 stvetro
|
500fcfbcbe
|
Generated guid
|
2020-10-09 15:42:05 +04:00 |
|
|
stvetro
|
f6ce48a1be
|
newline addded
|
2020-10-09 15:39:59 +04:00 |
|
|
stvetro
|
06c7d29f86
|
[OSCD] Two LOLBins: ftp.exe and Runscripthelper.exe
Tasks 45 and 81 from https://github.com/Neo23x0/sigma/issues/1014
|
2020-10-09 15:38:01 +04:00 |
|
|
Furkan ÇALIŞKAN
|
a6112dc268
|
Fixed OSCD wording
|
2020-10-09 11:59:08 +03:00 |
|
|
Yuliya Fomina
|
8eb8b996e4
|
sintax fix
|
2020-10-09 10:43:16 +03:00 |
|
|
Ivan Dyachkov
|
a88f7df704
|
fix tag 4
|
2020-10-09 10:37:51 +03:00 |
|
|
Ivan Dyachkov
|
dbb80b1482
|
fix tag 3
|
2020-10-09 10:34:15 +03:00 |
|
|
Yuliya Fomina
|
44fa88c2a7
|
Create win_susp_rpcping
|
2020-10-09 10:33:21 +03:00 |
|
|
Ivan Dyachkov
|
347978fc8a
|
fix tags 2
|
2020-10-09 10:31:07 +03:00 |
|
|
Ivan Dyachkov
|
c422ae4c1e
|
fixed tags
|
2020-10-09 10:25:45 +03:00 |
|
|
Ivan Dyachkov
|
40a8a9ea04
|
Added rule win_susp_diskshadow
|
2020-10-09 10:19:39 +03:00 |
|
|
Ensar Şamil
|
c3851710d1
|
Update win_class_exec_xwizard.yml
|
2020-10-09 09:38:14 +03:00 |
|
|
Ensar Şamil
|
4f49171b55
|
Update win_visual_basic_compiler.yml
author and selection fields edited
|
2020-10-09 09:35:33 +03:00 |
|
|
Furkan ÇALIŞKAN
|
abcc4a59c2
|
Fixed OSCD wording
|
2020-10-09 09:26:01 +03:00 |
|
|
Furkan ÇALIŞKAN
|
789a0c174f
|
Fixed OSCD wording
|
2020-10-09 09:25:38 +03:00 |
|
|
Vasilisa-L
|
1738316741
|
Update on help keys in cmd
|
2020-10-09 09:23:35 +03:00 |
|
|
svch0stz
|
0856170073
|
Update win_susp_mounted_share_deletion.yml
|
2020-10-09 11:42:06 +11:00 |
|
|
svch0stz
|
1088a2865b
|
Update win_susp_mounted_share_deletion.yml
|
2020-10-09 11:40:57 +11:00 |
|
|
Kirill Kiryanov
|
04d56bade4
|
Removed redundant tag
|
2020-10-08 23:26:51 +03:00 |
|
|
Kirill Kiryanov
|
d00e1073ee
|
Revert "Created rule win_susp_presentationhost_execution.yml"
This reverts commit a38c021876.
