 Florian Roth
|
a9500a3b1a
|
refactor: any finding in spool drivers is relevant
|
2021-07-01 09:46:35 +02:00 |
|
|
Sittikorn S
|
3382d5da09
|
Create av_printernightmare_cve_2021_1675.yml
|
2021-07-01 13:04:19 +07:00 |
|
|
Florian Roth
|
cb63816dcc
|
Merge pull request #1593 from hieuttmmo/master
PrintNightmare Detection using ImageLoad
|
2021-06-30 16:10:19 +02:00 |
|
|
Florian Roth
|
1ac79238dc
|
Merge pull request #1592 from SigmaHQ/rule-devel
rules: CVE-2021-1675 exploitation events
|
2021-06-30 16:09:34 +02:00 |
|
|
Florian Roth
|
7a96b40895
|
rule: CVE-2021-1675 eventid extension
|
2021-06-30 16:08:33 +02:00 |
|
|
hieuttmmo
|
dceb13fe3f
|
Merge branch 'SigmaHQ:master' into master
|
2021-06-30 20:36:23 +07:00 |
|
|
Tran Trung Hieu
|
579220de6f
|
Detect the PrintNighmare exploit using ImageLoad
|
2021-06-30 20:30:22 +07:00 |
|
|
Florian Roth
|
c508e71165
|
rules: CVE-2021-1675 exploitation events
|
2021-06-30 14:51:20 +02:00 |
|
|
Florian Roth
|
19962c6fe4
|
Merge pull request #1590 from SigmaHQ/rule-devel
config: mappings for Microsoft print service
|
2021-06-30 14:50:52 +02:00 |
|
|
Florian Roth
|
d2f7edc778
|
refactor: change title of older CVE-2021-1675 rule
|
2021-06-30 14:23:14 +02:00 |
|
|
Florian Roth
|
a49bfb14dd
|
refactor: Admin log - not Operational
|
2021-06-30 14:22:40 +02:00 |
|
|
Florian Roth
|
26cfbb9c34
|
config: mapping for Microsoft SMBClient service - security
|
2021-06-30 14:16:26 +02:00 |
|
|
Florian Roth
|
8262a1d98b
|
config: mappings for Microsoft print service
|
2021-06-30 14:09:44 +02:00 |
|
|
Florian Roth
|
9899dd9b82
|
Merge pull request #1579 from frack113/fix_pr_1022
Fix file from PR 1022
|
2021-06-29 12:51:08 +02:00 |
|
|
Florian Roth
|
863941bff5
|
Merge pull request #1586 from BlackB0lt/patch-7
Update sysmon_rclone_execution.yml
|
2021-06-29 12:46:24 +02:00 |
|
|
Florian Roth
|
bbe67ddc73
|
Merge pull request #1589 from WojciechLesicki/master
CobaltStrike Service Installations in Registry
|
2021-06-29 12:44:10 +02:00 |
|
|
Florian Roth
|
1425ede905
|
Merge pull request #1588 from SigmaHQ/rule-devel
CVE-2021-1675 Print Spooler Exploitation
|
2021-06-29 12:31:37 +02:00 |
|
|
Florian Roth
|
a27d3d5880
|
docs: add 2nd Github upload
|
2021-06-29 12:31:13 +02:00 |
|
|
Wojciech Lesicki
|
7c8f9b2d8c
|
Merge branch 'SigmaHQ:master' into master
|
2021-06-29 11:05:42 +02:00 |
|
|
WojciechLesicki
|
ae317652f7
|
Back to upstream version.
