 Roberto Rodriguez
|
7543b3e2a6
|
added definition to Sysmon 13.30 rule for priv escalation
|
2021-10-27 11:56:19 -04:00 |
|
|
frack113
|
c228cde0cb
|
Move to correct directory
|
2021-10-27 14:38:51 +02:00 |
|
|
phantinuss
|
8b12794486
|
fix: change title and filename
|
2021-10-27 14:07:27 +02:00 |
|
|
phantinuss
|
eb4ef6bcfc
|
fix: single list item to value
|
2021-10-27 11:16:12 +02:00 |
|
|
Roberto Rodriguez
|
d80f73625f
|
Added the right System string to User filter
|
2021-10-27 01:22:19 -04:00 |
|
|
Roberto Rodriguez
|
9c7a736ca6
|
added integrity level for user
|
2021-10-27 01:06:37 -04:00 |
|
|
Roberto Rodriguez
|
5aac1b6879
|
Unsupported rule now possible with Sysmonv13.30
|
2021-10-27 01:04:24 -04:00 |
|
|
frack113
|
bba1e68669
|
Merge pull request #2200 from frack113/susp_del
add process_creation_susp_del
|
2021-10-27 06:33:04 +02:00 |
|
|
frack113
|
98d7380a40
|
Merge pull request #2197 from frack113/fix_title
Fix title process_creation_powershell_web_request
|
2021-10-27 06:31:45 +02:00 |
|
|
Florian Roth
|
fcecb951d5
|
Merge branch 'master' into rule-devel
|
2021-10-26 22:03:55 +02:00 |
|
|
phantinuss
|
3983baf2b0
|
windows commandline obfuscation
|
2021-10-26 16:35:06 +02:00 |
|
|
frack113
|
79399db2b8
|
add process_creation_susp_del
|
2021-10-26 13:17:56 +02:00 |
|
|
frack113
|
765acac374
|
Merge pull request #2195 from frack113/cve_attack
CVE attack
|
2021-10-26 10:40:13 +02:00 |
|
|
Florian Roth
|
ab499c9c21
|
rules: crypto coin mining
|
2021-10-26 08:52:07 +02:00 |
|
|
frack113
|
7c9da11fa7
|
fix title
|
2021-10-26 06:49:44 +02:00 |
|
|
frack113
|
4bcde17e00
|
Fix title
|
2021-10-26 06:49:05 +02:00 |
|
|
frack113
|
9e61ad2592
|
Merge pull request #2189 from austinsonger/windows_suspicious_rclone_execution
win_susp_rclone_execution.yml
|
2021-10-25 21:20:00 +02:00 |
|
|
frack113
|
8eee468cc3
|
Add detect_by_option
|
2021-10-25 20:49:30 +02:00 |
|
|
frack113
|
b3df5bf325
|
Merge pull request #2192 from frack113/update_win_shadow_copies_deletion
Update win_shadow_copies_deletion.yml
|
2021-10-25 20:29:48 +02:00 |
|
|
frack113
|
f8574fcd81
|
Add cve tags
|
2021-10-25 18:40:50 +02:00 |
|
|
frack113
|
162d869e2b
|
Add cve tags
|
2021-10-25 18:14:03 +02:00 |
|
|
frack113
|
9ff310541a
|
add selection3
|
2021-10-24 20:14:44 +02:00 |
|
|
frack113
|
9065485855
|
update detection
|
2021-10-24 20:12:55 +02:00 |
|
|
frack113
|
db640f6080
|
Update win_susp_rclone_execution.yml
|
2021-10-24 18:47:04 +02:00 |
|
|
Austin Songer
|
85d7cb6f3e
|
Update process_creation_certoc_execution.yml
|
2021-10-24 11:06:51 -05:00 |
|
|
Austin Songer
|
5ded3e681c
|
Update win_susp_rclone_execution.yml
|
2021-10-24 11:04:34 -05:00 |
|
|
Austin Songer
|
9664ec4c35
|
