 Florian Roth
|
c07a9adb9b
|
fix: moved rule written for DNS/Sysmon to the correct folder
|
2021-11-09 17:30:15 +01:00 |
|
|
Florian Roth
|
39283c0ac2
|
CobaltStrike DNS rules
|
2021-11-09 17:29:43 +01:00 |
|
|
Florian Roth
|
37b9abd827
|
fix: date field
|
2021-11-09 16:52:19 +01:00 |
|
|
Florian Roth
|
77e9decc64
|
Merge branch 'master' into rule-devel
|
2021-11-09 16:45:49 +01:00 |
|
|
Florian Roth
|
c61ca81d9c
|
refactor: raw disk access rule FPs
|
2021-11-09 16:15:31 +01:00 |
|
|
frack113
|
73e2b5fae6
|
Merge pull request #2233 from frack113/zipexec
Add win_pc_susp_zipexec
|
2021-11-08 22:46:17 +01:00 |
|
|
frack113
|
3e670a876f
|
Merge pull request #2232 from frack113/fix_sysmon_rule
fix logsources
|
2021-11-08 21:28:44 +01:00 |
|
|
frack113
|
d3c3cd9930
|
Merge pull request #2230 from frack113/process_creation_clean
Process creation directory clean
|
2021-11-08 21:27:25 +01:00 |
|
|
Florian Roth
|
3f57251768
|
Merge branch 'master' into rule-devel
|
2021-11-08 11:46:35 +01:00 |
|
|
Florian Roth
|
d43f845157
|
Update proxy_cobalt_malformed_uas.yml
|
2021-11-08 11:21:49 +01:00 |
|
|
Florian Roth
|
20f4099cec
|
rule: Kirbi file creation
|
2021-11-08 11:21:40 +01:00 |
|
|
frack113
|
4672762010
|
add win_pc_susp_zipexec
|
2021-11-07 21:57:40 +01:00 |
|
|
frack113
|
e51dab10c2
|
fix logsources
|
2021-11-07 09:55:02 +01:00 |
|
|
frack113
|
aa8694fdef
|
add missing category
|
2021-11-06 10:17:12 +01:00 |
|
|
frack113
|
68d30293b5
|
Cleanup process_creation
|
2021-11-06 10:16:16 +01:00 |
|
|
frack113
|
a3f3ec84c9
|
fix product windows case
|
2021-11-05 13:16:24 +01:00 |
|
|
frack113
|
80d2aee944
|
Merge pull request #2227 from redsand/remove_duplicate_powershell_check
Removing duplicate rule of Powershell memory check
|
2021-11-05 11:15:38 +01:00 |
|
|
frack113
|
3416db7301
|
Merge pull request #2225 from frack113/cmdl32
add win_pc_susp_cmdl32_lolbas
|
2021-11-04 20:58:50 +01:00 |
|
|
frack113
|
a811acde00
|
Merge pull request #2224 from frack113/schtasks_appdata
add win_pc_susp_schtasks_user_temp
|
2021-11-04 20:58:31 +01:00 |
|
|
Tim Shelton
|
dda204bd51
|
updating yaml
|
2021-11-04 18:56:07 +00:00 |
|
|
Tim Shelton
|
e266491f0a
|
adding obsoletes tags
|
2021-11-04 18:36:55 +00:00 |
|
|
frack113
|
e058e56c22
|
fix unknown
|
2021-11-04 18:07:16 +01:00 |
|
|
Tim Shelton
|
1ae596b634
|
removing rule 867613fb-fa60-4497-a017-a82df74a172c . this is a duplicate of 092bc4b9-3d1d-43b4-a6b4-8c8acd83522f and does not contain an allow list of known processes.
