 Nasreddine Bencherchali
|
bf148ad0ac
|
fix: fp found in testing
|
2023-03-21 16:32:46 +01:00 |
|
|
m4nbat
|
ae469ddefe
|
New rules added for LockBit and Reddit used for C2. (#4045)
|
2023-02-20 12:07:02 +01:00 |
|
|
Nasreddine Bencherchali
|
a19a75b0b0
|
fix: resolves #4015
|
2023-02-07 14:33:56 +01:00 |
|
|
Wagga
|
273fdb9985
|
fix: typos in multiple rules (#4011)
|
2023-02-06 13:53:23 +01:00 |
|
|
Florian Roth
|
88c028f925
|
fix: FPs with cloudapp
|
2023-02-05 11:14:05 +01:00 |
|
|
Nasreddine Bencherchali
|
5d769b7b19
|
Merge branch 'SigmaHQ:master' into nasbench-rule-devel
|
2023-02-01 17:10:00 +01:00 |
|
|
Nasreddine Bencherchali
|
7c38a5c496
|
chore: add nextron authors tag
|
2023-02-01 11:14:59 +01:00 |
|
|
Nasreddine Bencherchali
|
9c0eae7590
|
fix: remove kerberos generic filters
|
2023-01-31 22:18:32 +01:00 |
|
|
frack113
|
1033b3f404
|
change status to test
|
2023-01-27 06:48:34 +01:00 |
|
|
frack113
|
cb67871bd2
|
Revert "Change status of old rules"
|
2023-01-26 19:37:18 +01:00 |
|
|
frack113
|
5323fd4baa
|
Change status of old rules
|
2023-01-25 18:41:18 +01:00 |
|
|
Nasreddine Bencherchali
|
ef0c3d35c4
|
fix: filter fp found in testing
|
2023-01-20 11:39:08 +01:00 |
|
|
Nasreddine Bencherchali
|
0909b65bff
|
feat: update sharing websites
|
2023-01-19 22:07:31 +01:00 |
|
|
Nasreddine Bencherchali
|
02e4a5112d
|
fix: fp found in testing
|
2023-01-18 18:41:07 +01:00 |
|
|
Nasreddine Bencherchali
|
81f75c1d2e
|
feat: updates and enhancements
|
2023-01-10 00:13:37 +01:00 |
|
|
frack113
|
aee5ca7afc
|
Fix invalid field cast or name (#3841)
|
2022-12-30 11:46:21 +01:00 |
|
|
frack113
|
7060db3d47
|
Promotion rules (#3821)
* Promotion rules
* fix missing null
* fix: modified date
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-12-27 12:29:10 +01:00 |
|
|
Nasreddine Bencherchali
|
1882a4a0c2
|
fix: remove unnecessary definition
|
2022-12-18 15:24:58 +01:00 |
|
|
orenebahar
|
021499e6ef
|
Update net_connection_win_malware_backconnect_ports.yml
Add description about the right event ID in sysmon configuration
|
2022-12-18 12:13:29 +00:00 |
|
|
Florian Roth
|
b1504c7632
|
fix: wrong condition
|
2022-12-15 19:02:56 +01:00 |
|
|
Florian Roth
|
84041dde1f
|
fix: FPs with wuauclt rule
|
2022-12-15 17:31:36 +01:00 |
|
|
Nasreddine Bencherchali
|
80ef3b70dc
|
fix: broken single item lists
|
2022-12-08 16:23:58 +01:00 |
|
|
Nasreddine Bencherchali
|
b6492e731b
|
feat: general updates and fixes
|
2022-12-02 23:16:03 +01:00 |
|
|
Nasreddine Bencherchali
|
b6dce4b6a5
|
feat: general fixes
|
2022-11-22 01:22:36 +01:00 |
|
|
Florian Roth
|
9bf023ceba
|
Merge pull request #3670 from nasbench/fix-false-positives
