escaping of * and ? in es-qs backend removed
|
2017-03-02 12:07:07 +01:00 |
|
|
Florian Roth
|
15e61a9681
|
Rule: Certutil Decode in AppData
|
2017-03-02 11:28:34 +01:00 |
|
|
Florian Roth
|
b6459a00ab
|
Two new Sysmon rules for Office Macro/PS detection
|
2017-03-02 11:06:53 +01:00 |
|
|
Florian Roth
|
8559837aab
|
Removed Sysmon EventLog from selection > via 'logsource'
|
2017-03-02 11:06:20 +01:00 |
|
|
Thomas Patzke
|
77b8bd3834
|
Merge branch 'devel-sigmac'
|
2017-03-01 21:55:55 +01:00 |
|
|
Thomas Patzke
|
10ee9c64fe
|
Moved node output into dedicated backend class methods
|
2017-03-01 21:47:51 +01:00 |
|
|
Florian Roth
|
06348d8ee3
|
Delete _config.yml
|
2017-03-01 17:29:02 +01:00 |
|
|
Florian Roth
|
b4f2a74371
|
Proposed changes to mimimkatz-inmemory aggregation
|
2017-03-01 10:16:43 +01:00 |
|
|
Florian Roth
|
9934a66a3c
|
Rule: ClamAV
|
2017-03-01 10:00:17 +01:00 |
|
|
Thomas Patzke
|
7c362fb98e
|
Merge branch 'devel-sigmac'
|
2017-03-01 09:45:35 +01:00 |
|
|
Thomas Patzke
|
0d470af0e7
|
Set sigmac default backend to 'es-qs'
|
2017-03-01 09:40:51 +01:00 |
|
|
Thomas Patzke
|
27909782e7
|
Merge branch 'devel-sigmac'
|
2017-03-01 09:36:46 +01:00 |
|
|
Florian Roth
|
ed78233544
|
Update README.md
|
2017-03-01 08:55:06 +01:00 |
|
|
Florian Roth
|
07206728a5
|
Sigmac Screenshot
|
2017-03-01 08:48:39 +01:00 |
|
|
Thomas Patzke
|
92920abbed
|
Added sigmac Screenshot
|
2017-03-01 08:39:02 +01:00 |
|
|
Florian Roth
|
2e0632b05f
|
Rule: Linux: buffer overflows
|
2017-03-01 08:38:33 +01:00 |
|
|
Thomas Patzke
|
0b0d37fd61
|
Added sigmac Screenshot
|
2017-03-01 00:19:11 +01:00 |
|
|
Thomas Patzke
|
f5616051d7
|
Merge branch 'master' into devel-sigmac
|
2017-03-01 00:09:24 +01:00 |
|
|
Thomas Patzke
|
e0f813ebbb
|
Conversion to Elasticsearch Query Strings
First version of sigmac that converts Sigma YAMLs without aggregations
into ES Query Strings suitable for Kibana or other tools.
|
2017-03-01 00:03:34 +01:00 |
|
|
Florian Roth
|
001bed0c45
|
ModSecurity rule: multiple blocks
|
2017-02-28 17:53:32 +01:00 |
|
|
Florian Roth
|
9c8ed4c0b1
|
Apache segmentation fault rule
|
2017-02-28 17:53:06 +01:00 |
|
|
Florian Roth
|
b1446f9b87
|
Removed 'last' keyword from 'timeframe' fields
|
2017-02-28 17:52:40 +01:00 |
|
|
Florian Roth
|
e9d39c78c6
|
Scheme - Image
|
2017-02-25 11:39:59 +01:00 |
|
|
Thomas Patzke
|
15c6f9411b
|
Rule review
* Typos
* Added false positive descriptions
|
2017-02-24 23:44:42 +01:00 |
|
|
Thomas Patzke
|
58f2118ef4
|
Parsing of search expressions
* Tokenization
* Building a parse tree
* Aggregations not yet implemented
|
2017-02-24 23:36:19 +01:00 |
|
|
Thomas Patzke
|
0e5eb513a2
|
Merge branch 'master' into devel-sigmac
|
2017-02-22 22:47:12 +01:00 |
|
|
Thomas Patzke
|
ec9f42410a
|
Intermediate backup state: Parsing of most conditions
* Conditions with parentheses cause exceptions
|
2017-02-22 22:43:35 +01:00 |
|
|
Thomas Patzke
|
fdbadb8e6e
|
Rule fix
Fixed condition in webshell keyowrd rule.
|
2017-02-22 22:42:35 +01:00 |
|
|
Florian Roth
|
b5b5296c5f
|
Fixed unfinished sentence, changed 'next steps'
|
2017-02-22 18:16:20 +01:00 |
|
|
Florian Roth
|
a57d8347b2
|
Link to Sigma Converter in Devel Branch
|
2017-02-20 10:37:23 +01:00 |
|
|
Thomas Patzke
|
a4611d6dc6
|
Added new rules
From adsecurity.org:
* https://adsecurity.org/?p=1772
* https://adsecurity.org/?p=1714
|
2017-02-19 22:43:27 +01:00 |
|
|
Thomas Patzke
|
9740be92bc
|
Merge branch 'master' into devel-sigmac
|
2017-02-19 22:15:18 +01:00 |
|