cd4491cba2
rule: disable volume snaptshots
2021-01-28 13:48:30 +01:00
7d99a48bb2
rule: new Quakbot pattern
2021-01-25 12:03:30 +01:00
a4bec724a6
rule: SonicWall exploitation
2021-01-25 11:54:23 +01:00
b62c705bf0
Improved UNC2452 activity rules
2021-01-22 09:18:11 +01:00
4ad70f0aaa
rule: Raccine uninstall
2021-01-21 17:59:17 +01:00
c5a7558ca0
fix: fixed actor name in description
2021-01-21 09:19:51 +01:00
a0b8eeac6f
fix: minor issues
2021-01-20 18:52:50 +01:00
8b319e3686
rule: UNC2452 PowerShell pattern
2021-01-20 18:51:49 +01:00
eedc483be4
rework: impossible rule with Sysmon
2021-01-19 14:12:40 +01:00
fdc969385a
rule: plink anomaly rules
2021-01-19 12:39:40 +01:00
cf37abee4d
docs: more details
2021-01-11 19:56:36 +01:00
a0fccf8647
rule: NTFS vulnerability
...
https://twitter.com/jonasLyk/status/1347900440000811010
2021-01-11 14:51:26 +01:00
63cc0d23c6
changes provided by FPT.EagleEye Team in
...
https://github.com/Neo23x0/sigma/pull/1218/files
2021-01-09 10:38:20 +01:00
30dcc28a1f
Cisco ASA FTD Exploit CVE-2020-3452
2021-01-07 13:17:58 +01:00
5ec4e42569
Merge pull request #1165 from w0rk3r/oscd3
...
[OSCD] Updated win_etw_trace_evasion - Added new detections, Removed reference to deprecated rule and changed selections
2021-01-06 00:12:22 +03:00
789dfb3f47
Merge pull request #1291 from lprat/fix_issue_1285
...
fix issue 1285
2020-12-30 23:06:38 +01:00
675d93ee3d
Replaced string comparison with isinstance
2020-12-30 22:50:13 +01:00
1bb0963784
Moved set_size option to class where it's used
2020-12-30 22:25:57 +01:00
ac55c7fdd4
Merge branch 'elasticsearch_backend' of https://github.com/WuerthIT/sigma into pr-1308
2020-12-30 22:18:13 +01:00
ab408750ac
Merge pull request #1314 from Neo23x0/rule-devel
...
rule: Lazarus activity
2020-12-30 13:27:38 +01:00
9ecaeb715f
Merge pull request #1317 from rtkdmasse/fix-missing-product-mouse-lock
...
Fix missing product mouse lock
2020-12-30 13:27:20 +01:00
15f5efc9c4
Merge pull request #1322 from maravedi/patch-1
...
Update sumologic.yml
2020-12-29 17:59:13 +01:00
126a17a276
Merge pull request #1323 from ZikyHD/master
...
Typo on field name
2020-12-29 15:39:36 +01:00
8a6b182fee
Update win_susp_adfind.yml
2020-12-29 14:41:46 +01:00
ece829bb25
Update win_susp_adfind.yml
...
Typo on field name
2020-12-29 14:40:36 +01:00
fa6f75f07e
Update sumologic.yml
...
The commit from vihreb on October 6, 2020 (https://github.com/Neo23x0/sigma/commit/51df5ad8764cd6896a3ef83ad388aebc136d5815 ) removed some items from the allowed fields list for the sumologic backend (https://github.com/Neo23x0/sigma/blob/51df5ad8764cd6896a3ef83ad388aebc136d5815/tools/sigma/backends/sumologic.py#L161 ) with the expectation that they are included in the sumologic config, however the default sumologic config does not reflect that change. This breaks the parsing of maps from rules. For example, when trying to run sigmac on a rule with multiple EventID values, the result is an error that states "argument of type 'int' is not iterable."
I suspect that this change in the behavior of the backend was made to accommodate for new sumologic-cse config which may not need the additional allowed fields that the regular sumologic config does. As such, I think it would probably make the most sense to re-add these fields to the sumologic config file rather than directly back into the backend for sumologic.
Note: In the config, I did not include those fields that are presently hard coded in the allowed field list in the sumologic backend (e.g. _sourceCategory and _view were removed). I also removed "sourcename" since from what I can tell, the syntax that vihreb added to the sumologic backend "_sourceName" is actually correct.
2020-12-28 16:46:32 -05:00
0a83f91386
Merge pull request #1321 from d4rk-d4nph3/master
...
Fixed typo in file format
2020-12-28 09:13:48 +01:00
bf77c8266a
Fixed typo in file format
2020-12-28 11:46:02 +05:45
896fc21911
Merge pull request #1320 from d4rk-d4nph3/master
...
Added rule for CVE-2020-10148 SolarWinds Orion API Authentication Bypass
2020-12-27 20:37:36 +01:00
a6212a4490
style: some minor style changes
2020-12-27 20:06:19 +01:00
1cfad987b0
Added rule for CVE-2020-10148 SolarWinds Orion API Authentication Bypass
2020-12-27 17:34:49 +05:45
bf539fd1fe
Revert "Fix bug changing the logsource service to category"
...
This reverts commit 0f51e53d0e
2020-12-23 15:50:49 -05:00
71ea5c7437
Add missing product in logsource
2020-12-23 15:45:00 -05:00
0f51e53d0e
Fix bug changing the logsource service to category
2020-12-23 15:12:31 -05:00
dedc34e91a
fix: typos and description
2020-12-23 14:46:08 +01:00
cdc29dfbe8
rule: Lazarus activity
2020-12-23 14:43:32 +01:00
821af35557
Merge pull request #1313 from Neo23x0/rule-devel
...
Rule devel
2020-12-23 13:57:11 +01:00
7286d01f78
fix: typo in rule
2020-12-23 13:26:44 +01:00
80aa398392
rule: Lazarus group loaders
2020-12-23 13:25:16 +01:00
e67d17a967
rule: improved solarwinds webshell rule
2020-12-22 10:36:34 +01:00
f20f346a6a
Merge pull request #1264 from omkar72/sdev-1
...
Adding 2 rules - Conhost & office test registry persistence
2020-12-21 18:28:59 +01:00
f46c590d91
Merge pull request #1288 from 0xtf/patch-1
...
add SIEGMA and S2AN
2020-12-21 18:27:52 +01:00
a314b54f93
docs: fix typo
2020-12-21 18:27:43 +01:00
e78d7e6aee
Merge pull request #1296 from mat-gas/fix-references
...
fix "references" field + add test for references in plural form
2020-12-21 18:25:35 +01:00
377454cb31
Merge pull request #1299 from tjgeorgen/patch-1
...
ATT&CK subtechnique tag updates
2020-12-21 18:24:00 +01:00
35ab80b39e
Merge pull request #1306 from d4rk-d4nph3/master
...
Added rule for Impacket's PsExec execution
2020-12-21 18:23:41 +01:00
1bb249c6ec
Merge pull request #1312 from Neo23x0/rule-devel
...
rule: Solarwinds SUPERNOVA web shell access
2020-12-21 11:30:56 +01:00
9c8e1387a9
rule: Solarwinds SUPERNOVA web shell access
2020-12-17 09:05:08 +01:00
7e6f01f611
elasticsearch backend: new parameter and fields support
2020-12-14 16:07:09 +01:00
0a7e95954e
Fix for fail build
2020-12-14 12:55:08 +05:45
Florian Roth