 Liam Sennitt
|
aee0d1dd67
|
fix tags on apt29 tor rule
|
2019-03-13 09:25:28 +00:00 |
|
|
Liam Sennitt
|
5dc229b590
|
add tags to apt29 thinktanks rule
|
2019-03-13 09:22:41 +00:00 |
|
|
Florian Roth
|
95b47972f0
|
fix: transformed rule to new proc_creation format
|
2019-03-12 09:03:30 +01:00 |
|
|
Florian Roth
|
c4003ff410
|
Merge pull request #264 from darkquasar/master
adding rule win-susp-mshta-execution.yml
|
2019-03-11 23:50:56 +01:00 |
|
|
Florian Roth
|
bd38cff042
|
Merge pull request #272 from LiamSennitt/master
fix tagging in turla png dropper service rule
|
2019-03-11 23:48:18 +01:00 |
|
|
Florian Roth
|
909c09f4ac
|
Merge pull request #282 from krakow2600/master
updated detection logic
|
2019-03-11 23:47:53 +01:00 |
|
|
Yugoslavskiy Daniil
|
5d54e9c8a1
|
nbstat.exe -> nbtstat.exe
|
2019-03-11 19:28:29 +01:00 |
|
|
Yugoslavskiy Daniil
|
c22265c655
|
updated detection logic
|
2019-03-11 16:58:57 +01:00 |
|
|
Florian Roth
|
8dd39a2653
|
Merge pull request #281 from TareqAlKhatib/oops
Migrated the last detections to process_creation
|
2019-03-09 19:40:25 +01:00 |
|
|
Tareq AlKhatib
|
783d8c4268
|
Reverting back to regular Sysmon 1 to fix CI test
|
2019-03-09 21:31:56 +03:00 |
|
|
Tareq AlKhatib
|
7f4557d183
|
Enabled check for process_creation
|
2019-03-09 21:00:11 +03:00 |
|
|
Tareq AlKhatib
|
075df83118
|
Converted to use the new process_creation data source
|
2019-03-09 20:57:59 +03:00 |
|
|
Tareq AlKhatib
|
c3b079990a
|
Properly end anchored the regex
|
2019-03-09 19:23:50 +03:00 |
|
|
Florian Roth
|
361f2ffa5f
|
Product Support - RANK VASA
|
2019-03-08 16:32:22 +01:00 |
|
|
Florian Roth
|
fe9e50167f
|
Rule: renamed bitsadmin rule
|
2019-03-08 16:25:16 +01:00 |
|
|
Florian Roth
|
49532438eb
|
Rule: Bitsadmin wot uncommon TLD
|
2019-03-08 16:20:10 +01:00 |
|
|
Thomas Patzke
|
082ee586bf
|
Merge branch 'christophetd-elastalert-alert-types'
|
2019-03-08 00:05:08 +01:00 |
|
|
Thomas Patzke
|
6d97c6d0bb
|
Extended elastalert CI testing
|
2019-03-08 00:04:43 +01:00 |
|
|
Thomas Patzke
|
a429f09cc1
|
Merge branch 'elastalert-alert-types' of https://github.com/christophetd/sigma into christophetd-elastalert-alert-types
|
2019-03-07 23:54:05 +01:00 |
|
|
Thomas Patzke
|
3c1948f089
|
Merge pull request #277 from megan201296/patch-18
Remove invalid link
|
2019-03-07 23:49:13 +01:00 |
|
|
Thomas Patzke
|
c235944a0c
|
Merge pull request #278 from krakow2600/master
fixed incorrect date format
|
2019-03-07 23:46:12 +01:00 |
|
|
Yugoslavskiy Daniil
|
475113b1c1
|
fixed incorrect date format
|
2019-03-07 22:52:11 +01:00 |
|
|
megan201296
|
c2a16591af
|
Remove invalid link
Cybereason link was broken. Couldn't find anything with a super similar file path. The below link might be a valid replacement but went better safe than sorry and just removed it completely. https://www.cybereason.com/hubfs/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty-Part1.pdf