Update win_susp_rclone_execution.yml
|
2021-10-23 19:59:37 -05:00 |
|
|
Austin Songer
|
c8383901e1
|
Update win_susp_rclone_execution.yml
|
2021-10-23 19:56:43 -05:00 |
|
|
Austin Songer
|
2d781ac20b
|
Rename win_suspicious_rclone_execution.yml to win_susp_rclone_execution.yml
|
2021-10-23 19:55:19 -05:00 |
|
|
Austin Songer
|
05fcc0d890
|
Rename windows_suspicious_rclone_execution.yml to win_suspicious_rclone_execution.yml
|
2021-10-23 19:52:37 -05:00 |
|
|
Austin Songer
|
2f5e235dfe
|
Delete sysmon_rclone_execution.yml
|
2021-10-23 19:51:59 -05:00 |
|
|
Austin Songer
|
a771549057
|
Delete win_susp_rclone_exec.yml
|
2021-10-23 19:51:50 -05:00 |
|
|
Austin Songer
|
76aa8bf904
|
Create windows_suspicious_rclone_execution.yml
|
2021-10-23 19:50:03 -05:00 |
|
|
Austin Songer
|
a78d6cce5f
|
Create process_creation_certoc_execution.yml
|
2021-10-23 14:10:40 -05:00 |
|
|
Austin Songer
|
b946106103
|
Delete process_creation_certoc_execution.yml
|
2021-10-23 14:09:58 -05:00 |
|
|
Austin Songer
|
4803d61f7f
|
Create process_creation_certoc_execution.yml
|
2021-10-23 14:09:28 -05:00 |
|
|
Maxime THIEBAUT
|
9c25c89dbb
|
Add LOLBin rule win_susp_workfolders
|
2021-10-21 11:43:27 +02:00 |
|
|
frack113
|
f61127f04e
|
Merge pull request #2157 from frack113/update_wmic_uninstall
win_susp_wmic_security_product_uninstall update product list
|
2021-10-19 14:24:09 +02:00 |
|
|
phantinuss
|
deecced962
|
fix: FP tuning when CommandLine logging is not activated for 4688 events
|
2021-10-19 13:37:28 +02:00 |
|
|
frack113
|
40e8dc506a
|
update product list
|
2021-10-18 11:19:18 +02:00 |
|
|
frack113
|
a8a0d546f3
|
Merge pull request #2113 from austinsonger/process_creation_lolbins_suspicious_driver_install_by_pnputil.yml
process_creation_lolbins_suspicious_driver_installed_by_pnputil.yml
|
2021-10-17 08:10:18 +01:00 |
|
|
frack113
|
5756888b1b
|
adds the alternative options
|
2021-10-17 08:33:32 +02:00 |
|
|
frack113
|
5aa62bd342
|
fix yml
|
2021-10-12 21:02:15 +02:00 |
|
|
frack113
|
37c637066b
|
add process_creation_conti_cmd_ransomware.yml
|
2021-10-12 20:57:12 +02:00 |
|
|
frack113
|
7497fdb484
|
Merge pull request #2129 from d4rk-d4nph3/master
Added rule for possible persistence via VMTools
|
2021-10-10 10:55:06 +02:00 |
|
|
Bhabesh Rai
|
a241f526ef
|
Added more strict path
|
2021-10-10 07:54:40 +05:45 |
|
|
Bhabesh Rai
|
a45e516f99
|
Added rule for possible persistence via VMTools
|
2021-10-08 13:28:35 +05:45 |
|
|
Mika Luhta
|
e70d17745e
|
Update modified field
|
2021-10-07 18:42:22 +02:00 |
|
|
Mika Luhta
|
0ee777e3b4
|
Fix rule detection logic
Changed ParentImage to Image
|
2021-10-07 14:25:18 +03:00 |
|
|
frack113
|
4f86a245f8
|
Order file i correct directory
|
2021-10-05 07:30:43 +02:00 |
|