1431992e4e
Merge pull request #2604 from frack113/add_ps_version
...
add posh_ps_clear_powershell_history
2022-01-27 18:24:37 +01:00
a8cbfa832d
Merge pull request #2609 from SigmaHQ/aurora-false-positive-fixing
...
fix: too many false positives with certain access masks
2022-01-27 16:53:34 +01:00
03b0bd8bd0
Merge pull request #2610 from zakibro/master
...
Adding auditd rule for CVE-2021-4034
2022-01-27 16:47:15 +01:00
1aa7697ca8
Update posh_ps_clear_powershell_history.yml
2022-01-27 16:16:57 +01:00
79de1631de
Merge pull request #2601 from secDre4mer/master
...
fix: Add filter for empty image to rule
2022-01-27 16:16:06 +01:00
c1c5ed0db7
Update lnx_auditd_cve_2021_4034.yml
2022-01-27 12:55:22 +01:00
bd9b5172cd
Update lnx_auditd_cve_2021_4034.yml
2022-01-27 12:44:53 +01:00
c924977576
Adding auditd rule for CVE-2021-4034
2022-01-27 12:36:19 +01:00
82d5f4a511
fix: too many false positives with certain access masks
2022-01-27 09:08:40 +01:00
d52602dd5e
Update posh_ps_clear_powershell_history.yml
2022-01-26 18:09:09 +01:00
feedcee6bf
Update posh_ps_clear_powershell_history.yml
2022-01-26 17:57:26 +01:00
b3b37719e7
Update sysmon_lsass_memdump.yml
...
Updated Sysmon Lsass Memdump to detect other memory dumping techniques from mimikatz, nanodump, invoke-mimikatz, and so forth. This adds additional GrantedAccess permissions and adds ntdll.dll to CallTrace. Tested with Atomic Red Team T1003.001, MimiKatz, Invoke-Mimikatz and Cobalt Strike.
2022-01-26 08:12:49 -07:00
a68cf58264
Merge pull request #2596 from frack113/blackbyte
...
Add win_re_blackbyte_ransomware
2022-01-25 20:39:05 +01:00
818b20b949
add posh_ps_clear_powershell_history
2022-01-25 19:58:18 +01:00
51d9aca239
chore: update modified date
2022-01-25 11:46:16 +01:00
0cad38be34
fix: Add filter for empty image to rule
2022-01-25 11:43:35 +01:00
8a47c56397
Merge pull request #2595 from frack113/red_20220123b
...
Windows Redcannary
2022-01-25 06:21:17 +01:00
f634962420
Merge pull request #2594 from frack113/red_20220123
...
Windows Redcannary tests
2022-01-25 06:20:53 +01:00
0d5618f8ef
Merge pull request #2593 from frack113/moonbounce
...
add win_pc_susp_instalutil
2022-01-25 06:20:38 +01:00
43690233fb
Merge pull request #2572 from zeronetworks/master
...
feat(rules): Adding rules for the rpc_firewall
2022-01-24 18:18:22 +01:00
d9193efda3
Merge pull request #2597 from SigmaHQ/rule-devel
...
AdvancedRun and Bugfix
2022-01-24 12:39:51 +01:00
9505a761e1
fix: bug in rule - missing backspace
2022-01-24 11:54:58 +01:00
4be9a6c3ad
Add win_re_blackbyte_ransomware
2022-01-24 10:03:52 +01:00
2dc0c2a8a9
fix field name case
2022-01-23 19:12:12 +01:00
f1959f25d7
Windows Redcannary
2022-01-23 16:37:59 +01:00
097704d834
add win_pc_susp_instalutil
2022-01-23 14:47:25 +01:00
1b8fa21be1
Fix space
2022-01-23 11:40:35 +01:00
90334e7f7c
Redcannary windows test
2022-01-23 11:37:01 +01:00
31e38623de
Update win_susp_curl_fileupload
2022-01-23 11:35:36 +01:00
83afc12875
fix(rules): changed "product" and "service" to suggested values.
2022-01-23 09:44:24 +02:00
bbdfb79bc0
Adding new linux auditd rule - Disable Dystem Firewall
2022-01-22 15:12:24 +01:00
dfc477888b
Merge pull request #2583 from BlackB0lt/patch-22
...
Create lnx_doas_conf_creation.yml
2022-01-21 18:44:08 +01:00
2eeee78466
Merge pull request #2582 from BlackB0lt/patch-21
...
Create lnx_doas_execution.yml
2022-01-21 18:43:57 +01:00
5f71d21dc0
Merge pull request #2589 from frack113/discussions_2584
...
Move windows internal services to builtin
2022-01-21 18:39:32 +01:00
7dabe5e7a8
Merge pull request #2591 from frack113/colorcpl
...
add win_fe_susp_colorcpl
2022-01-21 17:47:52 +01:00
978381000f
Merge pull request #2588 from frack113/order_folder
...
Order rules
2022-01-21 17:47:09 +01:00
97f4bda4bc
add win_fe_susp_colorcpl
2022-01-21 14:16:35 +01:00
6eeb0723ed
Fix FP thanks aurora
2022-01-21 13:14:35 +01:00
7053d42e43
move to builtin
2022-01-21 11:59:13 +01:00
eb22807ddc
Order rules
2022-01-20 22:06:55 +01:00
137fc39c54
Merge pull request #2578 from frack113/red_20220119
...
Add Redcannary Windows Rules
2022-01-20 18:03:04 +01:00
929711f5c1
fix(rules): missed stuff from previous fix
2022-01-20 17:27:47 +02:00
eb5578fa33
fix(rules): fixed capital in rule names, removed unknown mitre tags, removed unknown tag in logsource.
2022-01-20 16:53:01 +02:00
b7b95f9055
Order application folder
2022-01-20 14:57:57 +01:00
885f70b0f3
Update lnx_doas_execution.yml
2022-01-20 13:08:39 +01:00
375acb8ba4
Update lnx_doas_conf_creation.yml
2022-01-20 13:07:53 +01:00
0ae1e37ac9
Merge pull request #2586 from phantinuss/master
...
fix: typo unkown --> unknown
2022-01-20 11:36:33 +01:00
8cf78fb4e6
rules: advancedrun executions
2022-01-20 11:08:08 +01:00
e99d030754
Merge pull request #2585 from SigmaHQ/rule-devel
...
First code integrity rule - new log source
2022-01-20 11:06:20 +01:00
c76443051a
feat(rules): changing location to "application" folder
2022-01-20 11:57:10 +02:00
frack113