|
2021-11-04 17:07:00 +00:00 |
|
|
frack113
|
5506b1c566
|
add OriginalFileName
|
2021-11-04 13:42:04 +01:00 |
|
|
frack113
|
edb1458791
|
add win_pc_susp_cmdl32_lolbas
|
2021-11-03 20:45:21 +01:00 |
|
|
frack113
|
be6186fa1c
|
Forget the Local
|
2021-11-03 17:01:34 +01:00 |
|
|
frack113
|
5a4db26ec7
|
add win_pc_susp_schtasks_user_temp
|
2021-11-03 15:14:34 +01:00 |
|
|
zakibro
|
30f13d41f5
|
Update lnx_auditd_load_module_insmod.yml
fixing missing date
|
2021-11-02 17:16:59 +01:00 |
|
|
Pawel Mazur
|
dd7817917c
|
Linux - Auditd - Loading of Kernel Module via Insmod rule
|
2021-11-02 17:04:39 +01:00 |
|
|
frack113
|
eb9428ff6a
|
Merge pull request #2221 from skirankumar/master
Added another application
|
2021-11-02 16:28:33 +01:00 |
|
|
S.kiran kumar
|
802cdb0189
|
Added another application
|
2021-11-01 21:41:57 +05:30 |
|
|
frack113
|
2a2bfab06e
|
add win_pc_set_policies_to_unsecure_level
|
2021-11-01 15:35:46 +01:00 |
|
|
frack113
|
fb750721b2
|
Merge pull request #2212 from frack113/new_status
New status from discussions
|
2021-10-31 20:38:28 +01:00 |
|
|
frack113
|
eb242fba28
|
Merge pull request #2214 from elhoim/patch-1
Adding multiple named pipes
|
2021-10-31 07:44:31 +01:00 |
|
|
frack113
|
9f7d4a832e
|
Update sysmon_mal_namedpipes.yml
|
2021-10-31 07:03:27 +01:00 |
|
|
frack113
|
21654923be
|
Merge pull request #2218 from frack113/malware_run
add user temp folder
|
2021-10-31 07:01:10 +01:00 |
|
|
frack113
|
eba2f3b68f
|
add temp folder
|
2021-10-30 17:28:07 +02:00 |
|
|
David André
|
0de88e2f30
|
Added four other named pipes and corrected one missing slash
|
2021-10-29 16:33:07 +02:00 |
|
|
David André
|
8c57d29561
|
Added turla hyperstack named pipe
|
2021-10-29 15:49:04 +02:00 |
|
|
frack113
|
bcdf13c680
|
Merge pull request #2213 from frack113/fix_rule
Fix detection file_event_mal_vhd_download.yml
|
2021-10-29 12:26:06 +02:00 |
|
|
Florian Roth
|
f0dd02f483
|
fix: FPs with Failed Logon Reason rule
|
2021-10-29 10:25:27 +02:00 |
|
|
phantinuss
|
4b18d5e45c
|
chore: set status to test
|
2021-10-29 09:57:19 +02:00 |
|
|
frack113
|
ef0f836a71
|
Fix detection
|
2021-10-29 08:21:41 +02:00 |
|
|
frack113
|
c49b0d49fa
|
Add deprecated status
|
2021-10-28 20:08:27 +02:00 |
|
|
phantinuss
|
6fb27eeb76
|
fix: fix FPs found in production environment
|
2021-10-28 13:32:15 +02:00 |
|
|
frack113
|
8b86a79ef0
|
Merge pull request #2206 from frack113/order
Move rules to correct directory
|
2021-10-28 06:26:45 +02:00 |
|
|
frack113
|
d91eb0d0c0
|
Merge pull request #2204 from phantinuss/newrules
New Rule: windows commandline path obfuscation
|
2021-10-28 06:25:52 +02:00 |
|
|
frack113
|
957ba042f0
|
Merge pull request #2203 from OTRF/feature/Sysmon-v1330-Rules
Unsupported rules now possible with Sysmonv13.30
|
2021-10-28 06:25:35 +02:00 |
|
|
Roberto Rodriguez
|
7543b3e2a6
|
added definition to Sysmon 13.30 rule for priv escalation
|
2021-10-27 11:56:19 -04:00 |
|
|
frack113
|
c228cde0cb
|
Move to correct directory
|
2021-10-27 14:38:51 +02:00 |
|