 Nasreddine Bencherchali
|
ad0d3f58ac
|
fix: apply suggestions from code review
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
|
2023-07-24 12:35:11 +02:00 |
|
|
Nasreddine Bencherchali
|
72b658b4c2
|
Update proc_creation_win_susp_ntfs_short_name_use_image.yml
|
2023-07-24 11:44:59 +02:00 |
|
|
Nasreddine Bencherchali
|
a97c96aacc
|
fix: fp
|
2023-07-24 11:01:02 +02:00 |
|
|
Nasreddine Bencherchali
|
db9214e8d2
|
fix: typos
|
2023-07-20 14:13:13 +02:00 |
|
|
Nasreddine Bencherchali
|
1ed5629eb2
|
feat: update filter
|
2023-07-20 14:01:35 +02:00 |
|
|
Nasreddine Bencherchali
|
f7acf07882
|
Merge branch 'SigmaHQ:master' into new-rules-13-07-23
|
2023-07-20 13:51:48 +02:00 |
|
|
Nasreddine Bencherchali
|
73f44e61d1
|
feat: add more rules
|
2023-07-20 13:47:30 +02:00 |
|
|
frack113
|
9acc4e1823
|
feat: add rules related to pwsh set-acl cmdlet usage (#4352)
|
2023-07-20 11:08:44 +02:00 |
|
|
Florian Roth
|
764963c2c7
|
refactor: increased level
|
2023-07-18 14:09:12 +02:00 |
|
|
Josh
|
f083be8458
|
Fixed typo in comment
DragonOK and not dargonOK :)
|
2023-07-17 14:39:48 -04:00 |
|
|
Nasreddine Bencherchali
|
7ca5639d1d
|
Merge pull request #4346 from X-Junior/CVE-2023-36884-rules
feat: new rules related to CVE-2023-36884
|
2023-07-17 14:31:33 +02:00 |
|
|
phantinuss
|
b99089e252
|
fix: typo
|
2023-07-17 13:57:27 +02:00 |
|
|
Nasreddine Bencherchali
|
2c3d19f335
|
Merge pull request #4293 from danielbohannon/patch-1
|
2023-07-17 12:19:05 +02:00 |
|
|
Nasreddine Bencherchali
|
8726f310e7
|
chore: update metadata
|
2023-07-13 23:30:16 +02:00 |
|
|
Mohamed Ashraf (X__Junior)
|
c10a6c9870
|
Create net_connection_win_office.yml
|
2023-07-13 19:23:38 +03:00 |
|
|
Nasreddine Bencherchali
|
08e0a297f3
|
feat: new rules and updates
|
2023-07-13 17:31:13 +02:00 |
|
|
Mohamed Ashraf (X__Junior)
|
81440fe0ea
|
CVE-2023-36884 rules
|
2023-07-13 18:27:12 +03:00 |
|
|
Nasreddine Bencherchali
|
dcfb4c5c28
|
Merge pull request #4337 from phantinuss/master
fix: FP found in-the-wild
|
2023-07-13 11:23:25 +02:00 |
|
|
Nasreddine Bencherchali
|
6e6726749c
|
Merge pull request #4295 from danielbohannon/patch-3
|
2023-07-13 11:08:35 +02:00 |
|
|
Nasreddine Bencherchali
|
795179d9dc
|
Merge branch 'master' into master
|
2023-07-13 11:07:45 +02:00 |
|
|
Nasreddine Bencherchali
|
a1672f8dbb
|
fix: remove ping filter
|
2023-07-13 11:05:00 +02:00 |
|
|
frack113
|
62256b104d
|
fix: FP found with remote thread rule (#4342)
|
2023-07-13 10:04:03 +02:00 |
|
|
Nasreddine Bencherchali
|
ccec820a01
|
feat: new rules & updates (#4328)
|
2023-07-13 10:01:05 +02:00 |
|
|
frack113
|
3d2b11ac5f
|
Merge pull request #4345 from frack113/redcannary_t1087_002
Update posh_ps_get_adcomputer
|
2023-07-12 20:52:43 +02:00 |
|
|
frack113
|
1586e30f19
|
Merge pull request #4343 from frack113/redcannary_t1057
Add proc_creation_win_findstr_susp_parent
|
2023-07-12 20:52:17 +02:00 |
|
|
frack113
|
101fe1a355
|
Update posh_ps_get_adcomputer
Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com>
|
2023-07-08 18:02:06 +02:00 |
|
|
frack113
|
c97c3bc54c
|
Add httpd filter
Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com>
|
2023-07-06 20:19:03 +02:00 |
|
|
frack113
|
f9dbb1f413
|
Add proc_creation_win_findstr_susp_parent
Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com>
|
2023-07-06 19:51:47 +02:00 |
|
|
phantinuss
|
835dda9484
|
fix: FPs found in testing env
|
2023-07-05 10:37:17 +02:00 |
|
|
phantinuss
|
cede72ad18
|
fix: more FPs, found in testing env
|
2023-07-05 10:31:47 +02:00 |
|
|
phantinuss
|
f0dc10327b
|
fix: FP found in-the-wild
|
2023-06-30 09:39:55 +02:00 |
|
|
frack113
|
c0332a9d96
|
Merge pull request #4334 from securepeacock/patch-54
Update net_dns_wannacry_killswitch_domain.yml
|
2023-06-29 06:46:14 +02:00 |
|
|
frack113
|
78d28994c9
|
Merge pull request #4333 from securepeacock/patch-53
Update proc_creation_win_nltest_recon.yml
|
2023-06-29 06:45:58 +02:00 |
|
|
phantinuss
|
117c600e03
|
fix: FP found with excel
|
2023-06-28 10:33:19 +02:00 |
|
|
securepeacock
|
a60094531b
|
Update net_dns_wannacry_killswitch_domain.yml
|
2023-06-26 13:31:05 -04:00 |
|
|
securepeacock
|
a527ff3a1a
|
Update proc_creation_win_nltest_recon.yml
|
2023-06-26 09:55:01 -04:00 |
|
|
Ryan Plas
|
cda0fbff62
|
fix:F multiple 404 links in references (#4332)
|
2023-06-26 10:10:04 +01:00 |
|
|
Nasreddine Bencherchali
|
e59f9d6f61
|
chore: add missing quotes
|
2023-06-23 10:17:09 +02:00 |
|
|
Nasreddine Bencherchali
|
1562630a17
|
chore: update structure
|
2023-06-23 10:16:53 +02:00 |
|
|
Nasreddine Bencherchali
|
fac3e34f92
|
fix: broken selection
|
2023-06-23 10:12:23 +02:00 |
|
|
Nasreddine Bencherchali
|
135855e9a7
|
chore: update structure
|
2023-06-23 10:10:13 +02:00 |
|
|
Nasreddine Bencherchali
|
eef461a5fc
|
Merge pull request #4326 from securepeacock/patch-49
feat: add new reference to iso mount rule
|
2023-06-23 10:04:05 +02:00 |
|
|
Nasreddine Bencherchali
|
ee725107c3
|
Merge pull request #4327 from securepeacock/patch-50
feat: add new reference to iso mount rule
|
2023-06-23 10:00:31 +02:00 |
|
|
Nasreddine Bencherchali
|
96b2219686
|
Merge pull request #4329 from securepeacock/patch-51
feat: add new reference to curl download rule
|
2023-06-23 09:58:50 +02:00 |
|
|
Nasreddine Bencherchali
|
2915eb55c2
|
Merge pull request #4330 from securepeacock/patch-52
feat: add new reference for adfind rule
|
2023-06-23 09:58:17 +02:00 |
|
|
Ryan Plas
|
563f5ce090
|
Fix Zero Networks Blog 404s
|
2023-06-22 17:16:46 -04:00 |
|
|
securepeacock
|
01d3701982
|
Update proc_creation_win_pua_adfind_susp_usage.yml
|
2023-06-22 17:11:08 -04:00 |
|
|
securepeacock
|
f8d399f054
|
Update proc_creation_win_curl_susp_download.yml
|
2023-06-22 11:53:22 -04:00 |
|
|
securepeacock
|
bd184a9a3d
|
Update win_security_iso_mount.yml
|
2023-06-22 09:52:25 -04:00 |
|
|
securepeacock
|
59a673586c
|
Update file_event_win_iso_file_mount.yml
|
2023-06-22 09:51:44 -04:00 |
|