002f3e5961
Merge PR #5485 from @gregorywychowaniec-zt - Update registry_set rules to add 64 bits Program Files directory in filters
...
fix: Common Autorun Keys Modification - add 64 bits Program Files directory in filter
fix: CurrentVersion Autorun Keys Modification - add 64 bits Program Files directory in filter
2025-06-16 13:42:00 +02:00
dfed136f16
Merge PR #5477 from @phantinuss - chore: update MITRE tag t1219 to t1219.002
...
chore: update MITRE tag t1219 to t1219.002
2025-06-13 10:00:52 +02:00
cc747ed2e9
Merge PR #5471 from @swachchhanda000 - feat: BadSuccessor Exploits Detection
...
new: HKTL - SharpSuccessor Privilege Escalation Tool Execution
update: Malicious PowerShell Scripts - FileCreation - Add BadSuccessor Exploit
update: Malicious PowerShell Scripts - PoshModule - Add BadSuccessor Exploit
update: Malicious PowerShell Commandlets - PoshModule - Add BadSuccessor Exploit
2025-06-12 12:51:36 +02:00
dca02df740
Merge PR #5243 from @xlazarg - System Information Discovery via Registry Queries
...
new: System Information Discovery via Registry Queries
---------
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2025-06-12 12:31:43 +02:00
d242edfd5e
Merge PR #5453 from @egycondor - DNS Query To Common Malware Hosting and Shortener Services
...
new: DNS Query To Common Malware Hosting and Shortener Services
---------
Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com >
2025-06-12 12:31:03 +02:00
d44c380d8c
Merge PR #5413 from @swachchhanda000 - feat: Mshta more susp extension added
...
update: MSHTA Execution with Suspicious File Extensions - title changed and more susp extension added
---------
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-06-11 11:30:31 +02:00
3183768be3
Merge PR #4901 from @frack113 - Regasm Without CommandLine
...
new: RegAsm.EXE Execution Without CommandLine Flags or Files
---------
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2025-06-11 11:25:56 +02:00
12d68aca19
Merge PR #5148 from @MalGamy12 - Update Suspicious Windows Defender Registry Key Tampering Via Reg.EXE
...
update: Suspicious Windows Defender Registry Key Tampering Via Reg.EXE - Increase coverage by adding new values that allow for Windows Defender to be disabled such as DisableCloudProtection and DisableSecurityCenter
---------
Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com >
2025-06-11 11:25:56 +02:00
fd62c55e47
Merge PR #5221 from @dan21san - MSSQL Destructive Query
...
new: MSSQL Destructive Query
---------
Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com >
2025-06-11 11:25:56 +02:00
8cfa4fbd1c
Merge PR #5225 from @swachchhanda000 - Lazagne rule update
...
update: HackTool - LaZagne Execution: filter added to reduce FP and added more coverage through imphash
---------
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-06-11 11:25:51 +02:00
d35b514a16
Merge PR #5412 from @swachchhanda000 - feat: add more susp registry modifications associated with feature change of windows internal tools
...
update: Disable Internal Tools or Feature in Registry - More registry modifications associated with feature change of windows internal tools added
---------
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-06-11 11:25:45 +02:00
3eb0198939
Merge PR #5445 from @swachchhanda000 - feat: add coverage for Unicode Space Character Obfuscation
...
update: Suspicious Double Extension Files: add more suspicious extension combination
update: Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image - add Unicode space character
update: Suspicious Double Extension File Execution: add more suspicious extension combination
---------
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-06-05 13:29:46 +02:00
dc9a998874
Merge PR #5465 from @nasbench - Update File Decoded From Base64/Hex Via Certutil.EXE
...
update: File Decoded From Base64/Hex Via Certutil.EXE - Increase level to `high`
2025-06-04 18:11:03 +02:00
8b07b7b9a4
Merge PR #5208 from @swachchhanda000 - Fix FPs and added coverage for ARM based windows dotnet paths
...
fix: Creation of an Executable by an Executable - Add filter for Windows Microsoft.NET ARM path
fix: Amsi.DLL Load By Uncommon Process - Add filter for Windows Microsoft.NET ARM path
fix: WMI Module Loaded By Uncommon Process - Add filter for Windows Microsoft.NET ARM path
fix: PowerShell Core DLL Loaded By Non PowerShell Process - Add filter for Windows Microsoft.NET ARM path
fix: Potential DLL Sideloading Of MsCorSvc.DLL - Add filter for Windows Microsoft.NET ARM path
fix: Suspicious WSMAN Provider Image Loads - Add filter for Windows Microsoft.NET ARM path
fix: AddinUtil.EXE Execution From Uncommon Directory - Add filter for Windows Microsoft.NET ARM path
fix: Potential System DLL Sideloading From Non System Locations - Add filter for "C:\Windows\SyChpe32\"
update: AspNetCompiler Execution - Add ARM version of the \Microsoft.NET path
update: Potentially Suspicious ASP.NET Compilation Via AspNetCompiler - Add ARM version of the \Microsoft.NET path
---------
Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com >
2025-06-04 17:44:31 +02:00
c2a5f405fe
Merge PR #5219 from @nikstuckenbrock - Update Potential PowerShell Obfuscation Via WCHAR/CHAR
...
