18482601f3
Update and rename proc_creation_win_lolbin_fsianycpu.yml to proc_creation_win_lolbin_fsharp_interpreters.yml
2022-06-02 01:35:41 -04:00
2a62b35fd6
Create proc_creation_win_lolbin_fsianycpu.yml
2022-06-02 01:30:48 -04:00
f1925b8b42
Create proc_creation_win_lolbin_remote.yml
...
Let me know if anything needs to be changed.
2022-06-02 01:02:22 -04:00
ac89d4c00a
Update proc_creation_win_lolbin_visualuiaverifynative.yml
2022-06-02 00:44:38 -04:00
f9cee726cb
Rename proc_creation_win_lolbin_VisualUiaVerifyNative.yml to proc_creation_win_lolbin_visualuiaverifynative.yml
2022-06-02 06:25:00 +02:00
2b3007f1d0
Create proc_creation_win_lolbin_VisualUiaVerifyNative.yml
2022-06-02 00:09:13 -04:00
17ad4a33da
Rename proc_creation_win_lolbin_wfc.exe.yml to proc_creation_win_lolbin_wfc.yml
2022-06-02 00:06:16 -04:00
60a10806e2
Create proc_creation_win_lolbin_wfc.exe.yml
2022-06-01 23:59:00 -04:00
f79263fc3a
Merge pull request #3072 from pH-T/master
...
new rules
2022-06-01 18:56:53 +02:00
c900315145
new rules accompanying Follina exploits
2022-06-01 17:22:11 +02:00
30225cab11
Update proc_creation_win_msdt.yml
...
- Add MITRE tag
2022-06-01 16:00:43 +01:00
7c9210a119
Update proc_creation_win_msdt.yml
2022-06-01 15:55:12 +01:00
6aad923023
Fix typo and Update Rule
...
- Fixed typo in PowerShell definition to "enabled"
- Removed leading space from "/af" flag in "msdt" rule as it can be used without leading space.
2022-06-01 15:54:40 +01:00
fb63c3292a
refining some rules for Follina
2022-06-01 14:44:40 +02:00
7f7bf54ba6
Merge branch 'master' of github.com:pH-T/sigma
2022-06-01 13:32:06 +02:00
322468b35b
fix: added detection
2022-06-01 13:31:57 +02:00
a0aff0f680
Update proc_creation_win_susp_base64_load.yml
2022-06-01 13:06:17 +02:00
017813d3fa
new rules
2022-06-01 11:50:34 +02:00
587b5aa6a7
Merge pull request #3070 from leegengyu/patch-1
...
Update proc_creation_win_susp_conhost_option.yml - Remove Empty Reference Line
2022-06-01 06:34:51 +02:00
5ac620b555
Merge pull request #3069 from redsand/fp_UserInitMprLogonScript_citrix_icast
...
FP: citrix icast default userinit logon script.
2022-06-01 06:29:16 +02:00
da044e5cb8
Update proc_creation_win_susp_conhost_option.yml
...
Remove empty line reference.
2022-06-01 09:39:03 +08:00
6d68d5bfb0
FP: citrix icast default userinit logon script.
2022-05-31 21:53:13 +00:00
40f4ab328a
Update proc_creation_win_msdt.yml
...
- Added possible answer flag "/af" for possible execution with answer files.
- Removed the parent selection as it's already covered by the rule: 23daeb52-e6eb-493c-8607-c4f0246cb7d8
2022-05-31 21:48:01 +01:00
9586863433
Update proc_creation_win_msdt.yml
2022-05-31 10:11:09 +01:00
14d81bae06
Update proc_creation_win_msdt.yml
2022-05-31 09:46:40 +01:00
1e16ed0090
Merge pull request #3055 from phantinuss/master
...
Rule Harmonization
2022-05-31 08:27:35 +02:00
4010249934
update date
2022-05-30 11:24:54 +02:00
204df4b094
Merge pull request #3057 from frack113/lolbas_20220528
...
Lolbas
2022-05-30 08:46:46 +02:00
41d5ea5042
Update proc_creation_win_lolbas_utilityfunctions.yml
2022-05-30 08:35:06 +02:00
6e41ecdaaf
Merge pull request #3059 from c3rb3ru5d3d53c/patch-1
...
Follina — a Microsoft Office code execution vulnerability
2022-05-30 06:50:53 +02:00
18dc60858a
Fix selection1
2022-05-30 06:44:45 +02:00
7cd648a1ed
Update proc_creation_win_lolbins_by_office_applications.yml
...
https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
2022-05-29 21:28:35 -03:00
e9d18b5075
Create proc_creation_win_msdt.yml
2022-05-29 12:53:45 +01:00
7897192050
Merge branch 'master' of github.com:frack113/sigma into lolbas_20220528
2022-05-28 17:05:39 +02:00
b243c65d8a
Fix date
2022-05-28 17:04:12 +02:00
5b2ab692dc
Lolbas rule
2022-05-28 16:54:45 +02:00
7266c9ff62
fix: specify for local system user
2022-05-27 15:46:56 +02:00
54c2977ddb
chore: harmonize wuauclt rules - kept the oldest, most generic, highest level one
2022-05-27 15:16:31 +02:00
32169dbc33
chore: harmonization of generic 'nt system' user checks
...
also a simple (non-commprehensive) test case to find
usages of localized user names
2022-05-27 15:16:31 +02:00
5e2e776bce
Adjusting condition
2022-05-26 18:38:12 +00:00
48e37241dd
FP: IBM ClientSolutions is valid directory
2022-05-26 18:25:43 +00:00
2bff1eaaa7
Merge branch 'master' of https://github.com/CD-R0M/sigma-1
2022-05-25 17:31:24 -04:00
2030a6fddc
Update proc_creation_win_susp_rundll32_spawn_explorer.yml
2022-05-25 17:30:58 -04:00
bd5935ffb5
Merge branch 'SigmaHQ:master' into master
2022-05-25 17:27:20 -04:00
af45f06d58
Filter for Dell Display Manager Child Process
...
Adding filter for Rundll32.exe command line spawned by ddm.exe (Dell Display Manager).
2022-05-25 17:26:26 -04:00
b80eb411ab
Merge pull request #3032 from frack113/lolbin_20220522
...
Add lolbas cl script
2022-05-25 12:02:44 +02:00
e475deaf4d
Update proc_creation_win_lolbas_cl_mutexverifiers.yml
2022-05-25 11:56:52 +02:00
3bdf29033a
Update proc_creation_win_lolbas_cl_loadassembly.yml
2022-05-25 11:55:37 +02:00
f737ba6e95
Fix duplicate cast
2022-05-25 11:19:09 +02:00
c7b90f108f
Merge pull request #3039 from jstnk9/master
...
New sigma rule to detect the use of Jlaive antivirus defense evasion
2022-05-24 20:25:42 +02:00
securepeacock