3607cf878c
fix: FP with explorer.exe
2022-06-29 13:22:35 +02:00
afc3625791
Merge pull request #3161 from alexmcdonald1124/msra-injection
...
Msra.exe process injection rule
2022-06-29 06:30:00 +02:00
2da48f5052
Merge pull request #3167 from SigmaHQ/rule-devel
...
Rules: Bitsadmin coverage and minor improvements
2022-06-28 17:25:03 +02:00
991ff677c3
rule: bitsadmin coverage
2022-06-28 15:34:19 +02:00
6f26e26846
rules: bitsadmin coverage
2022-06-28 15:16:52 +02:00
f54f660efb
Merge pull request #3164 from pH-T/master
...
rule cleanup and new rules
2022-06-27 23:58:05 +02:00
d7f983340b
rule cleanup and new rules
2022-06-27 16:35:22 +02:00
ab5d2ed711
fix: FPs in testing environment
2022-06-27 08:47:27 +02:00
1b08ee7916
Update proc_creation_win_msra_process_injection.yml
2022-06-25 08:47:36 +02:00
e740cbcaa3
Including id number per the error reported in testing
2022-06-24 16:55:10 -04:00
fd1be59f55
New experimental rule designed to find process injection
2022-06-24 16:44:40 -04:00
d78818e27d
Merge pull request #3157 from d4rk-d4nph3/master
...
To account for SyncAppvPublishingServer bypass
2022-06-22 21:28:38 +02:00
cdfd908627
Merge branch 'master' into rule-devel
2022-06-22 21:16:29 +02:00
940e4149f7
fix: wrong rule title
2022-06-22 21:15:00 +02:00
7afe938d49
Fixed the missing all modifier
2022-06-22 15:14:39 +05:45
d9836d9fe4
Fixed my rule bug
2022-06-22 15:13:51 +05:45
f55e3451cf
Removed bypass for SyncAppvPublishingServer
2022-06-22 15:12:17 +05:45
a601ce4098
Merge pull request #3145 from frack113/chromeloader
...
Add proc_creation_win_chrome_load_extension
2022-06-22 10:26:07 +02:00
fedc465b00
Merge pull request #3155 from SigmaHQ/rule-devel
...
Linux - suspicious command lines
2022-06-22 10:25:42 +02:00
023306e09f
Added alternative cmd format
2022-06-22 10:16:39 +05:45
efbfc7fe67
New Rule ( https://twitter.com/nas_bench/status/1537919885031772161 )
2022-06-21 19:13:53 +01:00
e25ad42b5b
Reverted Rule + New Rule
2022-06-21 19:03:47 +01:00
0c2f1bfce5
Fix review comments
2022-06-21 17:22:39 +01:00
c2c25acbb6
docs: rules adjusted
2022-06-21 17:21:55 +02:00
f12f6e3646
Update ID's
2022-06-21 15:46:00 +01:00
7ecf771cb5
fix: rule that covers unrelated activity
2022-06-21 16:38:30 +02:00
27e73278e7
Update proc_creation_win_lolbin_findstr.yml
2022-06-21 15:37:39 +01:00
b2ce10ea2a
Update proc_creation_win_lolbin_findstr.yml
2022-06-21 15:36:21 +01:00
9fdf396314
Update proc_creation_win_chrome_load_extension.yml
2022-06-21 16:30:38 +02:00
e3bfb18f64
New Rules
2022-06-21 11:47:18 +01:00
62a7d755cc
Update proc_creation_win_service_stop.yml
...
Refactored the rule and added originalfilename
2022-06-21 11:46:32 +01:00
f2bc1be460
Update proc_creation_win_service_execution.yml
2022-06-21 11:46:06 +01:00
40ccd91a94
Update proc_creation_win_msdt_diagcab.yml
...
In my testing i found that ".diagcab" extension is not required. You can use .txt with the /cab flag and it'll spawn an msdt process.
Also I added the "-" (dash) version of the flag
2022-06-21 11:45:53 +01:00
d2ef62a49d
Update proc_creation_win_enumeration_for_credentials_in_registry.yml
2022-06-21 11:45:01 +01:00
4eb6b3509e
Update proc_creation_win_accesschk_usage_after_priv_escalation.yml
...
Changed the rule as the original was flagging on every usage of "accessChk" which was not the intended behaviour as described.
The modification take into consideration usage of the tool as seen in the referenced presentation and adds some more.
2022-06-21 11:44:51 +01:00
0a39827674
Renamed + Refactor "findstr" rule
2022-06-21 11:42:14 +01:00
9475153292
fix: FPs found in testing environment
2022-06-20 16:17:54 +02:00
50b2fad091
Merge branch 'master' into aurora-false-positive-fixing
2022-06-20 13:43:36 +02:00
72de90d2aa
fix: FPs
2022-06-20 12:52:23 +02:00
10e39e41f7
Merge pull request #3143 from SigmaHQ/rule-devel
...
Rule level refactoring: critical > high
2022-06-19 15:04:46 +02:00
87bad74ab1
Add proc_creation_win_chrome_load_extension
2022-06-19 09:34:07 +02:00
f728893364
refactor: rule level adjustments - critical to high
2022-06-18 17:43:22 +02:00
f84c1436a3
Add missing "contains" modifier
2022-06-17 14:06:14 +01:00
32c772d0df
Update proc_creation_win_lolbin_openconsole.yml
2022-06-16 23:41:57 +01:00
2ab106ddee
Small Update and New Rule
2022-06-16 23:37:50 +01:00
1eb02a0025
Update proc_creation_win_sysinternals_eula_accepted.yml
...
Description changed (original description was taken from registry_add_sysinternals_eula_accepted.yml).
2022-06-16 14:49:17 +08:00
bc94d575b7
Update proc_creation_win_susp_explorer_break_proctree.yml
2022-06-14 19:31:25 +01:00
3b7a405492
Update proc_creation_win_lolbin_forfiles.yml
2022-06-14 18:18:14 +01:00
7f75aceaf7
Update proc_creation_win_lolbin_pcalua.yml
2022-06-14 17:41:09 +01:00
f9bbe7e423
Update proc_creation_win_susp_explorer_break_proctree.yml
2022-06-14 17:40:01 +01:00
Florian Roth