 Florian Roth
|
9beafefe52
|
rules: suspicious linux patterns
|
2022-03-14 12:01:52 +01:00 |
|
|
frack113
|
8bb3379b68
|
Normalization of rule names
|
2022-02-22 11:16:31 +01:00 |
|
|
Andreas Hunkeler
|
c8fa678a9b
|
rule: add tag execution to new bpftrace rule
|
2022-02-11 14:14:22 +01:00 |
|
|
Andreas Hunkeler
|
66b9d35ee9
|
rule: add new bpftrace unsafe option rule
|
2022-02-11 12:08:53 +01:00 |
|
|
Florian Roth
|
885f70b0f3
|
Update lnx_doas_execution.yml
|
2022-01-20 13:08:39 +01:00 |
|
|
Sittikorn S
|
f195160baa
|
Update lnx_doas_execution.yml
|
2022-01-20 10:58:47 +07:00 |
|
|
Sittikorn S
|
8b94046efa
|
Update lnx_doas_execution.yml
|
2022-01-20 10:11:24 +07:00 |
|
|
Sittikorn S
|
4f56e0d92e
|
Update lnx_doas_execution.yml
|
2022-01-20 09:48:24 +07:00 |
|
|
Sittikorn S
|
eb4731b370
|
Create lnx_doas_execution.yml
|
2022-01-20 09:46:17 +07:00 |
|
|
frack113
|
4631d0c482
|
remove invalid tag
|
2022-01-19 18:23:30 +01:00 |
|
|
frack113
|
f7e670d55e
|
Simple Quote
|
2022-01-11 13:40:53 +01:00 |
|
|
Florian Roth
|
e055ec1d52
|
refactor: change all " of them" expressions
|
2022-01-11 10:59:57 +01:00 |
|
|
frack113
|
01dc930c17
|
Change status for old rules
|
2021-11-27 11:33:14 +01:00 |
|
|
frack113
|
1cfca93354
|
Missing status in rules (#2284)
* add missing status
|
2021-11-19 22:32:26 +01:00 |
|
|
Florian Roth
|
a921bd5ec8
|
style: reordered rule layout
|
2021-11-17 18:59:40 +01:00 |
|
|
frack113
|
1d38a7dfa5
|
Fix linux process_creation field case
|
2021-11-11 10:16:36 +01:00 |
|
|
frack113
|
c228cde0cb
|
Move to correct directory
|
2021-10-27 14:38:51 +02:00 |
|
|
Florian Roth
|
fcecb951d5
|
Merge branch 'master' into rule-devel
|
2021-10-26 22:03:55 +02:00 |
|
|
Florian Roth
|
1983cba1f3
|
refactor: xmrig sub process indicator
|
2021-10-26 13:24:01 +02:00 |
|
|
Florian Roth
|
ab499c9c21
|
rules: crypto coin mining
|
2021-10-26 08:52:07 +02:00 |
|
|
Florian Roth
|
0b46180cd2
|
fix: moved back connect bash to correct folder
|
2021-10-26 08:51:54 +02:00 |
|
|
frack113
|
8595478b36
|
Merge pull request #2149 from OTRF/feature/Sysmon-For-Linux-Rules
OTR - Migrating rules to Sysmon for Linux schema :)
|
2021-10-21 19:10:32 +02:00 |
|
|
frack113
|
963f32063f
|
Merge pull request #2148 from SigmaHQ/rule-devel
First Linux Process Creation and Network Connection rules (Sysmon for Linux)
|
2021-10-21 19:10:08 +02:00 |
|
|
Florian Roth
|
ae22f2ae7e
|
rule: Linux Bash reverse shell indicators
|
2021-10-16 14:21:55 +02:00 |
|
|
frack113
|
114e44ce6b
|
move file
|
2021-10-16 11:11:19 +02:00 |
|
|
Roberto Rodriguez
|
2c0e89ccc8
|
added indentation to lists per request
|
2021-10-15 16:24:26 -04:00 |
|
|
Roberto Rodriguez
|
7b11987155
|
Fixed format indentation to fix block error
|
2021-10-15 16:12:51 -04:00 |
|
|
Roberto Rodriguez
|
d391eccd32
|
split commandline arguments in a few rules
|
2021-10-15 16:10:42 -04:00 |
|
|
Roberto Rodriguez
|
eed86077ab
|
updated rules schema and added Clipboard Collection with Xclip Tool
|
2021-10-15 15:59:11 -04:00 |
|
|
Roberto Rodriguez
|
04ff9ae692
|
Updated at command rule to use Image field
|
2021-10-15 15:46:59 -04:00 |
|
|
Roberto Rodriguez
|
aa0a5b8204
|
commands to clear or remove the syslog rule
|
2021-10-15 15:43:42 -04:00 |
|
|
Roberto Rodriguez
|
f8cb0883d5
|
OMI SCX Execute RunAsProvider rules
|
2021-10-15 15:38:09 -04:00 |
|
|
Roberto Rodriguez
|
ca99394e46
|
detect overwriting and deletion of files via dd
|
2021-10-15 15:28:15 -04:00 |
|
|
Florian Roth
|
8ee9d2f5b4
|
docs: changes in description
|
2021-10-15 15:12:44 +02:00 |
|
|
Florian Roth
|
231b54e526
|
rule: first Linux process_creation rule
|
2021-10-15 14:39:32 +02:00 |
|