|
2021-06-29 11:02:55 +02:00 |
|
|
WojciechLesicki
|
364cfe56c2
|
Base to upstream version
|
2021-06-29 10:57:36 +02:00 |
|
|
WojciechLesicki
|
8b2881328f
|
CobaltStrike Service Installations in Registry
|
2021-06-29 10:52:10 +02:00 |
|
|
Florian Roth
|
b2ac3353dc
|
rule: CVE-2021-1675
|
2021-06-29 10:11:08 +02:00 |
|
|
Sittikorn S
|
56004fc49b
|
Update sysmon_rclone_execution.yml
Add RClone Command that used by DarkSide malware
|
2021-06-29 13:44:03 +07:00 |
|
|
Florian Roth
|
9e3caf4ceb
|
refactor: non-interactive Powershell to "low"
|
2021-06-28 16:38:34 +02:00 |
|
|
Florian Roth
|
b02741cfe0
|
Merge pull request #1583 from Karneades/Karneades-patch-1
Add Synergy as possible FP for PortProxy key
|
2021-06-28 13:52:05 +02:00 |
|
|
Andreas Hunkeler
|
756b8eed26
|
Add Synergy as possible FP for PortProxy key
|
2021-06-28 12:10:16 +02:00 |
|
|
Florian Roth
|
f4ac416ef4
|
Merge pull request #1582 from SigmaHQ/rule-devel
Rule devel
|
2021-06-28 11:36:21 +02:00 |
|
|
Florian Roth
|
d1f1e8e7c4
|
rule: reg add run key
|
2021-06-28 09:39:12 +02:00 |
|
|
Florian Roth
|
ab0502f893
|
refactor: add wscript.exe to mshta rule
|
2021-06-28 09:39:04 +02:00 |
|
|
Florian Roth
|
d48009748f
|
rule: mshta shell spawn
|
2021-06-28 09:32:28 +02:00 |
|
|
Florian Roth
|
e7d9f1b427
|
Merge pull request #1577 from austinsonger/master
Update win_susp_disable_eventlog.yml
|
2021-06-28 08:46:17 +02:00 |
|
|
Florian Roth
|
736cd404de
|
Merge pull request #1578 from wagga40/master
Updated rules with modifiers instead of '*', removed trailing '\\', removed drive letter before "Users"
|
2021-06-28 08:45:22 +02:00 |
|
|
Florian Roth
|
faf5e4a514
|
Update win_run_virtualbox.yml
|
2021-06-28 08:42:09 +02:00 |
|
|
Austin Songer
|
8e6ab7fd79
|
Update win_susp_disable_eventlog.yml
|
2021-06-28 00:59:53 -05:00 |
|
|
Austin Songer
|
bfe969f071
|
Update win_susp_disable_eventlog.yml
|
2021-06-28 00:53:52 -05:00 |
|
|
Austin Songer
|
d1fba0e1a5
|
Update win_susp_disable_eventlog.yml
|
2021-06-27 20:26:44 -05:00 |
|
|
frack113
|
e096b853cf
|
Fix file from PR 1022
|
2021-06-27 18:24:56 +02:00 |
|
|
wagga40
|
d6afa46e68
|
Added missing "modified" fields. Removed trailing wildcard.
|
2021-06-27 17:36:32 +02:00 |
|
|
wagga40
|
d6c430408f
|
Removed duplicate field
|
2021-06-27 15:54:26 +02:00 |
|
|
wagga40
|
3f0dd2417b
|
Removed Drive letter before "Users" directory
|
2021-06-27 15:32:46 +02:00 |
|
|
wagga40
|
11df697cdc
|
Updated rules with modifiers instead of '*' and remove trailing '\\'
|
2021-06-27 14:51:29 +02:00 |
|
|
Austin Songer
|
f1d937cbd6
|
Update win_susp_disable_eventlog.yml
|
2021-06-26 12:22:54 -05:00 |
|
|
Austin Songer
|
de6fac1d18
|
Update win_susp_disable_eventlog.yml
|
2021-06-26 03:15:05 -05:00 |
|
|
Florian Roth
|
abe353de66
|
Merge pull request #1561 from frack113/es_rule_add_more_tag
add multi custom tag for issue #1560
|
2021-06-25 12:25:28 +02:00 |
|
|
Florian Roth
|
2ad6401487
|
Merge pull request #1565 from SpeedyFireCyclone/powershell_fieldmappings
Generic remapping for PowerShell backend
|
2021-06-25 12:21:00 +02:00 |
|
|
Florian Roth
|
6c3f94fb72
|
Merge pull request #1572 from adeemm/ldap-recon
Add rule to detect AD enumeration
|
2021-06-25 12:18:26 +02:00 |
|
|
Florian Roth
|
685bd490f5
|
Merge pull request #1573 from d4rk-d4nph3/master
Added rule for default cobalt strike certificate
|
2021-06-25 12:16:31 +02:00 |
|
|
Florian Roth
|
c90e31275d
|
Merge pull request #1576 from CriimBow/patch-1
Typo on Find-DomainObjectPropertyOutlier
|
2021-06-25 12:15:59 +02:00 |
|
|
Florian Roth
|
537d89d185
|
Merge pull request #1575 from SigmaHQ/rule-devel
rules: PurpleSharp, WMIC ActiveScriptEventConsumer
|
2021-06-25 12:15:35 +02:00 |
|