 Nasreddine Bencherchali
|
c3d807f53a
|
Add More Malicious PowerShell Script/Cmdlet Names
|
2022-05-24 22:02:08 +01:00 |
|
|
Florian Roth
|
c7b90f108f
|
Merge pull request #3039 from jstnk9/master
New sigma rule to detect the use of Jlaive antivirus defense evasion
|
2022-05-24 20:25:42 +02:00 |
|
|
Florian Roth
|
a6202f7961
|
Merge pull request #3041 from SigmaHQ/rule-devel
refactor: old rule additions, rule: new powershell rules
|
2022-05-24 20:24:42 +02:00 |
|
|
Florian Roth
|
4b100116d4
|
Merge pull request #3031 from CD-R0M/master
Create proc_creation_win_rundll32_parent_explorer.yml
|
2022-05-24 20:19:11 +02:00 |
|
|
Florian Roth
|
0e62d5b204
|
fix: bugs in rules
|
2022-05-24 20:18:41 +02:00 |
|
|
Florian Roth
|
246d53854d
|
Merge pull request #3042 from zakibro/master
New detection - Linux Keylogging
|
2022-05-24 19:49:38 +02:00 |
|
|
zakibro
|
7a33aac1ed
|
Update lnx_auditd_keylogging_with_pam_d.yml
adding missing uuid
|
2022-05-24 17:15:54 +02:00 |
|
|
zakibro
|
89d88288d6
|
New detection - Linux Keylogging
|
2022-05-24 17:05:38 +02:00 |
|
|
Florian Roth
|
37cef9b153
|
rule: PowerShell obfuscate Net.WebClient
|
2022-05-24 15:20:21 +02:00 |
|
|
Florian Roth
|
642a334d9e
|
rule: suspicious PowerShell encoded command patterns
|
2022-05-24 15:20:01 +02:00 |
|
|
Florian Roth
|
a296bfe667
|
rule: suspicious anydesk start location
|
2022-05-24 15:19:45 +02:00 |
|
|
Florian Roth
|
9d11505aa8
|
refactor: rule additions
|
2022-05-24 15:19:25 +02:00 |
|
|
Florian Roth
|
662c13a720
|
Merge pull request #3035 from redsand/hawk_backend_cfg_update
Backend: adding additional entries to hawk.yml
|
2022-05-24 12:33:11 +02:00 |
|
|
Florian Roth
|
522eb09635
|
Merge pull request #3037 from redsand/fp_powershell_ps_access_win_api
FP: filtering out Amaazon AWS header
|
2022-05-24 12:32:58 +02:00 |
|
|
Florian Roth
|
3b360544a5
|
Merge pull request #3038 from redsand/hawk_backend_sys_update
Backend: because hawk splits up SYSTEM and NT AUTHORITY, additional t…
|
2022-05-24 12:32:34 +02:00 |
|
|
phantinuss
|
657e235420
|
Merge pull request #3040 from pH-T/master
added 'similar' related type to test_rules script
|
2022-05-24 11:11:37 +02:00 |
|
|
Paul Hager
|
9b80dd990a
|
added 'similar' related type
|
2022-05-24 09:51:48 +02:00 |
|
|
jstnk9
|
6f1602d243
|
New sigma rule to detect the use of Jlaive antivirus defense evasion
|
2022-05-24 02:40:08 +02:00 |
|
|
Tim Shelton
|
b339901806
|
Backend: because hawk splits up SYSTEM and NT AUTHORITY, additional treatment is needed on some rules
|
2022-05-23 23:52:52 +00:00 |
|
|
Tim Shelton
|
0fb943dc2c
|
FP: fixing modifier
|
2022-05-23 21:43:43 +00:00 |
|
|
Tim Shelton
|
c807191ab7
|
FP: filtering out Amaazon AWS header
|
2022-05-23 21:41:13 +00:00 |
|
|
Tim Shelton
|
6ca03d741b
|
adding additional file hash column translation
|
2022-05-23 21:11:34 +00:00 |
|
|
CD-R0M
|
87de0d39db
|
Update proc_creation_win_rundll32_parent_explorer.yml
|
2022-05-23 16:49:40 -04:00 |
|
|
Tim Shelton
|
605a0bc678
|
Backend: adding additional entries to hawk.yml
