 phantinuss
|
043747822f
|
fix: more falsepositives harmonization
|
2022-03-16 14:57:06 +01:00 |
|
|
phantinuss
|
6ae28b7a1c
|
fix: legitimate --> Legitimate
|
2022-03-16 14:35:19 +01:00 |
|
|
phantinuss
|
8d3f8acb60
|
fix: none --> Unknown
|
2022-03-16 14:19:21 +01:00 |
|
|
phantinuss
|
b23eee6ebf
|
fix: unknown --> Unknown
|
2022-03-16 13:43:54 +01:00 |
|
|
Florian Roth
|
9beafefe52
|
rules: suspicious linux patterns
|
2022-03-14 12:01:52 +01:00 |
|
|
frack113
|
7fb8272f94
|
Name Normalization
Name Normalization
|
2022-02-27 10:58:14 +01:00 |
|
|
frack113
|
ec7319be21
|
Name Normalization
Name Normalization
|
2022-02-27 07:39:46 +01:00 |
|
|
Florian Roth
|
86892c8f89
|
Merge pull request #2726 from rafaelszt/master
Adds root folder monitoring for bash configs
|
2022-02-22 17:33:21 +01:00 |
|
|
Rafael Teixeira
|
09aa506059
|
Updated modified date
|
2022-02-22 12:48:41 -03:00 |
|
|
frack113
|
8bb3379b68
|
Normalization of rule names
|
2022-02-22 11:16:31 +01:00 |
|
|
Rafael Teixeira
|
6ff13ddf68
|
Added root user files
|
2022-02-21 10:15:48 -03:00 |
|
|
Andreas Hunkeler
|
c8fa678a9b
|
rule: add tag execution to new bpftrace rule
|
2022-02-11 14:14:22 +01:00 |
|
|
Andreas Hunkeler
|
66b9d35ee9
|
rule: add new bpftrace unsafe option rule
|
2022-02-11 12:08:53 +01:00 |
|
|
frack113
|
ff9ecf395f
|
Fix detection
|
2022-02-06 19:16:27 +01:00 |
|
|
zakibro
|
d5257f9a05
|
Update lnx_auditd_systemd_service_creation.yml
fixing logic
|
2022-02-04 12:15:36 +01:00 |
|
|
Pawel Mazur
|
fede3b1183
|
Auditd rule - Systemd Service Creation
|
2022-02-03 20:31:07 +01:00 |
|
|
frack113
|
c3c13d6089
|
add lnx_pwnkit_local_privilege_escalation
|
2022-01-29 10:07:54 +01:00 |
|
|
zakibro
|
c1c5ed0db7
|
Update lnx_auditd_cve_2021_4034.yml
|
2022-01-27 12:55:22 +01:00 |
|
|
zakibro
|
bd9b5172cd
|
Update lnx_auditd_cve_2021_4034.yml
|
2022-01-27 12:44:53 +01:00 |
|
|
Pawel Mazur
|
c924977576
|
Adding auditd rule for CVE-2021-4034
|
2022-01-27 12:36:19 +01:00 |
|
|
Pawel Mazur
|
bbdfb79bc0
|
Adding new linux auditd rule - Disable Dystem Firewall
|
2022-01-22 15:12:24 +01:00 |
|
|
frack113
|
dfc477888b
|
Merge pull request #2583 from BlackB0lt/patch-22
Create lnx_doas_conf_creation.yml
|
2022-01-21 18:44:08 +01:00 |
|
|
Florian Roth
|
885f70b0f3
|
Update lnx_doas_execution.yml
|
2022-01-20 13:08:39 +01:00 |
|
|
Florian Roth
|
375acb8ba4
|
Update lnx_doas_conf_creation.yml
|
2022-01-20 13:07:53 +01:00 |
|
|
Sittikorn S
|
f21d10b69f
|
Update lnx_doas_conf_creation.yml
|
2022-01-20 11:00:18 +07:00 |
|
|
Sittikorn S
|
f195160baa
|
