52595de85e
Merge pull request #1889 from rachelrice/update_aws_rules
...
Update AWS CloudTrail rules
2021-08-23 11:14:31 +02:00
07a87aa7f8
Merge pull request #1858 from frack113/fix_pr718
...
Replace pr718
2021-08-21 18:02:30 +02:00
dbbb422a42
Merge pull request #1885 from austinsonger/microsoft365_unusual_volume_of_file_deletion.yml
...
microsoft365_unusual_volume_of_file_deletion.yml
2021-08-20 17:20:43 +02:00
34ac3587e9
Merge pull request #1884 from austinsonger/microsoft365_potential_ransomware_activity.yml
...
microsoft365_potential_ransomware_activity.yml
2021-08-20 17:20:34 +02:00
73fee68d4b
Merge pull request #1883 from austinsonger/microsoft365_user_restricted_from_sending_email.yml
...
microsoft365_user_restricted_from_sending_email.yml
2021-08-20 17:20:22 +02:00
b9a355e3f4
cleanup falsepositives
2021-08-20 17:18:32 +02:00
b92346ba5f
Merge pull request #1882 from austinsonger/win_susp_bitstransfer.yml
...
win_susp_bitstransfer.yml
2021-08-20 16:53:52 +02:00
f037f5b0a9
Add filter3 back for vm export failure, without consolelogin
...
Signed-off-by: Rachel Rice <rachel.rice@lacework.net >
2021-08-20 15:42:49 +01:00
a25f6e196f
Update microsoft365_unusual_volume_of_file_deletion.yml
2021-08-20 08:17:25 -05:00
360b936357
Update microsoft365_potential_ransomware_activity.yml
2021-08-20 08:17:09 -05:00
ae36804935
Update microsoft365_user_restricted_from_sending_email.yml
2021-08-20 08:16:48 -05:00
f09b3ea4b1
Update AWS CloudTrail rules
...
aws_ec2_disable_encryption.yml
Remove `status: success` from selection criteria, not required
aws_ec2_vm_export_failure.yml
Remove filter3:
```
eventName: 'ConsoleLogin'
responseElements|contains: 'Failure'
```
Incompatible with selection criteria `eventName: 'CreateInstanceExportTask'`
aws_ec2_download_userdata.yml, aws_iam_backdoor_users_keys.yml, aws_rds_change_master_password.yml, aws_rds_public_db_restore.yml
Update reference
aws_sts_assumedrole_misuse.yml
Rename to aws_sts_assumerole_misuse.yml
Update references to "AssumedRole" to "AssumeRole"
Update selection criteria of `userIdentity.sessionContext: Role` to `userIdentity.sessionContext.sessionIssuer.type: Role`
2021-08-20 13:43:00 +01:00
4e29dc9c45
fix title
2021-08-20 09:06:16 +02:00
9b106dcc7d
Merge pull request #1880 from austinsonger/azure_suppression_rule_created.yml
...
azure_suppression_rule_created.yml
2021-08-20 09:04:48 +02:00
d58b1e8e40
Merge pull request #1879 from austinsonger/azure_application_gateway_modified_or_deleted.yml
...
azure_application_gateway_modified_or_deleted.yml
2021-08-20 09:03:57 +02:00
4b08aac47f
Merge pull request #1878 from austinsonger/azure_application_security_group_modified_or_deleted.yml
...
azure_application_security_group_modified_or_deleted.yml
2021-08-20 09:01:39 +02:00
853c2eb41d
Update microsoft365_potential_ransomware_activity.yml
2021-08-20 01:19:01 -05:00
f745593e80
Update microsoft365_potential_ransomware_activity.yml
2021-08-20 00:33:42 -05:00
42fbc0cbfc
Update aws_eks_cluster_created_or_deleted.yml
2021-08-19 23:13:35 -05:00
bcb43cf728
Update aws_eks_cluster_created_or_deleted.yml
2021-08-19 23:13:06 -05:00
b89910a38a
Update aws_eks_cluster_created_or_deleted.yml
2021-08-19 23:09:38 -05:00
f882ebda35
fix status
2021-08-20 06:08:28 +02:00
54bda90685
Create microsoft365_user_restricted_from_sending_email.yml
2021-08-19 23:08:25 -05:00
9b19190ea7
Create microsoft365_potential_ransomware_activity.yml
2021-08-19 23:05:05 -05:00
99fbd4ef44
Create microsoft365_unusual_volume_of_file_deletion.yml
2021-08-19 23:00:23 -05:00
810aae5ddd
Update aws_eks_cluster_created_or_deleted.yml
2021-08-19 21:58:36 -05:00
0a3e57cc12
Update
2021-08-20 02:10:32 +00:00
842ade16be
Forgot to add my username to some of the rules.
