 frack113
|
6e41ecdaaf
|
Merge pull request #3059 from c3rb3ru5d3d53c/patch-1
Follina — a Microsoft Office code execution vulnerability
|
2022-05-30 06:50:53 +02:00 |
|
|
frack113
|
18dc60858a
|
Fix selection1
|
2022-05-30 06:44:45 +02:00 |
|
|
c3rb3ru5
|
7cd648a1ed
|
Update proc_creation_win_lolbins_by_office_applications.yml
https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
|
2022-05-29 21:28:35 -03:00 |
|
|
Nasreddine Bencherchali
|
e9d18b5075
|
Create proc_creation_win_msdt.yml
|
2022-05-29 12:53:45 +01:00 |
|
|
frack113
|
ff6c54ded6
|
Merge pull request #3044 from redsand/fp_file_event_win_webshell_creation
FP: System image (driver) restoring files. Valid behavior
|
2022-05-27 15:11:58 +02:00 |
|
|
frack113
|
9c0e7cf3e8
|
Merge pull request #3049 from MarkMorow/markmorow
Create azure_app_credential_added.yml
|
2022-05-27 07:01:39 +02:00 |
|
|
frack113
|
61ee06897a
|
Merge pull request #3054 from redsand/fp_proc_creation_ibm_desktop
FP: IBM ClientSolutions is valid directory
|
2022-05-27 07:00:01 +02:00 |
|
|
frack113
|
dc6640678a
|
Merge pull request #3053 from redsand/fp_net_connection_from_desktop_ibm
Fp net connection from desktop ibm
|
2022-05-27 06:58:45 +02:00 |
|
|
frack113
|
32e6a82cf2
|
Update azure_app_credential_added.yml
|
2022-05-27 06:56:07 +02:00 |
|
|
Mark Morowczynski
|
4f044ea760
|
Merge branch 'SigmaHQ:master' into markmorow
|
2022-05-26 12:38:05 -07:00 |
|
|
Mark Morowczynski
|
5229c05cab
|
Update azure_app_credential_added.yml
Changes based on Sigma template rules
|
2022-05-26 12:36:38 -07:00 |
|
|
Tim Shelton
|
b1cbac0ae3
|
Adjusting condition
|
2022-05-26 18:39:22 +00:00 |
|
|
Tim Shelton
|
5e2e776bce
|
Adjusting condition
|
2022-05-26 18:38:12 +00:00 |
|
|
Tim Shelton
|
b35cb0d315
|
Merge branch 'master' of https://github.com/redsand/sigma into fp_file_event_win_webshell_creation
|
2022-05-26 18:31:37 +00:00 |
|
|
Tim Shelton
|
a3853ac6a7
|
Merge branch 'master' of https://github.com/redsand/sigma into fp_net_connection_from_desktop_ibm
|
2022-05-26 18:30:48 +00:00 |
|
|
Tim Shelton
|
ffe059a9d5
|
Merge branch 'master' of https://github.com/redsand/sigma into fp_posh_ps_malicious_commandlets
|
2022-05-26 18:29:59 +00:00 |
|
|
Tim Shelton
|
72e090b8c1
|
Merge branch 'master' of https://github.com/redsand/sigma into fp_proc_creation_ibm_desktop
|
2022-05-26 18:28:25 +00:00 |
|
|
Tim Shelton
|
48e37241dd
|
FP: IBM ClientSolutions is valid directory
|
2022-05-26 18:25:43 +00:00 |
|
|
Tim Shelton
|
8ac66efd73
|
updating modified
|
2022-05-26 18:17:40 +00:00 |
|
|
Tim Shelton
|
13d68d9671
|
False positive on IBM Client Solutions
|
2022-05-26 18:16:55 +00:00 |
|
|
frack113
|
dbcb0164ab
|
Merge pull request #3051 from frack113/mittre
Mitre tag change
|
2022-05-26 18:52:41 +02:00 |
|
|
frack113
|
b9a0c7e437
|
Mitre Update
|
2022-05-26 18:39:42 +02:00 |
|
|
Mark Morowczynski
|
97efeada5f
|
Update .gitignore
|
2022-05-26 09:39:00 -07:00 |
|
|