update: Potential PowerShell Obfuscation Via WCHAR/CHAR - Add `CHAR` variation
---------
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2025-06-04 17:39:06 +02:00
3eaaa050b7
Merge PR #5452 from @david-syk - Update the MITRE ATT&CK tags for multiple rules
...
chore: update the MITRE ATT&CK tags for multiple rules
2025-06-04 14:39:25 +02:00
8e4e286b0b
Merge PR #5436 from @vx3r - Obfuscated PowerShell MSI Install via WindowsInstaller COM
...
new: Obfuscated PowerShell MSI Install via WindowsInstaller COM
---------
Co-authored-by: Meroujan.Antonyan <meroujan.antonyan.external@axa.com >
Co-authored-by: Mohamed Ashraf <47338567+X-Junior@users.noreply.github.com >
2025-06-04 13:50:39 +02:00
74fc1c74ec
Merge PR #5451 from @frack113 - chore: cleanup metadata
...
chore: 🧹 Remove redundant modified field
chore: 🧹 Use Mitre tags instead of url
chore: 🧹 Use permalink for github file reference
chore: 🧹 Order emerging-threats Exploits rules
2025-06-04 13:33:36 +02:00
ec827cccb6
Merge PR #5448 from @nasbench - Promote older rules status from experimental to test
...
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-06-02 13:29:48 +02:00
3054ad5d18
Merge PR #5440 from @gregorywychowaniec-zt - Add filter for local machine whithout IP
...
fix: MSSQL Server Failed Logon From External Network - filter for local_machine without IP
2025-05-31 13:14:46 +02:00
c96c031436
Merge PR #5407 from @joshnck - Suspicious Deno File Written from Remote Source
...
new: Suspicious Deno File Written from Remote Source
---------
Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com >
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2025-05-27 09:49:30 +02:00
7d493b41bb
Merge PR#5425 from @tsale - New Rule: Impacket File Indicators
...
new: HackTool - Impacket File Indicators
---------
Co-authored-by: Detections <Detections@thedfirreport.com >
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2025-05-27 09:45:15 +02:00
e8fbc4966d
Merge PR #5428 from @egycondor - AS-REP Roasting via Kerberos TGT Request
...
new: Potential AS-REP Roasting via Kerberos TGT Requests
---------
Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com >
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2025-05-26 10:50:14 +02:00
585bd7d487
Merge PR #5429 from @swachchhanda000 - Katz stealer malware
...
new: DNS Query To Katz Stealer Domains
new: Katz Stealer DLL Loaded
new: DNS Query To Katz Stealer Domains - Network
new: Katz Stealer Suspicious User-Agent
new: Suspicious File Access to Browser Credential Storage
new: Registry Export of Third-Party Credentials
update: Enumeration for 3rd Party Creds From CLI - Updated the condition to update FP
---------
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2025-05-26 10:33:24 +02:00
de7a1387b5
Merge PR #5417 from @jasonmull - Create Detection for Crash Dump Created By Operating System
...
new: Crash Dump Created By Operating System
---------
Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com >
2025-05-21 09:09:37 +02:00
6896d69d3e
Merge PR #5424 from @phantinuss - Some housekeeping
...
chore: deprecate rule in favour of c1337eb8-921a-4b59-855b-4ba188ddcc42
chore: update the ref of some rules
---------
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2025-05-20 23:12:55 +02:00
2076f5cfd6
Merge PR #5405 from @MalGamy12 - Update COM Object Hijacking Via Modification Of Default System CLSID Default Value
...
update: COM Object Hijacking Via Modification Of Default System CLSID Default Value - Add additional COM CLSID
2025-05-20 23:11:14 +02:00
6fe3ac8a02
Merge PR #5389 from @david-syk - Update MITRE ATT&CK tags
...
chore: update the tags of multiple rules
2025-05-20 23:09:50 +02:00
efcfe43fae
Merge PR #5388 from @david-syk - Update MITRE ATT&CK tags
...
chore: update the tags of multiple rules
2025-05-20 23:09:23 +02:00
f255ba29e6
Merge PR #5390 from @david-syk - Update MITRE ATT&CK tags
...
chore: update the tags of multiple rules
2025-05-20 23:08:57 +02:00
a869abc3cc
Merge PR #5395 from @david-syk - Update MITRE ATT&CK tags
...
chore: update the tags of multiple rules
2025-05-20 23:05:21 +02:00
926c05e2cd
Merge PR #5203 from @swachchhanda000 - Update AdFind rules
...
new: PUA - AdFind.EXE Execution
update: Renamed AdFind Execution - Add additional Imphash values
---------
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2025-05-20 23:03:13 +02:00
350fec2f51
Merge PR #5397 from @nasbench - Promote older rules status from experimental to test
...