Aurora - Fix FP Found In Testing
|
2022-11-04 17:56:32 +01:00 |
|
|
Florian Roth
|
d254c7a514
|
Update rules/windows/network_connection/net_connection_win_ngrok_tunnel.yml
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-11-04 10:49:17 +01:00 |
|
|
Florian Roth
|
4fcac3089d
|
Rule: Ngrok tunnel LNX
|
2022-11-03 17:41:23 +01:00 |
|
|
Florian Roth
|
e6278f839b
|
Rule: Ngrok Tunnel Target
|
2022-11-03 17:38:53 +01:00 |
|
|
Nasreddine Bencherchali
|
5ee9428e59
|
Fix
|
2022-11-03 09:39:48 +01:00 |
|
|
frack113
|
a3eed2b760
|
Order yaml field
|
2022-10-26 09:42:26 +02:00 |
|
|
frack113
|
931fb30853
|
old experimental rule promotion
|
2022-10-09 16:54:04 +02:00 |
|
|
Florian Roth
|
b634e1a3f9
|
Merge pull request #3562 from nasbench/pysigma-fix
PySigma Issues Fix
|
2022-10-07 09:21:15 +02:00 |
|
|
frack113
|
7539d29e8b
|
Merge pull request #3559 from nasbench/nasbench-rule-devel
Rule Dev
|
2022-10-07 06:07:43 +02:00 |
|
|
Nasreddine Bencherchali
|
2c26614ce4
|
Update Wildcard + Int to Str fields
|
2022-10-05 23:15:20 +02:00 |
|
|
Nasreddine Bencherchali
|
40dcb9a4c9
|
Update + Rename
|
2022-10-05 10:42:29 +02:00 |
|
|
Nasreddine Bencherchali
|
2ecf9ec7e1
|
Updates
|
2022-10-04 20:57:11 +02:00 |
|
|
Florian Roth
|
50b9a3e073
|
fix: FPs with MS IPs
|
2022-10-04 19:21:41 +02:00 |
|
|
Nasreddine Bencherchali
|
7dd2af08e7
|
Update net_connection_win_python.yml
|
2022-09-21 12:16:15 +02:00 |
|
|
Nasreddine Bencherchali
|
a0c3449079
|
Fix typo
|
2022-09-21 11:59:12 +02:00 |
|
|
Nasreddine Bencherchali
|
59530f49d4
|
Fix more FP in testing
|
2022-09-21 11:53:39 +02:00 |
|
|
nasreddine.bencherchali@nextron-systems.com
|
0caeaaa122
|
Update rules
|
2022-09-13 10:02:32 +02:00 |
|
|
Florian Roth
|
efe4d62a54
|
Merge pull request #3459 from SigmaHQ/aurora-false-positive-fixing
Aurora false positive fixing
|
2022-09-06 08:41:02 +02:00 |
|
|
Florian Roth
|
cab6ccc18a
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-09-05 16:57:10 +02:00 |
|
|
Florian Roth
|
468b303660
|
Update net_connection_win_certutil.yml
|
2022-09-05 11:59:15 +02:00 |
|
|
frack113
|
5e5f3c803e
|
Fix tag
|
2022-09-02 17:32:50 +02:00 |
|
|
frack113
|
8f0ade9ad9
|
Fix name
|
2022-09-02 17:28:36 +02:00 |
|
|
frack113
|
693b7761c1
|
Add net_connection_win_certutil
|
2022-09-02 17:23:23 +02:00 |
|
|
Florian Roth
|
3ee77e1446
|
fix: FPs noticed with Aurora
|
2022-09-02 16:57:23 +02:00 |
|
|
Nasreddine Bencherchali
|
343b0ef199
|
Update net_connection_win_susp_cmstp.yml
|
2022-08-31 09:46:18 +02:00 |
|
|
Nasreddine Bencherchali
|
77c5640839
|
Update net_connection_win_susp_cmstp.yml
|
2022-08-31 09:42:25 +02:00 |
|