|
2022-05-23 18:46:50 +00:00 |
|
|
Florian Roth
|
25edbeca69
|
Merge pull request #3034 from phantinuss/master
fix: FP found in testing environment
|
2022-05-23 17:18:25 +02:00 |
|
|
phantinuss
|
61c10d73e0
|
fix: FP found in testing environment
|
2022-05-23 16:45:27 +02:00 |
|
|
Florian Roth
|
0053a35328
|
Merge pull request #3033 from martinspielmann/patch-1
Fix typo
|
2022-05-23 11:20:16 +02:00 |
|
|
Martin
|
86d11e62e8
|
Fix typo
|
2022-05-23 10:50:59 +02:00 |
|
|
CD-R0M
|
9c26e12358
|
Update proc_creation_win_rundll32_parent_explorer.yml
|
2022-05-22 15:23:25 -04:00 |
|
|
CD-R0M
|
e9976bc3db
|
Update proc_creation_win_rundll32_parent_explorer.yml
|
2022-05-22 15:21:41 -04:00 |
|
|
CD-R0M
|
1e728d9598
|
Create proc_creation_win_rundll32_parent_explorer.yml
|
2022-05-21 17:07:31 -04:00 |
|
|
Florian Roth
|
bea6f18d35
|
Merge pull request #3024 from redsand/win_system_susp_eventlog_cleared
Making a derived detection for system/application/security event logs…
|
2022-05-20 20:56:00 +02:00 |
|
|
Florian Roth
|
946e4582a3
|
Merge pull request #3030 from SigmaHQ/aurora-false-positive-fixing
fix: detection with Windows Defender
|
2022-05-20 20:05:43 +02:00 |
|
|
Florian Roth
|
e86d007d35
|
Merge pull request #3027 from elhoim/rename_suspicious
Renamed suspicious in filenames to susp
|
2022-05-20 19:28:24 +02:00 |
|
|
Florian Roth
|
e8f59c8d0f
|
fix: detection with Windows Defender
|
2022-05-20 19:27:48 +02:00 |
|
|
frack113
|
865f26a543
|
Merge pull request #3029 from tr0mb1r/patch-1
Update sysmon.yml
|
2022-05-20 15:28:24 +02:00 |
|
|
tr0mb1r
|
ab7d7dbed8
|
Update sysmon.yml
typo in config
|
2022-05-20 13:47:18 +04:00 |
|
|
frack113
|
94702f7f9e
|
Merge pull request #3028 from MatilJ/powershell_msxml_com
Fix on Powershell MsXml COM object
|
2022-05-19 20:48:25 +02:00 |
|
|
MatilJ
|
10f0a82b94
|
Fix detection
|
2022-05-19 21:09:47 +03:00 |
|
|
Tim Shelton
|
600a7cd0e8
|
Re-adding accidently removed entry
|
2022-05-19 17:16:39 +00:00 |
|
|
Tim Shelton
|
60e6a147b4
|
merging remote change
|
2022-05-19 16:11:58 +00:00 |
|
|
Tim Shelton
|
3f6cabcae8
|
Updating to include match on Channel
|
2022-05-19 16:08:34 +00:00 |
|
|
David ANDRE
|
74b9f97b9c
|
Renamed suspicious in filenames to susp
|
2022-05-19 09:37:04 +02:00 |
|
|
Florian Roth
|
79c4e769d2
|
Update README.md
|
2022-05-19 07:54:04 +02:00 |
|
|
Florian Roth
|
003e5bee6d
|
Merge pull request #3018 from SigmaHQ/rule-devel
refactor: rule addition
|
2022-05-19 07:50:36 +02:00 |
|
|
Florian Roth
|
a21adf8904
|
Update README.md
|
2022-05-19 07:45:01 +02:00 |
|
|
Thomas Patzke
|
01ffec65fe
|
Merge pull request #2994 from ablescia/feat-hedera_backend
Hedera Backend - C# dynamic LINQ
|
2022-05-18 23:23:51 +02:00 |
|
|
Florian Roth
|
3fe86e3b84
|
rule: grpconv execution
|
2022-05-18 17:56:26 +02:00 |
|
|
Florian Roth
|
04a3dfeb01
|
Merge pull request #3025 from nasbench/master
Quick Updates and Fixes
|
2022-05-18 17:35:18 +02:00 |
|
|
Florian Roth
|
7d296ef078
|
fix: change on deleted rule
|
2022-05-18 17:34:39 +02:00 |
|