 frack113
|
ce8cdf24ec
|
Aurora FP
|
2022-02-14 18:08:51 +01:00 |
|
|
frack113
|
b632b6bda0
|
Fix invalid logsource
|
2022-02-14 06:48:22 +01:00 |
|
|
frack113
|
171edbd1bc
|
Merge pull request #2694 from frack113/Red_20220213
Windows Redcannary
|
2022-02-14 06:34:20 +01:00 |
|
|
frack113
|
277d14f4ee
|
Merge pull request #2696 from frack113/thedfirreport_qbot
Missing Qbot rules
|
2022-02-14 06:34:09 +01:00 |
|
|
frack113
|
7f15b7a802
|
Missing Qbot rules
|
2022-02-13 16:07:28 +01:00 |
|
|
frack113
|
82e08de42c
|
Merge pull request #2693 from wagga40/master
Correct a typo in rule name
|
2022-02-13 16:00:40 +01:00 |
|
|
wagga40
|
fceb2c0de1
|
Correct bad commit
|
2022-02-13 13:34:28 +01:00 |
|
|
Florian Roth
|
e49c142e08
|
Merge pull request #2695 from frack113/aurora_fp
Aurora Office FP
|
2022-02-13 12:34:40 +01:00 |
|
|
frack113
|
ce0a5033f8
|
Aurora Office FP
|
2022-02-13 11:29:52 +01:00 |
|
|
Florian Roth
|
1b7cc9b35a
|
Merge pull request #2691 from frack113/red_20220212
Windows Redcannary
|
2022-02-13 11:23:20 +01:00 |
|
|
frack113
|
f288134b41
|
Windows Redcannary
|
2022-02-13 11:04:00 +01:00 |
|
|
wagga40
|
c840c1a7f7
|
Correct a typo in rule name
|
2022-02-13 09:34:43 +01:00 |
|
|
frack113
|
e61c9e4b2e
|
Merge pull request #2690 from frack113/susp_temp_exe
add win_pc_susp_run_folder
|
2022-02-13 09:04:16 +01:00 |
|
|
frack113
|
7e3c088165
|
Windows Redcannary
|
2022-02-12 15:53:13 +01:00 |
|
|
Florian Roth
|
0feefdc751
|
Update win_pc_susp_run_folder.yml
|
2022-02-12 10:17:27 +01:00 |
|
|
Florian Roth
|
98dbfe1ff6
|
fix: too many matches on many programs
... running from every other locations
|
2022-02-12 00:44:42 +01:00 |
|
|
Florian Roth
|
12f7c58274
|
fix: FPs noticed with Aurora
|
2022-02-12 00:40:10 +01:00 |
|
|
Florian Roth
|
626b5a0488
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-02-12 00:36:33 +01:00 |
|
|
frack113
|
4e0b3d719a
|
add win_pc_susp_run_folder
|
2022-02-11 21:37:11 +01:00 |
|
|
Florian Roth
|
a7e4ef4442
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-02-11 20:21:37 +01:00 |
|
|
Florian Roth
|
85b25bf17e
|
fix: FP noticed with Aurora
VSCode installer uses .tmp extension
|
2022-02-11 20:21:35 +01:00 |
|
|
Florian Roth
|
7e46d382f0
|
Merge pull request #2687 from nasbench/master
Update win_susp_proc_access_lsass.yml
|
2022-02-11 18:06:55 +01:00 |
|
|
Florian Roth
|
c441852e5d
|
Merge pull request #2688 from phantinuss/checkbaseline
Fix FPs (Example Installation 3)
|
2022-02-11 18:06:37 +01:00 |
|
|
Florian Roth
|
891475dccb
|
Merge pull request #2684 from SigmaHQ/rule-devel
rules: SAM dump, suspicious program names, iso/img mount
|
2022-02-11 18:06:20 +01:00 |
|
|
phantinuss
|
646ce36809
|
fix: use doublequotes instead of ' because of ' in string
|
2022-02-11 16:52:45 +01:00 |
|
|
phantinuss
|
809f7abbb8
|
fix: several FPs against a fresh installed Windows with example applications and basic user interaction 3
|
2022-02-11 16:38:52 +01:00 |
