 Tim Shelton
|
bc40160444
|
fixing more yaml lint complaints
|
2022-02-10 00:00:03 +00:00 |
|
|
Tim Shelton
|
a72f843081
|
i think the yaml is angry
|
2022-02-09 23:50:07 +00:00 |
|
|
Tim Shelton
|
2ce7d60729
|
splitting up filters
|
2022-02-09 23:46:07 +00:00 |
|
|
Florian Roth
|
11af922740
|
Update win_file_permission_modifications.yml
|
2022-02-09 23:17:32 +01:00 |
|
|
Tim Shelton
|
ae2c0f0a7f
|
fixing test
|
2022-02-09 21:26:43 +00:00 |
|
|
Tim Shelton
|
d48b6beaf5
|
Filtering fp of dynatrace behavior
|
2022-02-09 20:24:59 +00:00 |
|
|
Florian Roth
|
ef23efa60f
|
Merge pull request #2668 from SigmaHQ/rule-devel
rule: suspicious execution from suspicious folders
|
2022-02-08 19:14:23 +01:00 |
|
|
Florian Roth
|
3e0f45d11e
|
rule: suspicious execution from temp folders
|
2022-02-08 16:15:46 +01:00 |
|
|
Florian Roth
|
93767430fa
|
Merge pull request #2666 from SigmaHQ/rule-devel
Network Recon Activity : nslookup _ldap._tcp.dc._msdcs
|
2022-02-08 13:30:32 +01:00 |
|
|
Florian Roth
|
ed06403d04
|
fix: unneeded list
|
2022-02-08 12:21:43 +01:00 |
|
|
Florian Roth
|
9bc8bb5c20
|
fix: remove old link to removed part of rule
|
2022-02-08 09:36:31 +01:00 |
|
|
Florian Roth
|
88ce0ed97d
|
rule: Network Reconnaissance Activity
|
2022-02-08 09:36:03 +01:00 |
|
|
Florian Roth
|
7e17c2bbd2
|
Merge pull request #2658 from Karneades/patch-1
rule: ACTINIUM Scheduled Task Persistence
|
2022-02-07 21:20:22 +01:00 |
|
|
Tim Shelton
|
f3ce179f76
|
fixing false positive when loading the powershell function Convert-GuidToCompressedGuid
|
2022-02-07 17:10:57 +00:00 |
|
|
Florian Roth
|
aef0bd2a2d
|
Update process_creation_apt_actinium_persistence.yml
|
2022-02-07 16:15:48 +01:00 |
|
|
Andreas Hunkeler
|
40411f0596
|
Fix list issue in new wscript persistence rule
|
2022-02-07 15:54:42 +01:00 |
|
|
Andreas Hunkeler
|
0a78c3966b
|
rule: ACTINIUM Scheduled Task Persistence
|
2022-02-07 15:43:30 +01:00 |
|
|
Florian Roth
|
094215a7e0
|
Update win_pc_embed_exe_lnk.yml
|
2022-02-06 14:20:30 +01:00 |
|
|
frack113
|
f1f38a2df4
|
add win_pc_embed_exe_lnk
|
2022-02-06 14:01:48 +01:00 |
|
|
frack113
|
ebd09793d7
|
Merge pull request #2643 from elhoim/patch-1
Avoiding being too narrow for paths
|
2022-02-05 12:03:46 +01:00 |
|
|
Florian Roth
|
8dc0835b2a
|
Update win_pc_redirect_to_stream.yml
|
2022-02-04 23:18:08 +01:00 |
|
|
Florian Roth
|
affd73506d
|
Update win_pc_susp_instalutil.yml
|
2022-02-04 23:16:05 +01:00 |
|
|
David André
|
391d73a2c2
|
Avoiding being too narrow for paths
InstallUtil.exe is also available under 32 bits path for .net framework
|
2022-02-04 21:08:47 +01:00 |
|
|
frack113
|
16fed13bb0
|
Order files
|
2022-02-04 10:52:55 +01:00 |
|
|
frack113
|
2887cf2800
|
Merge pull request #2623 from frack113/red_t1555_003
Redcannary windows
|
2022-02-03 22:23:19 +01:00 |
|
|
Florian Roth
|
20a7bad5d8
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-02-02 20:40:21 +01:00 |
|
|
Florian Roth
|
885651efae
|
fix: FPs noticed with Aurora
|
2022-02-02 20:39:47 +01:00 |
|
|
Florian Roth
|
ef955b92ae
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-02-02 13:49:23 +01:00 |
|
|
Florian Roth
|
cb8a0a6e73
|
Revert "fix: FPs with GoogleDrive update"
This reverts commit 86f3302a33.
