 frack113
|
ce8cdf24ec
|
Aurora FP
|
2022-02-14 18:08:51 +01:00 |
|
|
frack113
|
b632b6bda0
|
Fix invalid logsource
|
2022-02-14 06:48:22 +01:00 |
|
|
frack113
|
171edbd1bc
|
Merge pull request #2694 from frack113/Red_20220213
Windows Redcannary
|
2022-02-14 06:34:20 +01:00 |
|
|
frack113
|
277d14f4ee
|
Merge pull request #2696 from frack113/thedfirreport_qbot
Missing Qbot rules
|
2022-02-14 06:34:09 +01:00 |
|
|
frack113
|
7f15b7a802
|
Missing Qbot rules
|
2022-02-13 16:07:28 +01:00 |
|
|
Florian Roth
|
1b7cc9b35a
|
Merge pull request #2691 from frack113/red_20220212
Windows Redcannary
|
2022-02-13 11:23:20 +01:00 |
|
|
frack113
|
f288134b41
|
Windows Redcannary
|
2022-02-13 11:04:00 +01:00 |
|
|
frack113
|
e61c9e4b2e
|
Merge pull request #2690 from frack113/susp_temp_exe
add win_pc_susp_run_folder
|
2022-02-13 09:04:16 +01:00 |
|
|
frack113
|
7e3c088165
|
Windows Redcannary
|
2022-02-12 15:53:13 +01:00 |
|
|
Florian Roth
|
0feefdc751
|
Update win_pc_susp_run_folder.yml
|
2022-02-12 10:17:27 +01:00 |
|
|
Florian Roth
|
626b5a0488
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-02-12 00:36:33 +01:00 |
|
|
frack113
|
4e0b3d719a
|
add win_pc_susp_run_folder
|
2022-02-11 21:37:11 +01:00 |
|
|
Florian Roth
|
85b25bf17e
|
fix: FP noticed with Aurora
VSCode installer uses .tmp extension
|
2022-02-11 20:21:35 +01:00 |
|
|
Florian Roth
|
891475dccb
|
Merge pull request #2684 from SigmaHQ/rule-devel
rules: SAM dump, suspicious program names, iso/img mount
|
2022-02-11 18:06:20 +01:00 |
|
|
Florian Roth
|
635a5c7d41
|
fix: wrong condition
|
2022-02-11 12:47:34 +01:00 |
|
|
Florian Roth
|
1bf00333f7
|
fix: exclude empty OriginalName fields
|
2022-02-11 12:01:02 +01:00 |
|
|
Florian Roth
|
e6989f9efb
|
rules: samdumps, suspicious program names
|
2022-02-11 11:58:02 +01:00 |
|
|
frack113
|
6a69a06ea9
|
Merge pull request #2681 from johnpaulglab/patch-1
Update win_pc_msiexec_install_quiet.yml
|
2022-02-11 06:35:18 +01:00 |
|
|
johnpaulglab
|
a8f8f88c34
|
Update win_pc_msiexec_execute_dll.yml
Spelling error
|
2022-02-10 14:41:22 -06:00 |
|
|
johnpaulglab
|
89e98db927
|
Update win_pc_msiexec_install_quiet.yml
Spelling error
|
2022-02-10 14:38:51 -06:00 |
|
|
phantinuss
|
6ad44598ee
|
fix: several FPs against a fresh installed Windows with example applications and basic user interaction 2
|
2022-02-10 16:12:17 +01:00 |
|
|
Florian Roth
|
47d9595123
|
Merge pull request #2677 from SigmaHQ/rule-devel
refactor and new: lsass process dumping rules
|
2022-02-10 15:51:19 +01:00 |
|
|
Tobias Michalski
|
6af5d4b6f5
|
fix: False Positive fix
Empty field CurrentDirectory should be "or"-ed
|
2022-02-10 12:15:18 +01:00 |
|
|
Florian Roth
|
a05b3e50e5
|
refactor and new: lsass process dumping rules
|
2022-02-10 09:17:25 +01:00 |
|
|
Florian Roth
|
0dc9234176
|
Merge pull request #2675 from redsand/fp_win_apt_bluemashroom
Adds false positive filter to win apt bluemashroom
|
2022-02-09 23:11:55 +01:00 |
|
|
Tim Shelton
|
531f9a61f1
|