|
2019-03-07 14:22:29 -06:00 |
|
|
Florian Roth
|
a82ea0a022
|
Merge pull request #276 from krakow2600/master
ATC windows rules review
|
2019-03-06 17:16:32 +01:00 |
|
|
Florian Roth
|
83c0c71bc7
|
Reworked for process_creation rules
|
2019-03-06 17:09:43 +01:00 |
|
|
Florian Roth
|
d7c25adfb6
|
Merge pull request #274 from TareqAlKhatib/multifile_yamls
Updated to use the new process_creation logsource
|
2019-03-06 17:06:04 +01:00 |
|
|
Yugoslavskiy Daniil
|
cb7243de5d
|
fixed wrong tags
|
2019-03-06 06:18:38 +01:00 |
|
|
Yugoslavskiy Daniil
|
8bec627ff1
|
fixed multiple tags issue
|
2019-03-06 06:09:37 +01:00 |
|
|
Yugoslavskiy Daniil
|
5154460726
|
changed service to product
|
2019-03-06 05:57:01 +01:00 |
|
|
Yugoslavskiy Daniil
|
05cc7e455d
|
atc review
|
2019-03-06 05:25:12 +01:00 |
|
|
yugoslavskiy
|
725ab99e90
|
Merge pull request #1 from AverageS/master
Fix rules
|
2019-03-06 04:31:01 +01:00 |
|
|
Wydra Mateusz
|
534f250c35
|
Merge branch 'master' of https://github.com/krakow2600/sigma
|
2019-03-06 00:45:16 +01:00 |
|
|
Wydra Mateusz
|
bb95347745
|
rules update
|
2019-03-06 00:43:42 +01:00 |
|
|
mrblacyk
|
6232362f04
|
Missing tags
|
2019-03-06 00:16:40 +01:00 |
|
|
mrblacyk
|
07807837ee
|
Missing tags
|
2019-03-06 00:02:37 +01:00 |
|
|
mikhail
|
be108d95cc
|
Merge branch 'master' of https://github.com/AverageS/sigma
|
2019-03-06 01:57:38 +03:00 |
|
|
mikhail
|
40241c1fdf
|
Fix 4 rules
|
2019-03-06 01:56:05 +03:00 |
|
|
mrblacyk
|
99595a7f89
|
Added missing tags and some minor improvements
|
2019-03-05 23:25:49 +01:00 |
|
|
Tareq AlKhatib
|
879017818f
|
More conversions to the new process_creation logsource
|
2019-03-05 09:46:53 +03:00 |
|
|
Tareq AlKhatib
|
b2952b9f78
|
Fixing failed CI build - take 2
|
2019-03-04 16:51:39 +03:00 |
|
|
Tareq AlKhatib
|
c8be6e649b
|
Fixing failed CI build
|
2019-03-04 16:44:30 +03:00 |
|
|
Tareq AlKhatib
|
45458121c6
|
Updated to use the new process_creation logsource
|
2019-03-04 16:13:27 +03:00 |
|
|
Florian Roth
|
ae1541242c
|
New custom suspicious TLD in rule ".pw"
|
2019-03-03 10:58:12 +01:00 |
|
|
Thomas Patzke
|
17e9729ddd
|
Merge pull request #273 from TareqAlKhatib/process_create
Process create
|
2019-03-02 21:57:59 +01:00 |
|
|
Tareq AlKhatib
|
58c61430a2
|
updated to use process_creation
|
2019-03-02 21:05:15 +03:00 |
|
|
Tareq AlKhatib
|
be2ca8dc4d
|
Added checks for Sysmon 1 or EID 4688 instead of process_creation
|
2019-03-02 20:51:49 +03:00 |
|
|
Florian Roth
|
33e490e4fa
|
Titles in Examples
|
2019-03-02 12:23:44 +01:00 |
|
|
Florian Roth
|
7b3d67ae66
|
fix: bugfix in new proc creation rule
|
2019-03-02 11:28:13 +01:00 |
|
|
Florian Roth
|
9a3ceb8421
|
Sigmac Usage Examples
|
2019-03-02 10:58:02 +01:00 |
|
|
Liam Sennitt
|
bef5f03015
|
fix tagging in turla png dropper service rule
|
2019-03-02 09:01:00 +00:00 |
|