2021-08-20 02:09:31 +00:00
9a83836070
Update aws_eks_cluster_created_or_deleted.yml
2021-08-19 21:00:36 -05:00
6ae62488b3
Merge branch 'SigmaHQ:master' into azure_application_gateway_modified_or_deleted.yml
2021-08-19 20:32:35 -05:00
d2f87feb7b
Merge branch 'SigmaHQ:master' into azure_application_security_group_modified_or_deleted.yml
2021-08-19 20:31:48 -05:00
0103b148f7
Merge pull request #1876 from rachelrice/update_cloudtrail_rules
...
Update AWS CloudTrail rules
2021-08-19 18:33:07 +02:00
39617c9807
Merge pull request #1865 from austinsonger/azure_keyvault_secrets_modified_or_deleted.yml
...
add azure_keyvault_secrets_modified_or_deleted.yml
2021-08-19 17:06:28 +02:00
cc51e054e3
Update azure_keyvault_secrets_modified_or_deleted.yml
2021-08-19 09:04:22 -05:00
67020bb0ff
Update AWS CloudTrail rules
...
aws_elasticache_security_group_created.yml
aws_elasticache_security_group_modified_or_deleted.yml
Removed spaces from eventNames
aws_s3_data_management_tampering.yml
Fix typo in title, use s3 as eventSource
aws_snapshot_backup_exfiltration.yml
Use ec2 as eventSource
2021-08-19 14:24:43 +01:00
36406d5781
Fixed Spelling
2021-08-18 18:53:28 +00:00
c7d697e720
Merge pull request #1864 from austinsonger/azure_key_vault_modified_or_deleted.yml
...
azure_keyvault_modified_or_deleted.yml
2021-08-18 18:30:20 +02:00
309e71491b
Update azure_keyvault_key_modified_or_deleted.yml
2021-08-17 08:44:39 -05:00
23d0477120
Update azure_keyvault_secrets_modified_or_deleted.yml
2021-08-17 08:42:41 -05:00
16e0def41d
Update and rename azure_vault_key_modified_or_deleted.yml to azure_keyvault_key_modified_or_deleted.yml
2021-08-17 08:31:22 -05:00
ecdcd8f843
Rename azure_key_vault_modified_or_deleted.yml to azure_keyvault_modified_or_deleted.yml
2021-08-17 08:30:10 -05:00
49ab7d7bb6
Merge branch 'SigmaHQ:master' into azure_application_gateway_modified_or_deleted.yml
2021-08-17 08:29:18 -05:00
9986515b59
Update azure_suppression_rule_created.yml
2021-08-17 00:04:11 -05:00
84e96d5b4f
Create azure_suppression_rule_created.yml
2021-08-17 00:04:00 -05:00
1fcc1701b7
Create azure_keyvault_secrets_modified_or_deleted.yml
2021-08-16 23:54:57 -05:00
7abceb07ce
Create azure_vault_key_modified_or_deleted.yml
2021-08-16 23:50:56 -05:00
758293e2f9
Delete azure_application_security_group_modified_or_deleted.yml
2021-08-16 23:42:15 -05:00
824d64a9ce
Create azure_key_vault_modified_or_deleted.yml
2021-08-16 23:41:43 -05:00
3c8f27ba76
Create azure_application_security_group_modified_or_deleted.yml
2021-08-16 23:31:45 -05:00
144cfcb016
Create azure_application_gateway_modified_or_deleted.yml
2021-08-16 23:30:30 -05:00
frack113