 Florian Roth
|
1382edb5e3
|
Cosmetics
|
2018-02-09 10:13:39 +01:00 |
|
|
Florian Roth
|
34e0352a21
|
Rule: Proxy UAs - malware - Ghost419
https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/
|
2018-02-03 14:47:04 +01:00 |
|
|
SherifEldeeb
|
348728bdd9
|
Cleaning up empty list items
|
2018-01-28 02:36:39 +03:00 |
|
|
SherifEldeeb
|
48441962cc
|
Change All "str" references to be "list"to mach schema update
|
2018-01-28 02:24:16 +03:00 |
|
|
SherifEldeeb
|
112a0939d7
|
Change "reference" to "references" to match new schema
|
2018-01-28 02:12:19 +03:00 |
|
|
Florian Roth
|
aca70e57ec
|
Massive Title Cleanup
|
2018-01-27 10:57:30 +01:00 |
|
|
Florian Roth
|
fd801a61a5
|
Bronze Butler Daserf malware User Agents in Proxy Logs
|
2017-11-08 12:52:11 +01:00 |
|
|
Florian Roth
|
e5383be163
|
Rule: Proxy suspicious downloads from Dyndns hosts
|
2017-11-08 11:32:30 +01:00 |
|
|
Florian Roth
|
4540088aa9
|
Rule: Extended proxy suspicious TLD white list rule
|
2017-11-08 00:38:26 +01:00 |
|
|
Florian Roth
|
acc430c4b6
|
Rule: Proxy download from blacklisted TLDs
|
2017-11-07 14:03:16 +01:00 |
|
|
Florian Roth
|
58f20d3cfb
|
Rule: Proxy download whitelist bugfix and improvements
|
2017-11-07 14:02:56 +01:00 |
|
|
Florian Roth
|
e680da1b50
|
Suspicious flash player download location / BadRabbit
|
2017-10-25 08:40:30 +02:00 |
|
|
Florian Roth
|
f4720d5149
|
APT17 malware UA
https://twitter.com/cyb3rops/status/915135877709549568
|
2017-10-03 12:47:53 +02:00 |
|
|
Thomas Patzke
|
986c9ff9b7
|
Added field names to first rules
|
2017-09-12 23:54:04 +02:00 |
|
|
Thomas Patzke
|
5c465129bd
|
Fixed rules
* Replaced unspecified logsource attribute 'type' with 'category'
* Usage of service 'auth' for linux logs
|
2017-09-11 00:35:52 +02:00 |
|
|
Florian Roth
|
433293ea40
|
'ruler' User Agent
https://www.crowdstrike.com/blog/using-outlook-forms-lateral-movement-persistence/
|
2017-07-22 09:24:45 -06:00 |
|
|
Florian Roth
|
4bff14acd1
|
User-Agent rules split up in separate files
|
2017-07-08 09:59:05 -06:00 |
|
|
Florian Roth
|
eeb31964da
|
User-Agent Rules
|
2017-07-08 08:37:44 -06:00 |
|
|
Florian Roth
|
cf42847b74
|
Suspicious User Agent strings
|
2017-07-07 20:53:22 -06:00 |
|
|
Florian Roth
|
cec48ece04
|
Suspicious User-Agent Strings, starting with empty value
|
2017-07-07 18:38:32 -06:00 |
|
|
Florian Roth
|
a87d513efa
|
Rule: Suspicious executable downloads
|
2017-03-13 16:11:43 +01:00 |
|
|
Florian Roth
|
b8db4935e0
|
Rule: PowerShell UserAgent in Proxy Logs
|
2017-03-13 13:51:32 +01:00 |
|