Tim Shelton
|
c1ef20761a
|
Fixing condition
|
2022-05-26 16:14:37 +00:00 |
|
|
Tim Shelton
|
9086efa5cd
|
Updating meta
|
2022-05-26 16:13:22 +00:00 |
|
|
Tim Shelton
|
295a984d89
|
Fixing order of items in yaml
|
2022-05-26 16:12:31 +00:00 |
|
|
Tim Shelton
|
879fccd266
|
merging locally
|
2022-05-26 15:27:13 +00:00 |
|
|
Tim Shelton
|
b78386d372
|
FP: ignore Amazon aws powershell
|
2022-05-26 14:45:00 +00:00 |
|
|
Mark Morowczynski
|
34d06708e5
|
Create azure_app_credential_added.yml
App Credential Add rule
|
2022-05-25 19:13:26 -07:00 |
|
|
Tim Shelton
|
8ef2a37fda
|
clean up condition
|
2022-05-25 20:24:47 +00:00 |
|
|
phantinuss
|
b80eb411ab
|
Merge pull request #3032 from frack113/lolbin_20220522
Add lolbas cl script
|
2022-05-25 12:02:44 +02:00 |
|
|
phantinuss
|
e475deaf4d
|
Update proc_creation_win_lolbas_cl_mutexverifiers.yml
|
2022-05-25 11:56:52 +02:00 |
|
|
phantinuss
|
3bdf29033a
|
Update proc_creation_win_lolbas_cl_loadassembly.yml
|
2022-05-25 11:55:37 +02:00 |
|
|
frack113
|
f737ba6e95
|
Fix duplicate cast
|
2022-05-25 11:19:09 +02:00 |
|
|
Tim Shelton
|
7369908284
|
fixing yaml syntax check
|
2022-05-24 22:52:04 +00:00 |
|
|
Tim Shelton
|
9a3fc4f543
|
FP: System image (driver) restoring files. Valid behavior
|
2022-05-24 22:31:05 +00:00 |
|
|
Nasreddine Bencherchali
|
c3d807f53a
|
Add More Malicious PowerShell Script/Cmdlet Names
|
2022-05-24 22:02:08 +01:00 |
|
|
Florian Roth
|
c7b90f108f
|
Merge pull request #3039 from jstnk9/master
New sigma rule to detect the use of Jlaive antivirus defense evasion
|
2022-05-24 20:25:42 +02:00 |
|
|
Florian Roth
|
a6202f7961
|
Merge pull request #3041 from SigmaHQ/rule-devel
refactor: old rule additions, rule: new powershell rules
|
2022-05-24 20:24:42 +02:00 |
|
|
Florian Roth
|
4b100116d4
|
Merge pull request #3031 from CD-R0M/master
Create proc_creation_win_rundll32_parent_explorer.yml
|
2022-05-24 20:19:11 +02:00 |
|
|
Florian Roth
|
0e62d5b204
|
fix: bugs in rules
|
2022-05-24 20:18:41 +02:00 |
|
|
zakibro
|
7a33aac1ed
|
Update lnx_auditd_keylogging_with_pam_d.yml
adding missing uuid
|
2022-05-24 17:15:54 +02:00 |
|
|
zakibro
|
89d88288d6
|
New detection - Linux Keylogging
|
2022-05-24 17:05:38 +02:00 |
|
|
Florian Roth
|
37cef9b153
|
rule: PowerShell obfuscate Net.WebClient
|
2022-05-24 15:20:21 +02:00 |
|
|
Florian Roth
|
642a334d9e
|
rule: suspicious PowerShell encoded command patterns
|
2022-05-24 15:20:01 +02:00 |
|
|
Florian Roth
|
a296bfe667
|
rule: suspicious anydesk start location
|
2022-05-24 15:19:45 +02:00 |
|
|
Florian Roth
|
9d11505aa8
|
refactor: rule additions
|
2022-05-24 15:19:25 +02:00 |
|
|
jstnk9
|
6f1602d243
|
New sigma rule to detect the use of Jlaive antivirus defense evasion
|
2022-05-24 02:40:08 +02:00 |
|
|
Tim Shelton
|
0fb943dc2c
|
FP: fixing modifier
|
2022-05-23 21:43:43 +00:00 |
|
|
Tim Shelton
|
c807191ab7
|
FP: filtering out Amaazon AWS header
|
2022-05-23 21:41:13 +00:00 |
|