|
2020-10-08 22:49:52 +03:00 |
|
|
Ryan Plas
|
5e1075b656
|
Update Powershell section
|
2020-10-08 15:19:42 -04:00 |
|
|
Jonhnathan
|
1695bc56dc
|
Remove commas
|
2020-10-08 15:31:17 -03:00 |
|
|
Craig Young
|
6cd9be66ed
|
Adding all modifier
|
2020-10-08 12:57:09 -04:00 |
|
|
Nikita P. Nazarov
|
60997b0243
|
Detects Obfuscated Powershell via use MSHTA in Scripts
|
2020-10-08 18:26:08 +03:00 |
|
|
Nikita P. Nazarov
|
47c22d0443
|
Detects Obfuscated Powershell via use Rundll32 in Scripts
|
2020-10-08 18:06:41 +03:00 |
|
|
esebese
|
ba96efc25e
|
[OSCD]win_pe_exec_vsjitdebugger.yml added
|
2020-10-08 17:28:20 +03:00 |
|
|
Sander
|
e6ad52c102
|
Corrected falsepositives
|
2020-10-08 15:11:57 +02:00 |
|
|
Sander
|
0e07ea3e70
|
Corrected author
|
2020-10-08 15:04:09 +02:00 |
|
|
Sander
|
539400c384
|
Creation of win_regini
|
2020-10-08 14:47:22 +02:00 |
|
|
Kirill Kiryanov
|
7e28bf4df8
|
Fixed title format
|
2020-10-08 14:38:47 +03:00 |
|
|
Kirill Kiryanov
|
55ea538841
|
Created rule win_susp_sqldumper_activity.yml
|
2020-10-08 14:29:21 +03:00 |
|
|
Kirill Kiryanov
|
a09488a90f
|
revert changes for making new pull request
|
2020-10-08 14:20:32 +03:00 |
|
|
Kirill Kiryanov
|
1581be1ec2
|
Created rule win_susp_sqldumper_activity.yml
|
2020-10-08 14:00:43 +03:00 |
|
|
Kirill Kiryanov
|
a38c021876
|
Created rule win_susp_presentationhost_execution.yml
|
2020-10-08 13:24:59 +03:00 |
|
|
Yuliya Fomina
|
785f7e32e3
|
typo, - script extention
|
2020-10-08 10:13:20 +03:00 |
|
|
Yuliya Fomina
|
aba6cd26ca
|
Delete regex
|
2020-10-08 10:01:41 +03:00 |
|
|
Jonhnathan
|
8d94e993ab
|
Update win_susp_rundll32_activity.yml
|
2020-10-07 18:27:25 -03:00 |
|
|
Jonhnathan
|
109b1ea9cf
|
Revert "Create win_susp_replace_lolbin.yml"
This reverts commit e6a6549676.
|
2020-10-07 18:26:11 -03:00 |
|
|
Jonhnathan
|
15bd7dcd3b
|
Revert "Changed the rule to download only and not the copy"
This reverts commit 1324bc1ad1.
|
2020-10-07 18:26:04 -03:00 |
|
|
Semanur Guneysu
|
357d4bd895
|
Update sysmon_abusing_debug_privilege.yml
|
2020-10-07 23:34:03 +03:00 |
|
|
Craig Young
|
deb8db8599
|
Adding extension
Woops
|
2020-10-07 16:05:58 -04:00 |
|
|
Craig Young
|
a0dfde8478
|
Added UUID
|
2020-10-07 16:01:53 -04:00 |
|
|
esebese
|
127bc075b0
|
[OSCD] win_class_exec_xwizard.yml added
|
2020-10-07 22:49:12 +03:00 |
|
|
Craig Young
|
aea3c13d01
|
Initial commit
Other parameters besides \query may also be useful for credential dumping. This should be researched.
|
2020-10-07 15:33:26 -04:00 |
|
|
Jonhnathan
|
1324bc1ad1
|
Changed the rule to download only and not the copy
|
2020-10-07 16:18:21 -03:00 |
|
|
Furkan CALISKAN
|
1c413bcf6d
|
Fixed status
|
2020-10-07 20:45:34 +03:00 |
|
|
Semanur Guneysu
|
8696b3ba18
|
Update sysmon_abusing_debug_privilege.yml
|
2020-10-07 19:32:05 +03:00 |
|
|
Ryan Plas
|
7b64ab552f
|
Capitalize Title
|
2020-10-07 10:51:55 -04:00 |
|
|
Ryan Plas
|
2d30379ab2
|
Move to process_creation category
|
2020-10-07 10:47:40 -04:00 |
|
|
Yuliya Fomina
|
df51044c90
|
Rule collection implemented
|
2020-10-07 17:35:14 +03:00 |
|