1431992e4e
Merge pull request #2604 from frack113/add_ps_version
...
add posh_ps_clear_powershell_history
2022-01-27 18:24:37 +01:00
a8cbfa832d
Merge pull request #2609 from SigmaHQ/aurora-false-positive-fixing
...
fix: too many false positives with certain access masks
2022-01-27 16:53:34 +01:00
1aa7697ca8
Update posh_ps_clear_powershell_history.yml
2022-01-27 16:16:57 +01:00
79de1631de
Merge pull request #2601 from secDre4mer/master
...
fix: Add filter for empty image to rule
2022-01-27 16:16:06 +01:00
82d5f4a511
fix: too many false positives with certain access masks
2022-01-27 09:08:40 +01:00
d52602dd5e
Update posh_ps_clear_powershell_history.yml
2022-01-26 18:09:09 +01:00
feedcee6bf
Update posh_ps_clear_powershell_history.yml
2022-01-26 17:57:26 +01:00
b3b37719e7
Update sysmon_lsass_memdump.yml
...
Updated Sysmon Lsass Memdump to detect other memory dumping techniques from mimikatz, nanodump, invoke-mimikatz, and so forth. This adds additional GrantedAccess permissions and adds ntdll.dll to CallTrace. Tested with Atomic Red Team T1003.001, MimiKatz, Invoke-Mimikatz and Cobalt Strike.
2022-01-26 08:12:49 -07:00
a68cf58264
Merge pull request #2596 from frack113/blackbyte
...
Add win_re_blackbyte_ransomware
2022-01-25 20:39:05 +01:00
818b20b949
add posh_ps_clear_powershell_history
2022-01-25 19:58:18 +01:00
51d9aca239
chore: update modified date
2022-01-25 11:46:16 +01:00
0cad38be34
fix: Add filter for empty image to rule
2022-01-25 11:43:35 +01:00
8a47c56397
Merge pull request #2595 from frack113/red_20220123b
...
Windows Redcannary
2022-01-25 06:21:17 +01:00
f634962420
Merge pull request #2594 from frack113/red_20220123
...
Windows Redcannary tests
2022-01-25 06:20:53 +01:00
0d5618f8ef
Merge pull request #2593 from frack113/moonbounce
...
add win_pc_susp_instalutil
2022-01-25 06:20:38 +01:00
d9193efda3
Merge pull request #2597 from SigmaHQ/rule-devel
...
AdvancedRun and Bugfix
2022-01-24 12:39:51 +01:00
9505a761e1
fix: bug in rule - missing backspace
2022-01-24 11:54:58 +01:00
4be9a6c3ad
Add win_re_blackbyte_ransomware
2022-01-24 10:03:52 +01:00
2dc0c2a8a9
fix field name case
2022-01-23 19:12:12 +01:00
f1959f25d7
Windows Redcannary
2022-01-23 16:37:59 +01:00
097704d834
add win_pc_susp_instalutil
2022-01-23 14:47:25 +01:00
1b8fa21be1
Fix space
2022-01-23 11:40:35 +01:00
90334e7f7c
Redcannary windows test
2022-01-23 11:37:01 +01:00
31e38623de
Update win_susp_curl_fileupload
2022-01-23 11:35:36 +01:00
5f71d21dc0
Merge pull request #2589 from frack113/discussions_2584
...
Move windows internal services to builtin
2022-01-21 18:39:32 +01:00
7dabe5e7a8
Merge pull request #2591 from frack113/colorcpl
...
add win_fe_susp_colorcpl
2022-01-21 17:47:52 +01:00
978381000f
Merge pull request #2588 from frack113/order_folder
...
Order rules
2022-01-21 17:47:09 +01:00
97f4bda4bc
add win_fe_susp_colorcpl
2022-01-21 14:16:35 +01:00
6eeb0723ed
Fix FP thanks aurora
2022-01-21 13:14:35 +01:00
7053d42e43
move to builtin
2022-01-21 11:59:13 +01:00
eb22807ddc
Order rules
2022-01-20 22:06:55 +01:00
137fc39c54
Merge pull request #2578 from frack113/red_20220119
...
Add Redcannary Windows Rules
2022-01-20 18:03:04 +01:00
0ae1e37ac9
Merge pull request #2586 from phantinuss/master
...
fix: typo unkown --> unknown
2022-01-20 11:36:33 +01:00
8cf78fb4e6
rules: advancedrun executions
2022-01-20 11:08:08 +01:00
e99d030754
Merge pull request #2585 from SigmaHQ/rule-devel
...
First code integrity rule - new log source
2022-01-20 11:06:20 +01:00
26c1c23305
fix: typo
2022-01-20 10:45:30 +01:00
9b7b48c0e6
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
2022-01-20 09:45:03 +01:00
4395a6dafa
rule: code integrity failed driver load
2022-01-20 09:45:00 +01:00
caa4c7f977
Add Redcannary Windows Rules
2022-01-19 20:40:43 +01:00
8a70729654
Merge pull request #2574 from SigmaHQ/rule-devel
...
rule: extended Defender exclusions rule
2022-01-19 20:32:14 +01:00
86165466e5
Merge pull request #2577 from SigmaHQ/aurora-false-positive-fixing
...
fix: FPs noticed with Aurora
2022-01-19 20:32:05 +01:00
d6af219bed
Merge branch 'master' into pr/2573
2022-01-19 19:42:49 +01:00
6835381e6a
Merge branch 'master' into rule-devel
2022-01-19 19:42:14 +01:00
27912f20d1
Merge branch 'master' into aurora-false-positive-fixing
2022-01-19 19:41:39 +01:00
e10decf584
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
2022-01-19 19:41:09 +01:00
51970e888e
Merge branch 'master' into aurora-false-positive-fixing
2022-01-19 19:40:51 +01:00
ba3a71aa9a
Merge branch 'master' into aurora-false-positive-fixing
2022-01-19 18:35:20 +01:00
94df11f53c
fix: FPs noticed with Aurora
2022-01-19 18:34:07 +01:00
4631d0c482
remove invalid tag
2022-01-19 18:23:30 +01:00
37243f5902
Updating formatting for more accurate mssql sqlps.exe detection
2022-01-19 14:49:00 +00:00
frack113