|
2022-02-02 13:49:06 +01:00 |
|
|
phantinuss
|
b627c62fe8
|
fix: filter out googledrivesync.exe FP
|
2022-02-02 12:25:55 +01:00 |
|
|
Florian Roth
|
86f3302a33
|
fix: FPs with GoogleDrive update
|
2022-02-02 11:45:42 +01:00 |
|
|
phantinuss
|
a22d57fc87
|
fix: rename filter
|
2022-02-02 11:12:39 +01:00 |
|
|
phantinuss
|
2d36c6222d
|
fix: FPs found in prod environment
|
2022-02-02 11:03:19 +01:00 |
|
|
Florian Roth
|
f357c73554
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-02-01 19:50:21 +01:00 |
|
|
Florian Roth
|
9fc06fb027
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-02-01 15:57:20 +01:00 |
|
|
Florian Roth
|
6efa5da3dc
|
fix: unescaped double back slashes
|
2022-02-01 15:57:15 +01:00 |
|
|
Florian Roth
|
926f9b588c
|
Merge pull request #2605 from securepeacock/patch-9
Rundll32 From Abnormal Drive
|
2022-01-31 16:38:46 +01:00 |
|
|
Florian Roth
|
fb44e9ae56
|
Update process_creation_rundll32_not_from_c_drive.yml
|
2022-01-30 21:48:57 +01:00 |
|
|
frack113
|
0bcb842c70
|
Redcannary windows
|
2022-01-30 18:47:49 +01:00 |
|
|
Florian Roth
|
642b3748fe
|
Merge pull request #2615 from frack113/redcannary_20220128
Add windows redcannary rules
|
2022-01-29 15:25:40 +01:00 |
|
|
Florian Roth
|
56fba15638
|
Update process_creation_tool_nircmd.yml
|
2022-01-28 23:14:17 +01:00 |
|
|
Florian Roth
|
34c8de908d
|
Update process_creation_tool_nircmd_as_system.yml
|
2022-01-28 23:08:41 +01:00 |
|
|
Nasreddine Bencherchali
|
6f96372ece
|
Update process_creation_tool_nircmd_as_system.yml
|
2022-01-28 21:10:52 +01:00 |
|
|
Nasreddine Bencherchali
|
b0b9d32dfa
|
Update process_creation_tool_nircmd.yml
|
2022-01-28 21:10:03 +01:00 |
|
|
Nasreddine Bencherchali
|
0b09dbdcd1
|
Update process_creation_tool_nircmd_as_system.yml
|
2022-01-28 21:01:43 +01:00 |
|
|
Florian Roth
|
0391cffab4
|
Merge pull request #2616 from SigmaHQ/rule-devel
rule: xordump
|
2022-01-28 18:06:21 +01:00 |
|
|
Florian Roth
|
bfee0f8067
|
rule: xordump
|
2022-01-28 17:26:12 +01:00 |
|
|
frack113
|
5b30db61b0
|
Add windows redcannary rules
|
2022-01-28 16:12:38 +01:00 |
|
|
Florian Roth
|
a5cb3ba37f
|
Merge pull request #2598 from SigmaHQ/rule-devel
rules: NirCmd, NSudo, RunX
|
2022-01-28 12:18:15 +01:00 |
|
|
frack113
|
9a517bae7c
|
Merge pull request #2614 from frack113/update_ref
sysmon_proxy_execution_wuauclt Update References
|
2022-01-28 11:51:45 +01:00 |
|