003e5bee6d
Merge pull request #3018 from SigmaHQ/rule-devel
...
refactor: rule addition
2022-05-19 07:50:36 +02:00
3fe86e3b84
rule: grpconv execution
2022-05-18 17:56:26 +02:00
04a3dfeb01
Merge pull request #3025 from nasbench/master
...
Quick Updates and Fixes
2022-05-18 17:35:18 +02:00
7d296ef078
fix: change on deleted rule
2022-05-18 17:34:39 +02:00
99e81ea2eb
Merge branch 'pr/3023'
2022-05-18 17:33:10 +02:00
15cee5c0b1
Update proc_creation_win_susp_taskkill.yml
2022-05-18 17:28:26 +02:00
dcf236fede
Quick Updates and Fixes
...
- Added "Invoke-EventViewer.ps1" script to the rule "file_event_win_powershell_exploit_scripts"
- Added "OriginalFileName" to "proc_creation_win_susp_taskkill"
- Created rule for "winword" being used as a LOLBIN to download and load arbitrary DLLs
2022-05-18 12:50:59 +01:00
354e8ded4e
Merge pull request #3020 from nasbench/master
...
Rule Update (Batch 2)
2022-05-18 07:05:34 +02:00
07a79acede
Update proc_creation_win_lolbas_extrac32.yml
2022-05-17 15:33:18 +01:00
389240855d
Update proc_creation_win_lolbas_extrac32.yml
2022-05-17 15:17:09 +01:00
3bbeab2a7b
Requested Changes
2022-05-17 15:04:26 +01:00
7ea6ed3db6
Merge pull request #3016 from frack113/ttdinjec
...
ttdinject lolbin
2022-05-17 06:28:22 +02:00
b49633d32b
#2902 : Remove t1547.006
2022-05-16 21:57:30 -05:00
3a629e8a2e
Update proc_creation_win_certoc_download.yml
2022-05-16 22:05:00 +01:00
f0e05ccb3c
Rule Update (Batch 2)
...
- Added 5 more PowerShell scripts for the rule "file_event_win_powershell_exploit_scripts.yml"
- Created new rule for "certoc" lolbin to cover "Download" option as described in the LOLBAS project
- Created specific rule for the "IEExec" lolbin to cover "Download" option as described in the LOLBAS Project
- Updated some rules to use "OriginalFileName" in addition to the "Image" selection
- Updated some rules to increase coverage.
2022-05-16 22:02:41 +01:00
f0f8d601c0
Update proc_creation_win_lolbin_ttdinject.yml
2022-05-16 16:53:41 +02:00
ed5963493c
Merge pull request #3012 from svch0stz/patch-2
...
Update proc_creation_win_webshell_spawn.yml
2022-05-16 16:51:04 +02:00
c240824bd0
ttdinject lolbin
2022-05-16 09:10:28 +02:00
f386440bb3
Add status
2022-05-15 16:17:02 +02:00
3ec531979a
Update proc_creation_win_webshell_spawn.yml
...
Example pulled from manage engine below:
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ParentImage: C:\Program Files\ManageEngine\SupportCenterPlus\jre\bin\java.exe
ParentCommandline: "..\jre\bin\java" -Dcatalina.home=.. -Dserver.home=.. -Dserver.stats=1000 <snip>
2022-05-15 14:57:21 +10:00
4241a5d13e
Update proc_creation_win_wmi_spwns_powershell.yml
2022-05-13 15:33:48 +01:00
ae2ddae5aa
Fix Requested Changes
2022-05-13 15:28:22 +01:00
2e689eca54
Quick Fix
...
- Removed "Contains" modifier from "OriginalFileName" across all rules.
- Added "Image" field back in the rules highlighted by Florian
2022-05-13 11:52:31 +01:00
1e494e508a
Update proc_creation_win_powershell_defender_exclusion.yml
...
Added ' -ExclusionIpAddress' Option
2022-05-12 23:28:14 +01:00
d8a3ca6919
Updated Rules to Use OriginalFileName
2022-05-12 23:27:48 +01:00
26e041f13a
fix: VSCode icacls
2022-05-12 21:48:05 +02:00
9e218149d9
Merge pull request #3008 from SigmaHQ/rule-devel
...
refactor: AV rules, changes, new PW protected ZIP rules
2022-05-12 17:38:11 +02:00
23fbf66679
Removed duplicate rule
2022-05-12 17:19:57 +02:00
2b0db86440
Merge pull request #3002 from phantinuss/master
...
Various new Rule Tests
2022-05-11 15:49:46 +02:00
6f92a11c02
chore: test rules: check for all modifier with single item
2022-05-11 11:06:09 +02:00
112b715dd6
chore: test rules: reactivate single value list check
2022-05-10 17:13:04 +02:00
b4fdb13e8a
chore: test rules: check for unused selections
2022-05-10 11:07:40 +02:00
5151fc25c9
Updated "modified" field
2022-05-09 19:28:50 +01:00
b987752cfe
Small update
...
- Updated regini rules to take into consideration OriginalFileName
- Added another function to execute execute click-once via rundll32 (dfshim)
2022-05-09 19:26:51 +01:00
b991a5be52
chore: test rules: warn on errors or invalid FP reasons
...
also adapted the existing rules to pass the tests
2022-05-09 16:07:55 +02:00
dbd68bf3f0
chore: test rules: capitalization on FP list entries
...
Entires to the false positive list should begin with
a capital letter. e.g. Unkown instead of unkown.
Fixed the existing rules accordingly
2022-05-09 16:07:44 +02:00
99dc599432
Update proc_creation_win_lolbin_ie4uinit.yml
2022-05-07 10:55:58 +02:00
4c51bab130
Update proc_creation_win_lolbas_replace.yml
2022-05-07 10:55:03 +02:00
c90e2828d4
Lolbin
2022-05-07 10:37:55 +02:00
35a7244c62
Merge pull request #2986 from elhoim/susp_regsvr32_child_explorer
...
[New Rule] Suspicious explorer as child of regsvr32
2022-05-06 20:17:33 +02:00
3ed4c1ad14
Merge pull request #2985 from humpalum/patch-6
...
Create proc_creation_win_susp_NtlmRelay.yml
2022-05-06 20:17:02 +02:00
bf9417c88d
Update proc_creation_win_susp_ntlmrelay.yml
2022-05-06 19:46:24 +02:00
5243e5567f
Update proc_creation_win_susp_regsvr32_explorer.yml
2022-05-06 19:43:43 +02:00
f729bbef1d
Update proc_creation_win_tool_nircmd.yml
2022-05-06 15:18:42 +01:00
4a4ce131c1
Update proc_creation_win_tool_nircmd.yml
2022-05-06 12:11:54 +01:00
bd2f527a36
Update proc_creation_win_susp_advancedrun.yml
2022-05-05 22:32:44 +01:00
43d4bfa9db
Update proc_creation_win_tool_nircmd.yml
2022-05-05 22:32:36 +01:00
04ad307e4e
Update proc_creation_win_susp_advancedrun_priv_user.yml
...
Added cases for LocalService and NetworkService, which could be interesting to monitor:
RunAs=10 (Network Service)
RunAs=11 (Local Service)
2022-05-05 21:06:53 +01:00
a285238808
fix: typo
2022-05-05 19:01:43 +02:00
91a2411ea3
Update and rename proc_creation_win_susp_NtlmRelay.yml to proc_creation_win_susp_ntlmrelay.yml
2022-05-05 18:57:42 +02:00
Florian Roth