c2a16591af
Remove invalid link
...
Cybereason link was broken. Couldn't find anything with a super similar file path. The below link might be a valid replacement but went better safe than sorry and just removed it completely. https://www.cybereason.com/hubfs/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty-Part1.pdf
2019-03-07 14:22:29 -06:00
a82ea0a022
Merge pull request #276 from krakow2600/master
...
ATC windows rules review
2019-03-06 17:16:32 +01:00
d7c25adfb6
Merge pull request #274 from TareqAlKhatib/multifile_yamls
...
Updated to use the new process_creation logsource
2019-03-06 17:06:04 +01:00
cb7243de5d
fixed wrong tags
2019-03-06 06:18:38 +01:00
8bec627ff1
fixed multiple tags issue
2019-03-06 06:09:37 +01:00
5154460726
changed service to product
2019-03-06 05:57:01 +01:00
05cc7e455d
atc review
2019-03-06 05:25:12 +01:00
725ab99e90
Merge pull request #1 from AverageS/master
...
Fix rules
2019-03-06 04:31:01 +01:00
534f250c35
Merge branch 'master' of https://github.com/krakow2600/sigma
2019-03-06 00:45:16 +01:00
bb95347745
rules update
2019-03-06 00:43:42 +01:00
6232362f04
Missing tags
2019-03-06 00:16:40 +01:00
07807837ee
Missing tags
2019-03-06 00:02:37 +01:00
be108d95cc
Merge branch 'master' of https://github.com/AverageS/sigma
2019-03-06 01:57:38 +03:00
40241c1fdf
Fix 4 rules
2019-03-06 01:56:05 +03:00
99595a7f89
Added missing tags and some minor improvements
2019-03-05 23:25:49 +01:00
879017818f
More conversions to the new process_creation logsource
2019-03-05 09:46:53 +03:00
b2952b9f78
Fixing failed CI build - take 2
2019-03-04 16:51:39 +03:00
c8be6e649b
Fixing failed CI build
2019-03-04 16:44:30 +03:00
45458121c6
Updated to use the new process_creation logsource
2019-03-04 16:13:27 +03:00
ae1541242c
New custom suspicious TLD in rule ".pw"
2019-03-03 10:58:12 +01:00
17e9729ddd
Merge pull request #273 from TareqAlKhatib/process_create
...
Process create
2019-03-02 21:57:59 +01:00
58c61430a2
updated to use process_creation
2019-03-02 21:05:15 +03:00
be2ca8dc4d
Added checks for Sysmon 1 or EID 4688 instead of process_creation
2019-03-02 20:51:49 +03:00
33e490e4fa
Titles in Examples
2019-03-02 12:23:44 +01:00
7b3d67ae66
fix: bugfix in new proc creation rule
2019-03-02 11:28:13 +01:00
9a3ceb8421
Sigmac Usage Examples
2019-03-02 10:58:02 +01:00
1a583c158d
fixed typo as in pull request by @m0jtaba
2019-03-02 08:16:25 +01:00
2188001f98
Extended filter list provided by @Ov3rflow
2019-03-02 08:13:29 +01:00
bd4e61acd8
Merge pull request #271 from vburov/patch-4
...
Update win_susp_failed_logon_reasons.yml
2019-03-02 07:21:28 +01:00
f80cf52982
Expired happens too often
...
Back then when we created this rule, we noticed that "logon attempt with expired account" happens pretty often, so we decided to not include it. All event codes in this rule did not appear in a 30 day time period and therefore the rule's "level" was set to "high".
2019-03-02 07:20:59 +01:00
99b15edf8a
Sigma tools release 0.9
2019-03-02 00:47:03 +01:00
56a1ed1eac
Merge branch 'project-1'
2019-03-02 00:26:10 +01:00
7602309138
Increased indentation to 4
...
* Converted (to generic sigma) rules
* Converter outputs by default with indentation 4
2019-03-02 00:14:20 +01:00
1aac9baaed
Merge pull request #270 from LiamSennitt/master
...
fix bug in chafer activity rule #269
2019-03-01 17:13:04 +01:00
7bebedbac1
Update win_susp_failed_logon_reasons.yml
...
Added descriptions for logon failure statuses and new logon failure status that may indicate suspicious logon.
2019-03-01 18:18:39 +03:00
af6a1ff26a
Extended rule, modified timestamp
2019-03-01 13:36:54 +01:00
f560e83886
Added modified date
2019-03-01 12:07:31 +01:00
fc683ac7ee
Added error code for denied logon type
2019-03-01 12:06:54 +01:00
2345cbf7bd
fix bug in chafer activity rule #269
2019-03-01 10:23:02 +00:00
690807c846
Sigma tools release 0.8
2019-02-28 09:08:22 +01:00
6bdb4ab78a
Merge cleanup
2019-02-27 22:05:27 +01:00
8ce4b1530d
Rule: added SAM export
2019-02-26 09:00:47 +01:00
c922f7d73f
Merge branch 'master' into project-1
2019-02-26 00:24:46 +01:00
58a32f35d9
Merge pull request #246 from james0d0a/master
...
Added esentutl copy command to sysmon_susp_vssadmin_ntds_activity.yml
2019-02-24 16:53:49 +01:00
f278a00174
Rule: certutil encode
2019-02-24 14:10:40 +01:00
e7f5cbc22a
Rule: BabyShark activity
2019-02-24 14:04:44 +01:00
a60b53a7df
fix: bugfix in BEAR activity rule
2019-02-24 14:04:44 +01:00
8b7f0508a7
Merge pull request #262 from TareqAlKhatib/sysinternals
...
Added a detection path through process spawn
2019-02-24 09:19:00 +01:00
7d3d819ea5
Added a detection path through process spawn
2019-02-24 10:29:58 +03:00
bdf0dd8e21
Merge pull request #260 from TareqAlKhatib/malware_backconnect
...
Added private IP filter to reduce FPs
2019-02-23 22:47:14 +01:00
megan201296