Update lnx_doas_execution.yml
|
2022-01-20 10:58:47 +07:00 |
|
|
Sittikorn S
|
8b94046efa
|
Update lnx_doas_execution.yml
|
2022-01-20 10:11:24 +07:00 |
|
|
Sittikorn S
|
41065bcc91
|
Update lnx_doas_conf_creation.yml
|
2022-01-20 10:11:14 +07:00 |
|
|
Sittikorn S
|
bb574151ba
|
Create lnx_doas_conf_creation.yml
|
2022-01-20 09:50:41 +07:00 |
|
|
Sittikorn S
|
4f56e0d92e
|
Update lnx_doas_execution.yml
|
2022-01-20 09:48:24 +07:00 |
|
|
Sittikorn S
|
eb4731b370
|
Create lnx_doas_execution.yml
|
2022-01-20 09:46:17 +07:00 |
|
|
frack113
|
4631d0c482
|
remove invalid tag
|
2022-01-19 18:23:30 +01:00 |
|
|
frack113
|
f7e670d55e
|
Simple Quote
|
2022-01-11 13:40:53 +01:00 |
|
|
Florian Roth
|
e055ec1d52
|
refactor: change all " of them" expressions
|
2022-01-11 10:59:57 +01:00 |
|
|
frack113
|
9092958019
|
fix quote
|
2022-01-10 22:25:47 +01:00 |
|
|
frack113
|
a885d95aa3
|
Update pattern
|
2021-12-10 16:45:42 +01:00 |
|
|
frack113
|
b56630ced1
|
Add lnx_susp_dev_tcp
|
2021-12-10 13:39:06 +01:00 |
|
|
phantinuss
|
07a0a37273
|
feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*'
|
2021-12-02 14:47:39 +01:00 |
|
|
Pawel Mazur
|
6e43a294a2
|
Linux Auditd - Discovery of Capabilities files
|
2021-11-28 16:48:37 +01:00 |
|
|
frack113
|
01dc930c17
|
Change status for old rules
|
2021-11-27 11:33:14 +01:00 |
|
|
Florian Roth
|
4a69c71b2f
|
Update lnx_shell_clear_cmd_history.yml
|
2021-11-24 09:31:12 +01:00 |
|
|
Florian Roth
|
94c61bf07a
|
Update lnx_shell_clear_cmd_history.yml
|
2021-11-24 09:29:48 +01:00 |
|
|
secjunkie
|
b76d000f26
|
Update lnx_shell_clear_cmd_history.yml
cat and ln can use zero or null
chattr does not clear but stops further logging
|
2021-11-23 23:06:23 +00:00 |
|
|
remotephone
|
be59ca0f01
|
Update macos_space_after_filename.yml
Fixing new line and updating change date
|
2021-11-20 15:54:24 -06:00 |
|
|
remotephone
|
9530d67834
|
Create macos_space_after_filename.yml
Adding coverage for macOS space after filename
|
2021-11-20 15:43:51 -06:00 |
|
|
frack113
|
1cfca93354
|
Missing status in rules (#2284)
* add missing status
|
2021-11-19 22:32:26 +01:00 |
|
|
frack113
|
0c61c444eb
|
Merge pull request #2278 from zakibro/master
Adding New Linux Auditd rule - Data Exfil with Wget
|
2021-11-19 22:30:10 +01:00 |
|
|
Pawel Mazur
|
87f64e28fd
|
Adding New Linux Auditd rule - Data Exfil with Wget
|
2021-11-18 18:03:17 +01:00 |
|
|
Florian Roth
|
a921bd5ec8
|
style: reordered rule layout
|
2021-11-17 18:59:40 +01:00 |
|
|
Florian Roth
|
645292d945
|
removed contributor, added to authors
|
2021-11-12 19:44:50 +01:00 |
|