|
|
Nasreddine Bencherchali
|
d0b68c4483
|
Update win_susp_proc_access_lsass.yml
|
2022-02-11 14:20:42 +01:00 |
|
|
Florian Roth
|
a72e432389
|
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
|
2022-02-11 14:15:54 +01:00 |
|
|
Florian Roth
|
0476b8693d
|
refactor: extended .iso rule
|
2022-02-11 14:15:51 +01:00 |
|
|
Florian Roth
|
635a5c7d41
|
fix: wrong condition
|
2022-02-11 12:47:34 +01:00 |
|
|
Florian Roth
|
06e62c48ee
|
Merge pull request #2683 from SigmaHQ/aurora-false-positive-fixing
Aurora false positive fixing
|
2022-02-11 12:45:41 +01:00 |
|
|
Florian Roth
|
3fa2d13e10
|
rule: iso / img file mount
|
2022-02-11 12:37:35 +01:00 |
|
|
Florian Roth
|
8e255bfdaf
|
refactor: sam hive dump filename rule
|
2022-02-11 12:16:40 +01:00 |
|
|
Florian Roth
|
1bf00333f7
|
fix: exclude empty OriginalName fields
|
2022-02-11 12:01:02 +01:00 |
|
|
Florian Roth
|
36b0a13e0f
|
fix: better way to filter these events
|
2022-02-11 12:00:08 +01:00 |
|
|
Florian Roth
|
55a2fdd1c3
|
fix: FP noticed with Aurora
|
2022-02-11 11:58:30 +01:00 |
|
|
Florian Roth
|
e6989f9efb
|
rules: samdumps, suspicious program names
|
2022-02-11 11:58:02 +01:00 |
|
|
frack113
|
6a69a06ea9
|
Merge pull request #2681 from johnpaulglab/patch-1
Update win_pc_msiexec_install_quiet.yml
|
2022-02-11 06:35:18 +01:00 |
|
|
johnpaulglab
|
a8f8f88c34
|
Update win_pc_msiexec_execute_dll.yml
Spelling error
|
2022-02-10 14:41:22 -06:00 |
|
|
johnpaulglab
|
89e98db927
|
Update win_pc_msiexec_install_quiet.yml
Spelling error
|
2022-02-10 14:38:51 -06:00 |
|
|
phantinuss
|
97f4b8a1e9
|
fix: mandatory escaping of \*
|
2022-02-10 16:16:42 +01:00 |
|
|
phantinuss
|
6ad44598ee
|
fix: several FPs against a fresh installed Windows with example applications and basic user interaction 2
|
2022-02-10 16:12:17 +01:00 |
|
|
Florian Roth
|
47d9595123
|
Merge pull request #2677 from SigmaHQ/rule-devel
refactor and new: lsass process dumping rules
|
2022-02-10 15:51:19 +01:00 |
|
|
Florian Roth
|
5ab21fdd0a
|
docs: wording
|
2022-02-10 12:49:23 +01:00 |
|
|
Florian Roth
|
3c7c348b89
|
refactor: extended rules and made them more exact
|
2022-02-10 12:46:24 +01:00 |
|
|
Tobias Michalski
|
6af5d4b6f5
|
fix: False Positive fix
Empty field CurrentDirectory should be "or"-ed
|
2022-02-10 12:15:18 +01:00 |
|
|
Florian Roth
|
a05b3e50e5
|
refactor and new: lsass process dumping rules
|
2022-02-10 09:17:25 +01:00 |
|
|
Florian Roth
|
0dc9234176
|
Merge pull request #2675 from redsand/fp_win_apt_bluemashroom
Adds false positive filter to win apt bluemashroom
|
2022-02-09 23:11:55 +01:00 |
|
|
Tim Shelton
|
531f9a61f1
|
Adds false positive filter to win apt bluemashroom and process for adding additional filters in the future
|
2022-02-09 20:11:45 +00:00 |
|
|
Florian Roth
|
2a816c53d7
|
Merge pull request #2674 from SigmaHQ/aurora-false-positive-fixing
fix: extended rule due to high number of fps
|
2022-02-09 20:48:07 +01:00 |
|