Adds false positive filter to win apt bluemashroom and process for adding additional filters in the future
|
2022-02-09 20:11:45 +00:00 |
|
|
phantinuss
|
43bae23f23
|
fix: several FPs against a fresh installed Windows with example applications and basic user interaction
|
2022-02-09 17:47:22 +01:00 |
|
|
phantinuss
|
0a5f2a020a
|
fix: filter events with empty sysmon field
|
2022-02-09 17:47:22 +01:00 |
|
|
Florian Roth
|
ef23efa60f
|
Merge pull request #2668 from SigmaHQ/rule-devel
rule: suspicious execution from suspicious folders
|
2022-02-08 19:14:23 +01:00 |
|
|
Florian Roth
|
3e0f45d11e
|
rule: suspicious execution from temp folders
|
2022-02-08 16:15:46 +01:00 |
|
|
Florian Roth
|
93767430fa
|
Merge pull request #2666 from SigmaHQ/rule-devel
Network Recon Activity : nslookup _ldap._tcp.dc._msdcs
|
2022-02-08 13:30:32 +01:00 |
|
|
Florian Roth
|
ed06403d04
|
fix: unneeded list
|
2022-02-08 12:21:43 +01:00 |
|
|
Florian Roth
|
9bc8bb5c20
|
fix: remove old link to removed part of rule
|
2022-02-08 09:36:31 +01:00 |
|
|
Florian Roth
|
88ce0ed97d
|
rule: Network Reconnaissance Activity
|
2022-02-08 09:36:03 +01:00 |
|
|
Florian Roth
|
7e17c2bbd2
|
Merge pull request #2658 from Karneades/patch-1
rule: ACTINIUM Scheduled Task Persistence
|
2022-02-07 21:20:22 +01:00 |
|
|
Tim Shelton
|
f3ce179f76
|
fixing false positive when loading the powershell function Convert-GuidToCompressedGuid
|
2022-02-07 17:10:57 +00:00 |
|
|
Florian Roth
|
aef0bd2a2d
|
Update process_creation_apt_actinium_persistence.yml
|
2022-02-07 16:15:48 +01:00 |
|
|
Andreas Hunkeler
|
40411f0596
|
Fix list issue in new wscript persistence rule
|
2022-02-07 15:54:42 +01:00 |
|
|
Andreas Hunkeler
|
0a78c3966b
|
rule: ACTINIUM Scheduled Task Persistence
|
2022-02-07 15:43:30 +01:00 |
|
|
Florian Roth
|
094215a7e0
|
Update win_pc_embed_exe_lnk.yml
|
2022-02-06 14:20:30 +01:00 |
|
|
frack113
|
f1f38a2df4
|
add win_pc_embed_exe_lnk
|
2022-02-06 14:01:48 +01:00 |
|
|
frack113
|
ebd09793d7
|
Merge pull request #2643 from elhoim/patch-1
Avoiding being too narrow for paths
|
2022-02-05 12:03:46 +01:00 |
|
|
Florian Roth
|
8dc0835b2a
|
Update win_pc_redirect_to_stream.yml
|
2022-02-04 23:18:08 +01:00 |
|
|
Florian Roth
|
affd73506d
|
Update win_pc_susp_instalutil.yml
|
2022-02-04 23:16:05 +01:00 |
|
|
David André
|
391d73a2c2
|
Avoiding being too narrow for paths
InstallUtil.exe is also available under 32 bits path for .net framework
|
2022-02-04 21:08:47 +01:00 |
|
|
frack113
|
16fed13bb0
|
Order files
|
2022-02-04 10:52:55 +01:00 |
|
|
frack113
|
2887cf2800
|
Merge pull request #2623 from frack113/red_t1555_003
Redcannary windows
|
2022-02-03 22:23:19 +01:00 |
|
|
Florian Roth
|
20a7bad5d8
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-02-02 20:40:21 +01:00 |
|
|
Florian Roth
|
885651efae
|
fix: FPs noticed with Aurora
|
2022-02-02 20:39:47 +01:00 |
|
|
Florian Roth
|
ef955b92ae
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-02-02 13:49:23 +01:00 |
|