fc44b0999b
Update proc_creation_win_lolbin_mftrace.yml
2022-06-09 18:47:53 +01:00
a934f587d4
Update proc_creation_win_lolbin_mftrace.yml
2022-06-09 18:04:35 +01:00
78bdfa85a9
Fix
2022-06-09 18:00:24 +01:00
f4b0dd69f1
Update proc_creation_win_lolbin_adplus.yml
2022-06-09 16:15:28 +01:00
0a0e976ccf
Update proc_creation_win_susp_dxcap.yml
2022-06-09 15:58:52 +01:00
87e813a649
Update proc_creation_win_lolbin_squirrel.yml
2022-06-09 15:58:22 +01:00
4561d86d81
New/Update LOLBIN Rules
2022-06-09 15:56:33 +01:00
e6cf3d34d1
Update modified
2022-06-09 13:27:07 +02:00
ffcf5872c5
Update proc_creation_win_susp_recon_activity.yml
2022-06-09 20:34:25 +10:00
54b1baa188
Add proc_creation_win_msdt_diagcab
2022-06-09 08:57:51 +02:00
c1a601fef8
Update proc_creation_win_susp_recon_activity.yml
...
Using "/do" is still a valid argument . looking for /dom will exclude this.
Other option is to remove the "/do" argument and just look for cmdline contains:
- net group "domain admins"
https://twitter.com/TheDFIRReport/status/1534227586225684481
2022-06-09 10:14:57 +10:00
7f61789082
rule: renamed rundll32.exe
2022-06-08 17:23:29 +02:00
1abfc46f6f
fix: casing of OriginalFileName
2022-06-08 17:14:49 +02:00
c9a5747fc4
rule: archiver > iso/img phishing indicator
2022-06-08 16:30:17 +02:00
7b8c4e2a78
Update proc_creation_win_tool_nsudo_execution.yml
2022-06-07 17:00:35 +01:00
e4fb5d6fb9
Update proc_creation_win_tool_nsudo_execution.yml
2022-06-07 14:51:25 +01:00
452bf6424e
Renamed file to reflect broader meaning
2022-06-07 14:46:38 +01:00
093f738d41
Update proc_creation_win_tool_nsudo_as_system.yml
2022-06-07 14:39:29 +01:00
c7b5eb65b0
Update proc_creation_win_renamed_plink.yml
2022-06-07 10:43:23 +02:00
7327dd53e5
New/Update Rules
...
- Renamed "sql_injection_keywords.yml" to "web_sql_injection_keywords.yml" to conform with the rest of the rule in the WEB directory
- Renamed "xss_keywords.yml" to "web_xss_keywords.yml" to conform with the rest of the rule in the WEB directory
- Renamed "proc_create_win_msdt_susp_parent.yml" to "proc_creation_win_msdt_susp_parent.yml" to conform with other process creation rules
- Renamed "proc_create_win_sdiagnhost_susp_child.yml" to "proc_creation_win_sdiagnhost_susp_child.yml" to conform with other process creation rules
- Moved the rule "win_powershell_snapins_hafnium.yml" to process_creation folder instead of the WEB folder
- Created "web_susp_windows_path_uri.yml" to detect URI that contains susp windows paths
- Updated the description "web_webshell_keyword.yml" and added 3 more cases
- Created "file_event_win_cve_2021_44077_poc_default_files.yml" to detect the default dropped file from the POC of CVE-2021-44077 (Showcased in the DFIR report)
- Created "proc_creation_win_renamed_plink.yml" to detect renamed usage of "Plink"
2022-06-06 21:16:52 +01:00
6b34764215
Merge pull request #3097 from frack113/user32
...
