8ec7d53688
Improved coverage / tree image
2017-02-19 13:41:04 +01:00
00a4adf542
Link Bugfix
2017-02-19 11:09:32 +01:00
52d04e52ac
Removed lists from log source section
2017-02-19 11:08:40 +01:00
6fbc1dcd32
Mayor update
...
Why Sigma, intro changed
2017-02-19 11:03:30 +01:00
ca758bb99b
New images
2017-02-19 10:24:24 +01:00
166f207dc0
Sysmon rules 'logsource' change
2017-02-19 09:19:06 +01:00
cd6e24c5ff
Added "logsource" sections and new rule
2017-02-19 00:31:59 +01:00
0543ef7e75
sigmac: Condition Tokenizer
2017-02-16 23:58:44 +01:00
ec1c5e142b
Merge branch 'master' into devel-sigmac
2017-02-16 23:52:03 +01:00
9a38d6543f
Fixed type of condition
2017-02-16 23:49:34 +01:00
367596060d
Merge branch 'master' into devel-sigmac
2017-02-16 22:14:48 +01:00
18fd63f6b7
Levels to low, medium, high, critical
2017-02-16 18:06:22 +01:00
ce43dce7ef
Parsing of detections
...
Transformation of detections into internal data structures. Parsing must
be changed later to on-demand parsing because condition can change
default behavior of lists.
2017-02-16 00:40:08 +01:00
77930b5173
Merge pull request #3 from Neo23x0/devel
...
Rule review and cleanup
2017-02-16 00:07:46 +01:00
3821e59db1
Merge branch 'devel' into devel-sigmac
2017-02-15 23:57:33 +01:00
88270fcf2d
Rule review and cleanup
...
* removed unnecessary one element lists from definitions
* converted some lists of one element maps to maps because the resulting
OR linkage would cause wrong result.
2017-02-15 23:53:08 +01:00
980ed9c5c7
Moved YAML parsing in SigmaParser class
2017-02-13 23:31:42 +01:00
1498d787e7
Added Sigma converter skeleton
...
* YAML parsing
* argument parsing
* empty backend classes
2017-02-13 23:28:53 +01:00
193436c7fc
Set theme jekyll-theme-slate
2017-02-13 14:42:42 +01:00
c8c1a0f2b0
New Screenshot Section in README
2017-02-12 17:10:48 +01:00
09def1fe2e
New Screenshot - Suspicious Failed Logons from Single Source Workstation
2017-02-12 17:09:24 +01:00
d54c094af0
New screenshot - Webshell detection with Sysmon
2017-02-12 16:43:13 +01:00
a6173df0b9
LSASS Remote Thread Update
2017-02-12 16:33:09 +01:00
d0999ce8da
Screenshot Update
2017-02-12 16:32:52 +01:00
406ee52398
Changed second screenshot
2017-02-12 15:54:05 +01:00
04ea201817
New rules and cleanup
2017-02-12 15:50:39 +01:00
0988aa3496
Screenshots - Rule Examples
2017-02-12 15:50:12 +01:00
a2adb1ddb5
Renamed rule files, new rules
2017-02-10 19:17:02 +01:00
97847a29de
Moved network rules into rules directory
2017-02-08 12:43:50 +01:00
a7c1409fc6
Added 'Network Scan' rule ( #1 )
...
* Added possibility for multiple OR-linked conditions
2017-02-08 12:41:32 +01:00
1307a45fd5
Moved rules to a separate directory
2017-02-07 00:44:40 +01:00
ee6cad91fb
Update README.md
2017-02-07 00:24:37 +01:00
a69c7e3cf7
Update README.md
2017-02-07 00:24:10 +01:00
411cc8b7af
Wiki title image
2017-02-06 20:04:51 +01:00
03c0ea7aa2
README Update
2017-02-06 20:03:57 +01:00
810758a9f5
Rew rule examples: RC4 Kerberos, JAVA remote debugging process
2017-02-06 20:03:42 +01:00
e7d62f8fbe
Added 'multiple_suspicious_response_codes_single_source' web rule
2017-01-11 20:47:44 +01:00
97511f7c1e
Replicated 'susp_failed_logons_single_source' to Linux.
2017-01-11 20:47:28 +01:00
775323deef
Added experimental web 'shell_spawn' rule
2017-01-11 20:47:21 +01:00
b202822ef2
Added status classification to specification
2017-01-11 20:45:57 +01:00
1ad5d2555a
Update of specification
2017-01-11 20:45:37 +01:00
d31614af9c
Consistency between format description and examples
...
- description/comment -> title/description
- addition of reference
2017-01-11 20:45:01 +01:00
68cc0770e8
The poor VI(M) users with their swp's!
2017-01-11 20:44:47 +01:00
c2f3ee25a8
Fixed single quote balance
2017-01-11 20:44:36 +01:00
6125875d2d
Simplification of aggregation comparison expression
...
Parenthesis around aggregation expression should be optional. Parser
would handle this through operator precedence.
2017-01-11 20:43:34 +01:00
ffda754d53
Remove implicit selection number, first Sysmon example
2017-01-10 15:05:19 +01:00
bb02bf93d4
Update README.md
2017-01-08 17:40:40 +01:00
8ee9c37811
README Update Specs 1
2017-01-07 22:39:06 +01:00
b446fb39f7
Updated examples
2016-12-27 23:09:41 +01:00
5f0a227053
Example Updates
2016-12-27 14:49:59 +01:00
Florian Roth