aa5396cb9f
Merge pull request #1246 from oscd-initiative/oscd_art_macos_task_14_T1049
...
[OSCD] ART sync, test T1049: System Network Connections Discovery (macOS)
2020-12-30 22:57:29 +01:00
fb9698345b
Merge pull request #1247 from oscd-initiative/oscd_art_linux_task_8__T1049
...
[OSCD] ART sync, test T1049: System Network Connections Discovery (Linux)
2020-12-30 22:57:11 +01:00
6a7991ee96
Merge pull request #1250 from oscd-initiative/oscd_art_macos_task_41_T1518.001
...
[OSCD] ART sync, test T1518.001: Security Software Discovery (macOS)
2020-12-30 22:41:18 +01:00
a88c853237
Merge pull request #1251 from oscd-initiative/oscd_art_linux_task_26_T1518.001
...
[OSCD] ART sync, test T1518.001: Security Software Discovery (Linux)
2020-12-30 22:40:32 +01:00
436fd37655
Merge pull request #1252 from oscd-initiative/oscd_art_macos_task_55_T1553.001
...
[OSCD] ART sync, test T1553.001: Gatekeeper Bypass (macOS)
2020-12-30 22:39:36 +01:00
5de952d488
Merge pull request #1253 from oscd-initiative/oscd_art_macos_task_60_T1562.001
...
[OSCD] ART sync, test T1562.001: Disable or Modify Tools (macOS)
2020-12-30 22:39:15 +01:00
e223d34a6e
Merge pull request #1257 from alejandroortuno/service-scanning
...
[OSCD] Network Service Scanning
2020-12-30 22:35:47 +01:00
5c03c4d4ec
Merge pull request #1258 from alejandroortuno/applescript
...
[OSCD] MacOS Applescript
2020-12-30 22:31:30 +01:00
06c168d9b2
Merge pull request #1259 from alejandroortuno/firewall
...
[OSCD] Firewall Disable (Linux)
2020-12-30 22:30:41 +01:00
7954684fbf
Merge pull request #1260 from alejandroortuno/remote-system-discovery
...
[OSCD] Remote System Discovery
2020-12-21 18:32:08 +01:00
64197d0dec
Merge pull request #1261 from alejandroortuno/emond
...
[OSCD] MacOS Emond Launch Daemon
2020-12-21 18:30:56 +01:00
c17c034cb5
Changed selections and condition
...
see manpage for security tool on macOS
https://gist.github.com/Capybara/6228955
2020-11-27 19:23:31 +01:00
78d201ad15
Fix value modifier and add a slash
2020-11-24 23:06:21 +03:00
000c038ede
Retrigger tests
2020-11-20 09:30:43 +01:00
cfcda8d25f
Trigger new test execution
2020-11-20 09:29:09 +01:00
199a897f75
Fix rule indent
2020-11-17 10:12:55 +01:00
2939b33ab5
Update lnx_network_service_scanning.yml
2020-11-16 01:00:09 +01:00
ad031d97ee
Filter out listening mode on nc
2020-11-09 10:32:56 +01:00
c17e8574d0
change the syntax a bit and removed .service suffix as it is
...
[redundant](https://www.freedesktop.org/software/systemd/man/systemctl.html ]:
```
Unit commands listed above take either a single unit name (designated as UNIT), or multiple unit specifications (designated as PATTERN…). In the first case, the unit name with or without a suffix must be given. If the suffix is not specified (unit name is "abbreviated"), systemctl will append a suitable suffix, ".service" by default, and a type-specific suffix in case of commands which operate only on specific unit types. For example,
# systemctl start sshd
and
# systemctl start sshd.service
are equivalent
```
2020-11-06 20:56:08 +01:00
7c5067ade4
Making it a global rule
2020-11-06 10:25:59 +01:00
a9a90e024c
make it global rule
2020-11-06 09:56:49 +01:00
5918cc0a3d
remove cat
2020-10-29 09:58:58 +01:00
0c0c1725fa
refactor detections
2020-10-29 09:34:47 +01:00
167e9745cd
Update macos_remote_system_discovery.yml
2020-10-29 02:06:45 +01:00
81f6f24155
Update lnx_remote_system_discovery.yml
2020-10-29 02:06:20 +01:00
80b1a19246
Added the space at the beginning of the IP ranges.
2020-10-28 10:16:29 +01:00
3a58c00feb
Removing the echo detection
2020-10-28 10:07:59 +01:00
e31c8f96e9
added the category
2020-10-28 09:56:01 +01:00
c83d5a3d65
Added some minor tuning of ip ranges
2020-10-26 09:45:13 +01:00
11df6c2566
Sigma rule
2020-10-23 10:16:59 +02:00
638fd7eeab
Remote system discovery sigma rules for macos and linux
2020-10-22 10:37:29 +02:00
5d37c0ee1e
Added some modifications to firewall disabling
2020-10-22 10:22:00 +02:00
5e5576a91b
Fix product
2020-10-21 10:13:28 +02:00
aa416090e1
Initial sigma rule
2020-10-21 10:09:00 +02:00
cdabf8e0e8
Sigma rules for network service scanning.
2020-10-21 09:41:40 +02:00
e95749e190
fix syntax
2020-10-20 05:10:11 +02:00
99b40e4a6a
chage list of plist to contains modifier. could be easily bypassed with endswith
2020-10-20 05:09:08 +02:00
cea24c9984
add macos_disable_security_tools.yml, oscd initiative issue #1012 , task number 60
2020-10-20 05:06:43 +02:00
2890adf093
add macos_xattr_gatekeeper_bypass.yml, oscd initiative issue #1012 , task number 55
2020-10-20 04:34:02 +02:00
5a8c7cd3f9
add missing falcond
2020-10-20 04:00:16 +02:00
6f3ac02cb3
add lnx_security_software_discovery.yml, oscd initiative issue #1011 , task number 26
2020-10-20 03:57:41 +02:00
f0663c8412
add macos_security_software_discovery.yml, oscd initiative issue #1012 , task number 41
2020-10-20 03:46:41 +02:00
34591f9f64
add lnx_system_network_connections_discovery.yml, oscd initiative issue #1011 , task number 8
2020-10-20 01:17:06 +02:00
941fbebcdc
add macos_system_network_connections_discovery.yml, oscd initiative issue #1012 , task number 14
2020-10-20 01:14:56 +02:00
0323e50011
Detect credential access for macOS via Keychain
2020-10-19 23:37:46 +03:00
d3ee1aba66
docs: MITRE ATT&CK(R) trademark references removed or adjusted
...
https://github.com/Neo23x0/sigma/issues/1028
2020-09-30 08:53:52 +02:00
8ce73bd8df
Fixed issues with tags and missing files
2020-09-15 06:10:57 -06:00
52ab677798
Fixed my git issue
2020-09-13 22:03:04 -06:00
de5444a81e
Merge pull request #989 from oscd-initiative/master
...
[OSCD Initiative][ATT&CK tags update]
2020-09-08 13:27:58 +02:00
af3b93a522
Merge pull request #914 from omergunal/ogunal-2
...
New rules for Linux
2020-09-07 09:41:43 +02:00
Thomas Patzke