Add proc_creation_win_susp_rundll32_user32_dll
2022-06-04 18:35:56 +02:00
1e64a05fde
Update proc_creation_win_susp_rundll32_user32_dll.yml
2022-06-04 13:29:37 +02:00
c0c9bdb8f7
fix: missing selection in condition
2022-06-04 12:52:30 +02:00
7bd4d68580
Merge branch 'master' into aurora-false-positive-fixing
2022-06-04 12:52:14 +02:00
6d9587dab2
fix: Aurora FPs / NVidia driver update
2022-06-04 12:44:51 +02:00
e4499caa4e
Add proc_creation_win_susp_rundll32_user32_dll
2022-06-04 11:48:44 +02:00
36e5400b39
Rules Update
...
- Updated "proc_creation_win_susp_wmic_security_product_uninstall" with more AV and CLI variants.
- Updated "egistry_set_disable_fonction_user" with more interesting registry locations
2022-06-03 20:29:59 +01:00
cdc06238cd
Merge pull request #3088 from pH-T/master
...
new rules for msdt cloaking
2022-06-03 17:09:44 +02:00
07628f6795
Update proc_creation_win_renamed_msdt.yml
2022-06-03 17:03:33 +02:00
c2c1a2dcb7
Merge pull request #3090 from frack113/refractor_condition
...
Refactor condition
2022-06-03 17:02:31 +02:00
1ba6dab453
Update proc_creation_win_renamed_msdt.yml
2022-06-03 15:42:43 +02:00
8de0027ca3
refactor condition
2022-06-03 15:35:24 +02:00
1cb985487c
windows and linux python pty spawning
2022-06-03 12:17:33 +02:00
30cc5f4623
new rule for office directory traversal
2022-06-03 12:17:33 +02:00
79cc5f73ea
add more suspicious child processes / relevant parent processes
2022-06-03 12:17:33 +02:00
f9b895759b
new rules for msdt cloaking
2022-06-03 12:14:14 +02:00
0db42c0ca6
Merge pull request #3080 from securepeacock/patch-20
...
Create proc_creation_win_lolbin_fsianycpu.yml
2022-06-02 17:22:00 +02:00
50d1093677
Merge pull request #3082 from secDre4mer/master
...
feat: Add rule for renamed browser core execution
2022-06-02 17:17:42 +02:00
294c71ebde
Update proc_creation_win_lolbin_fsharp_interpreters.yml
2022-06-02 17:15:15 +02:00
419fb2e8b9
Merge pull request #3079 from securepeacock/patch-19
...
Create proc_creation_win_lolbin_remote.yml
2022-06-02 17:14:02 +02:00
d849ece51e
feat: Add rule for renamed browser core execution
2022-06-02 14:17:02 +01:00
7811a79833
Update proc_creation_win_lolbin_fsharp_interpreters.yml
2022-06-02 09:01:07 -04:00
26838d9b0d
Update proc_creation_win_lolbin_remote.yml
2022-06-02 09:00:22 -04:00
fd28f0b04e
Merge branch 'SigmaHQ:master' into master
2022-06-02 13:39:23 +01:00
97856b562a
Add "\" to "Image|endswith" modifier
...
- Added the "\\" (backslash) for the "(Parent)Image|endswith" modifiers to avoid possible confusion.
- The modification were mostly done on default windows binaries to avoid changing logic of other rules.
2022-06-02 13:39:07 +01:00
320ddcb676
Merge pull request #3077 from securepeacock/patch-16
...
Create proc_creation_win_lolbin_wfc.yml
2022-06-02 13:59:22 +02:00
a06fbc9371
Merge pull request #3078 from securepeacock/patch-17
...
Create proc_creation_win_lolbin_VisualUiaVerifyNative.yml
2022-06-02 13:58:54 +02:00
d34b4080d5
Update proc_creation_win_lolbin_wfc.yml
2022-06-02 13:47:11 +02:00
169b85f9ef
Update proc_creation_win_lolbin_visualuiaverifynative.yml
2022-06-02 13:43:01 +02:00
a4255091b9
Merge pull request #3066 from phantinuss/master
...
refining some rules for Follina
2022-06-02 13:40:27 +02:00
Nasreddine Bencherchali