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-05-20 22:58:46 +02:00
83b9ff50bc
Merge PR #5418 from @frack113 - chore: 🧹 Update MITRE V17 DLL tags
...
chore: Update MITRE T1574.002 as is now merge into T1574.001 in the V17
2025-05-15 12:17:10 +02:00
c0972b644d
Merge PR #5378 from @X-Junior - fix: FP related to Potentially Suspicious WDAC Policy File Creation
...
update: Potentially Suspicious WDAC Policy File Creation
2025-05-12 13:31:38 +02:00
906b392938
Merge PR #5196 from @swachchhanda000 - Updated and Added rules related to Autorun Registry
...
new: Suspicious Autorun Registry Modified via WMI
update: Suspicious PowerShell Invocations - Specific - PowerShell Module
update: Suspicious PowerShell Invocations - Specific
update: Potential Persistence Attempt Via Run Keys Using Reg.EXE
update: New RUN Key Pointing to Suspicious Folder
update: Suspicious Powershell In Registry Run Keys
update: Direct Autorun Keys Modification
update: Suspicious Run Key from Download
---------
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2025-05-12 13:28:51 +02:00
b062d8ad65
Merge PR #5380 from @david-syk - Update MITRE ATT&CK tags 2nd batch
2025-04-25 21:01:12 +02:00
95b6dd8573
Merge PR #5381 from @david-syk - Update MITRE ATT&CK tags
...
chore: update multiple mitre att&ck tags
2025-04-25 20:55:51 +02:00
07c285ca29
Merge PR #5265 form @tsale - Update Obfuscated PowerShell OneLiner Execution and author of multiple rules
...
update: Obfuscated PowerShell OneLiner Execution - Enhance logic to increase coverage.
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-04-17 21:42:17 +02:00
5d050fb8a5
Merge PR #5228 from @swachchhanda000 - Update Eventlog clearing related rules
...
update: Suspicious Eventlog Clear - Added coverage for eventlog clearing using dotnet class
update: Suspicious Eventlog Clearing or Configuration Change Activity- Added coverage for eventlog clearing using dotnet class
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-04-17 00:45:10 +02:00
ff4076fea1
Merge PR #5234 from @swachchhanda000 - Update Potential Product Class Reconnaissance Via Wmic.EXE
...
update: Potential Product Class Reconnaissance Via Wmic.EXE - Add `AntiSpywareProduct` class
2025-04-17 00:44:13 +02:00
75a1ff3915
Merge PR #5239 from @swachchhanda000 - Update Potential Browser Data Stealing
...
update: Potential Browser Data Stealing - add esentutl.exe
---------
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2025-04-17 00:43:26 +02:00
6143a22389
Merge PR #5240 from @swachchhanda000 - Add Suspicious LNK Command-Line Padding with Whitespace Characters
...
new: Suspicious LNK Command-Line Padding with Whitespace Characters
2025-04-17 00:42:11 +02:00
29ad6f9617
Merge PR #5249 from @nasbench - Promote older rules status from experimental to test
...
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-04-17 00:41:35 +02:00
1f1cac10eb
Merge PR #5258 from @david-syk - Update Potential Adplus.EXE Abuse tags
...
chore: update mitre attack tag
---------
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2025-04-17 00:40:41 +02:00
ced93a8d17
Merge PR #5264 from @swachchhanda000 - Update Potential Binary Impersonating Sysinternals Tools
...
update: Potential Binary Impersonating Sysinternals Tools - Add list of binaries compiled for Arm64 arch added
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2025-04-17 00:39:23 +02:00
fa27f1bc54
Merge PR #5224 from @swachchhanda000 - Fix Multiple FPs
...
update: Elevated System Shell Spawned - Add `powershell_ise`
fix: Potential Binary Or Script Dropper Via PowerShell - Add filter for `C:\Windows\SystemTemp\`
fix: Python Initiated Connection - Enhance python filter
fix: Conhost Spawned By Uncommon Parent Process - Add filter for `'-k wusvcs -p -s WaaSMedicSvc`
update: Elevated System Shell Spawned From Uncommon Parent Location - Add `powershell_ise`
fix: Potential WinAPI Calls Via CommandLine - Add new filter for `CompatTelRunner`
fix: Windows Processes Suspicious Parent Directory - Add new filter for empty parent
fix: Whoami.EXE Execution Anomaly - Add new filter for empty parent
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-04-07 11:05:53 +02:00
166af991c0
Merge PR #4886 from @frack113 - Add Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock
...
new: Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-04-07 11:02:17 +02:00
13b9a509d4
Merge PR #5198 from @DFIR-Detection - Add Notepad Password Files Discovery
...
new: Notepad Password Files Discovery
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-03-05 00:24:11 +01:00
64852d95a9
Merge PR #5216 from @nasbench - Promote older rules status from experimental to test
...
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-03-05 00:23:27 +01:00
Grégory Wychowaniec