cc8a89b679
Merge pull request #239 from neu5ron/master
...
update helk config
2019-02-05 20:01:28 +01:00
046510f021
updated HELK Destination IP name
2019-02-05 13:11:06 -05:00
5092b1e603
Rule: removed overlapping strings in Linux rule
2019-02-05 16:12:07 +01:00
32c098294f
Rule: extended suspicious command lines
2019-02-05 15:58:15 +01:00
8f684ddd06
Rule: FP in WMI persistence with SCCM
2019-02-05 15:57:54 +01:00
a276d3083d
DHCP log source in sigmac configs
2019-02-05 14:35:23 +01:00
dfd4ce878f
Rule: limiting rule to DHCP log
2019-02-05 14:35:23 +01:00
5b92790e3f
Rule: WMI Persistence - FPs
2019-02-05 14:35:23 +01:00
abf5a5088e
Rule: more malicious UAs
2019-02-05 14:35:23 +01:00
3ef930b094
Escaped '\*' to '\\*' where required
2019-02-03 00:24:57 +01:00
9c44bb04a7
Added mail address to CI fail notification
2019-02-02 23:52:54 +01:00
9403128aef
Merge branch 'master' of https://github.com/Neo23x0/sigma
2019-02-02 23:52:06 +01:00
6215a694a8
Remove escaping from '\\*' in es-dsl backend
2019-02-02 23:51:11 +01:00
37e13c9f41
Notify me
2019-02-02 08:56:00 +01:00
8a0784ad33
Fixed escaping of \\*
2019-02-02 00:18:58 +01:00
6440bc962b
CACTUSTORCH detection
2019-02-01 23:27:53 +01:00
6436cb3ae1
Added missing conditions
2019-02-01 23:02:03 +01:00
27c2684a0f
Rule: Chafer malware proxy pattern
2019-01-31 12:31:48 +01:00
a8d1e7c62b
Rule: Fixed ntdsutil rule field in 4688 events
2019-01-29 15:59:39 +01:00
6c8d08942e
Rule: Fixed field in RDP rule
2019-01-29 15:17:29 +01:00
f61b44efa8
Rule: Netsh port forwarding
2019-01-29 14:04:48 +01:00
086e62a495
Rule: Netsh RDP port forwarding rule
2019-01-29 14:04:28 +01:00
a2eac623a6
Rule: Adjusted RDP login from localhost rule level
2019-01-29 14:04:10 +01:00
c9ec469180
style: cosmetics - removed empty lines at file end
2019-01-29 12:54:07 +01:00
516bfc88ff
Added rule: RDP login from localhost
2019-01-28 22:43:22 +01:00
3c7f46a6cd
Added rule test to CI testing
2019-01-23 23:31:36 +01:00
9ce7d18712
Merge pull request #231 from TareqAlKhatib/rule_testing_framework
...
Rule testing framework
2019-01-23 23:16:46 +01:00
ecffe28933
Correct MITRE tag
2019-01-22 21:26:07 +03:00
e3d61047bb
Added two tests. One for MITRE and another for file extension.
2019-01-22 21:25:13 +03:00
90e8eba530
rule: false positive reduction in PowerShell rules
2019-01-22 16:37:36 +01:00
cc6e0baef1
rule: extended certutil rule to include verifyctl and allows renamed certutil
...
https://twitter.com/egre55/status/1087685529016193025
2019-01-22 16:20:06 +01:00
b1ea976f66
fix: fixed bug inntdsutil rule that included a white space
2019-01-22 16:18:43 +01:00
8c4b21f063
Rule: Apache threading errors
2019-01-22 08:49:10 +01:00
5645c75576
Rule: updated relevant AV signatures - exploiting
...
https://twitter.com/haroldogden/status/1085556071891173376
2019-01-16 18:43:28 +01:00
f759e8b07c
Rule: Suspicious Program Location Process Starts
2019-01-15 15:40:51 +01:00
8336b47530
Merge branch 'master' of https://github.com/Neo23x0/sigma
2019-01-14 22:12:37 +01:00
cc4b806b94
Sigma tools release 0.7.1
2019-01-14 00:26:03 +01:00
5cba0b9946
Merge pull request #223 from m0jtaba/master
...
extending the qradar backend to allow for timeframe query
2019-01-13 23:55:55 +01:00
ed1ee80f2d
Merge pull request #221 from adrienverge/fix/yamllint
...
Fix yamllint config
2019-01-13 23:55:14 +01:00
9a6b3b5389
Rule: PowerShell script run in AppData folders
2019-01-12 12:03:36 +01:00
604d88cf1e
Rule: WMI Event Subscription
2019-01-12 12:03:36 +01:00
63f96d58b4
Rule: Renamed PowerShell.exe
2019-01-12 12:03:36 +01:00
b7eb79f8da
Rule: UserInitMprLogonScript persistence method
2019-01-12 12:03:36 +01:00
d4a1fe786a
Rule: Dridex pattern
2019-01-12 12:03:36 +01:00
aa37ef2559
extending the qradar backend to allow for timeframe query
2019-01-11 03:33:49 +00:00
44f18db80d
Fix YAML errors reported by yamllint
...
Especially the config for ArcSight, that was invalid:
tools/config/arcsight.yml
89:5 error duplication of key "product" in mapping (key-duplicates)
90:5 error duplication of key "conditions" in mapping (key-duplicates)
rules/windows/builtin/win_susp_commands_recon_activity.yml
10:9 error too many spaces after colon (colons)
2019-01-10 09:51:39 +01:00
b5531be4bf
Really run yamllint (it wasn't checking any rule)
...
Fix the yamllint config in `.yamllint` to "extend" the default rule.
Previously, it didn't extend anything and only disabled a rule, which
means no rule at all were checked.
Also disable some rules in this file, because they report many errors in
the Sigma code base.
In the future, I suggest fixing these errors and re-enabling standard
rules like `trailing-spaces` or `indentation`.
Fixes #220 .
2019-01-10 09:51:33 +01:00
0c3b0e25a8
Merge pull request #217 from TareqAlKhatib/private_ips
...
Corrected class B private IP range to prevent false negatives
2019-01-04 12:11:25 +01:00
8b94860ee6
Corrected class B private IP range to prevent false negatives
2019-01-04 12:50:41 +03:00
ee417dd2ea
Merge pull request #216 from TareqAlKhatib/duplicate_outlook
...
Removed Outlook detection which is a subset of the Office one
2019-01-02 22:56:59 +01:00
Florian Roth