 phantinuss
|
043747822f
|
fix: more falsepositives harmonization
|
2022-03-16 14:57:06 +01:00 |
|
|
phantinuss
|
6ae28b7a1c
|
fix: legitimate --> Legitimate
|
2022-03-16 14:35:19 +01:00 |
|
|
phantinuss
|
84d0c472ba
|
fix: remove penetration test as valid false positive reason
|
2022-03-16 14:33:18 +01:00 |
|
|
phantinuss
|
4585133325
|
fix: remove penetration testing as a valid false positive
|
2022-03-16 13:51:26 +01:00 |
|
|
phantinuss
|
b23eee6ebf
|
fix: unknown --> Unknown
|
2022-03-16 13:43:54 +01:00 |
|
|
frack113
|
c6d37d4a78
|
fix yaml
|
2022-03-08 19:14:46 +01:00 |
|
|
frack113
|
5938569d3e
|
Refactor regex
|
2022-03-08 19:07:37 +01:00 |
|
|
frack113
|
f9c0e21323
|
Refactor regex
|
2022-03-07 19:08:30 +01:00 |
|
|
Florian Roth
|
ec62ec6bbb
|
fix: values missed escaping
|
2022-03-05 10:39:15 +01:00 |
|
|
Florian Roth
|
e57b952455
|
Merge branch 'master' into rule-devel
|
2022-03-04 16:34:52 +01:00 |
|
|
Florian Roth
|
8012efa9b5
|
refactor: some adjustments
|
2022-03-04 16:34:15 +01:00 |
|
|
Florian Roth
|
eb06a6fdd1
|
Merge pull request #2764 from SigmaHQ/rule-devel
refactor: PowerShell Defender modifications
|
2022-03-03 23:29:08 +01:00 |
|
|
Florian Roth
|
b3b5b2cbdd
|
refactor: PowerShell Defender modifications
|
2022-03-03 13:53:06 +01:00 |
|
|
nNipsx
|
b43e37518e
|
update Author contribute
|
2022-03-03 14:34:13 +07:00 |
|
|
frack113
|
19ba2fe16c
|
Update posh_ps_detect_vm_env.yml
|
2022-03-03 08:12:01 +01:00 |
|
|
nNipsx
|
f57bb708bb
|
Update another command line of Get-WmiObject (gwmi)
|
2022-03-03 11:04:26 +07:00 |
|
|
phantinuss
|
8212b1a2ad
|
fix: FP
|
2022-02-23 17:18:53 +01:00 |
|
|
phantinuss
|
329b5aa0eb
|
fix: reduce level, many legitimate usages expected
|
2022-02-23 14:13:12 +01:00 |
|
|
Florian Roth
|
35d4c8bc69
|
fix: FPs noticed in THOR testing
|
2022-02-21 10:15:27 +01:00 |
|
|
phantinuss
|
12fffc5fd5
|
fix: more chocolatey FPs
|
2022-02-16 16:31:11 +01:00 |
|
|
frack113
|
7e3c088165
|
Windows Redcannary
|
2022-02-12 15:53:13 +01:00 |
|
|
phantinuss
|
646ce36809
|
fix: use doublequotes instead of ' because of ' in string
|
2022-02-11 16:52:45 +01:00 |
|
|
phantinuss
|
809f7abbb8
|
fix: several FPs against a fresh installed Windows with example applications and basic user interaction 3
|
2022-02-11 16:38:52 +01:00 |
|
|
Florian Roth
|
97dacc4ffc
|
refactor: increased level to medium
|
2022-02-06 14:17:38 +01:00 |
|
|
frack113
|
62611e0e39
|
add posh_ps_get_adreplaccount
|
2022-02-06 11:15:00 +01:00 |
|
|
frack113
|
2887cf2800
|
Merge pull request #2623 from frack113/red_t1555_003
Redcannary windows
|
2022-02-03 22:23:19 +01:00 |
|
|
frack113
|
d1268d040c
|
Change status and related
|
2022-02-03 06:53:50 +01:00 |
|
|
frack113
|
8eeadb9beb
|
Add other browser
|
2022-02-03 06:38:43 +01:00 |
|
|
Florian Roth
|
d2e741cf9a
|
Merge pull request #2628 from frack113/redcannay_t1553_005
Windows Redcannary T1553.005
|
2022-02-02 18:38:55 +01:00 |
|
|
phantinuss
|
65c3a72715
|
fix: used in legitimate microsoft scripts
|
2022-02-02 11:00:43 +01:00 |
|
|
frack113
|
3c0f4b79c9
|
Windows Redcannary T1553.005
|
2022-02-01 18:41:53 +01:00 |
|
|
frack113
|
0bcb842c70
|
Redcannary windows
|
2022-01-30 18:47:49 +01:00 |
|
|
frack113
|
1aa7697ca8
|
Update posh_ps_clear_powershell_history.yml
|
2022-01-27 16:16:57 +01:00 |
|
|
Florian Roth
|
d52602dd5e
|
Update posh_ps_clear_powershell_history.yml
|
2022-01-26 18:09:09 +01:00 |
|
|
Florian Roth
|
feedcee6bf
|
Update posh_ps_clear_powershell_history.yml
|
2022-01-26 17:57:26 +01:00 |
|
|
frack113
|
818b20b949
|
add posh_ps_clear_powershell_history
|
2022-01-25 19:58:18 +01:00 |
|
|
frack113
|
8a47c56397
|
Merge pull request #2595 from frack113/red_20220123b
Windows Redcannary
|
2022-01-25 06:21:17 +01:00 |
|
|
frack113
|
f1959f25d7
|
Windows Redcannary
|
2022-01-23 16:37:59 +01:00 |
|
|
frack113
|
1b8fa21be1
|
Fix space
|
2022-01-23 11:40:35 +01:00 |
|
|
frack113
|
90334e7f7c
|
Redcannary windows test
|
2022-01-23 11:37:01 +01:00 |
|
|
frack113
|
caa4c7f977
|
Add Redcannary Windows Rules
|
2022-01-19 20:40:43 +01:00 |
|
|
frack113
|
4631d0c482
|
remove invalid tag
|
2022-01-19 18:23:30 +01:00 |
|
|
frack113
|
3ec9f6d252
|
Merge pull request #2569 from frack113/red_20220116
Windows Redcannary defense_evasion
|
2022-01-17 06:36:41 +01:00 |
|
|
frack113
|
fc7485a07c
|
Merge pull request #2567 from frack113/red_20220115
Windows Redcannary
|
2022-01-17 06:35:49 +01:00 |
|
|
frack113
|
12f0d6dfab
|
Windows Redcannary
|
2022-01-16 14:47:56 +01:00 |
|
|
frack113
|
cb938c14df
|
Windows Redcannary
|
2022-01-15 17:04:03 +01:00 |
|
|
frack113
|
65a268b0b3
|
Rename powershell_script
|
2022-01-15 10:54:21 +01:00 |
|
|
frack113
|
f4c6871b50
|
Merge pull request #2554 from frack113/red_2022012
Windows Redcannary
|
2022-01-13 22:26:48 +01:00 |
|
|
frack113
|
592485fac5
|
Windows Redcannary
|
2022-01-12 20:27:56 +01:00 |
|
|
phantinuss
|
b6d4e39538
|
feat: check for the existence of a description field
it is not mandatory in the sigma standard but
mandatory for this repository
|
2022-01-12 12:55:49 +01:00 |
|