ff08de6d20
Completed Changes based on review
...
selection2:
ParentPrcessName|endswith:
2021-09-09 21:02:11 -06:00
d9cd1652f2
Split global sysmon rules
2021-09-09 16:11:41 +02:00
312ffe69e2
Update Monitor_LOLBins_process_creations_with_Wmiprvse_parent_process.yml
2021-09-09 06:28:48 +02:00
b2c44ebd6e
Changed selection1
...
completed the following change to selection1 to keep inline with rule creation guideline
- CommandLine|contains: 'wmic '
2021-09-08 21:27:15 -06:00
fe9b91c504
Completed changes to selection1
...
changed to the following to follow rule creation guidelines:
- Image|endswith: '\wbem\WMIC.exe'
- ProcessCommandLine|contains: 'wmic '
2021-09-08 21:26:01 -06:00
851dfeee46
Changed selection2 condition
...
changed from "\\wbem\\WmiPrvSE.exe" to "\wbem\WmiPrvSE.exe" to follow rule creation guidelines
2021-09-08 21:24:18 -06:00
6ddc83901b
Changed Category
...
Category Changed from process_creation to file_event
2021-09-08 20:38:07 -06:00
5ac0fded26
Merge branch 'SigmaHQ:master' into master
2021-09-08 20:26:59 -06:00
e712d9696b
Merge pull request #2000 from frack113/split_global
...
Split frack113 global rules
2021-09-08 06:26:35 +02:00
e3b376e945
Completed Changes Based on Comments
...
Removed :
unnecessary event ID
2021-09-07 21:26:42 -06:00
4130ceb208
Completed Changes Based on Comments
...
Removed :
unnecessary event ID
2021-09-07 21:25:52 -06:00
8d47f9531b
Completed Changes Based on Comments
...
Removed :
unnecessary event ID
2021-09-07 21:22:01 -06:00
13e6262055
Completed Changes Based on Comments
...
Removed :
unnecessary event ID
2021-09-07 21:20:51 -06:00
8dc1b03fef
Completed Changes Based on Comments
...
Removed :
unnecessary event ID
2021-09-07 21:19:43 -06:00
932b7cf2ba
Merge branch 'SigmaHQ:master' into master
2021-09-07 19:58:09 -06:00
143744bc12
Various fixes
...
* Backslashes in regular expressions
* Casing of condition operators
* Further small errors
2021-09-07 23:38:07 +02:00
0e5e4fa19d
Split global rules
2021-09-07 13:30:32 +02:00
be442182fe
convert to LF
2021-09-06 21:10:08 +02:00
9ef299c4f4
Change to LF
2021-09-06 21:07:49 +02:00
d02ee1eddd
Update global ID
2021-09-02 21:16:55 +02:00
f90c7558a7
update global id
2021-09-02 21:03:25 +02:00
086a15fc45
Update global ID
2021-09-02 20:07:03 +02:00
c5507658c0
Updated Rule
...
updated title
2021-08-31 22:13:31 -06:00
785fc98ee3
Updated Rule
...
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
- Removed the service: Sysmon, updated selection1.
2021-08-31 22:05:10 -06:00
d5f73a8910
Updated Rule
...
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
- Removed the service: Sysmon, updated selection1.
2021-08-31 22:03:31 -06:00
fa3b882fdc
Updated Rule
...
Removed " " from falsepositives section
2021-08-31 21:58:50 -06:00
c7c49c55d2
Updated Rule
...
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
- Removed the service: Sysmon, updated selection1.
2021-08-31 21:58:09 -06:00
d5fa226180
Updated Rule
...
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated author
- updated description in detection section.
- Removed the service: Sysmon, updated selection1.
2021-08-31 21:54:32 -06:00
900f71e6b2
Rule Update Review
...
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
- Removed the service: Sysmon, updated selection1.
2021-08-31 21:50:44 -06:00
6c9b2a2f37
Add files via upload
2021-08-30 21:48:03 -06:00
a4021842de
Fix invalid tags
2021-08-25 09:15:57 +02:00
c2302a15da
fix cve tags
2021-08-24 10:10:45 +02:00
6f05e33feb
fix: Correct incorrect message / keyword usage
...
Correct a number of rules where message or keyword were incorrectly used
as field names in events (typically windows event logs). However, neither
field actually exists and as such these strings could never match.
2021-08-12 16:28:07 +02:00
cf8d8d3ed4
fix TargetFilename case error
2021-08-06 08:43:05 +02:00
d3a1fb8565
Update sysmon_cve_2021_31979_cve_2021_33771_exploits.yml
2021-07-17 06:49:37 +07:00
5e84a603d0
Update sysmon_cve_2021_31979_cve_2021_33771_exploits.yml
2021-07-17 01:04:07 +07:00
a3c4aa5dad
Update sysmon_cve_2021_31979_cve_2021_33771_exploits.yml
2021-07-17 01:02:14 +07:00
eea3675d4e
Rename sysmon_cve_2021_31979_cve-2021_33771_exploits.yml to sysmon_cve_2021_31979_cve_2021_33771_exploits.yml
2021-07-17 00:09:04 +07:00
90fc50e0a2
Update and rename sysmon_devilstongue_CVE_2021_31979_exploit.yml to sysmon_cve_2021_31979_cve-2021_33771_exploits.yml
...
rename sysmon_cve_2021_31979_cve-2021_33771_exploits.yml
2021-07-17 00:02:15 +07:00
9fb589201e
Update and rename sysmon_devilstongue_exploit_0day.yml to sysmon_devilstongue_CVE_2021_31979_exploit.yml
...
Change Title
2021-07-16 23:47:14 +07:00
f2187f05e6
Update and rename sysmon_devilstongue_CVE_2021_31979_CVE_2021_33771.yml to sysmon_devilstongue_exploit_0day.yml
2021-07-16 23:42:05 +07:00
91295cff21
Update sysmon_devilstongue_CVE_2021_31979_CVE_2021_33771.yml
2021-07-16 23:35:31 +07:00
dac72e2750
Update and rename sysmon_exploit_CVE_2021_31979_CVE_2021_33771.yml to sysmon_devilstongue_CVE_2021_31979_CVE_2021_33771.yml
2021-07-16 23:30:05 +07:00
10b7b6d640
Update sysmon_exploit_CVE_2021_31979_CVE_2021_33771.yml
2021-07-16 23:11:14 +07:00
94ba194b42
Update sysmon_exploit_CVE_2021_31979_CVE_2021_33771.yml
2021-07-16 23:09:51 +07:00
477ec060d2
Update and rename sysmon_susp_devilstongue_CVE_2021_31979_CVE_2021_33771.yml to sysmon_exploit_CVE_2021_31979_CVE_2021_33771.yml
2021-07-16 22:47:04 +07:00
99e5990416
Update sysmon_susp_devilstongue_CVE_2021_31979_CVE_2021_33771.yml
2021-07-16 22:30:06 +07:00
dc94c4e51e
Update sysmon_susp_devilstongue_CVE_2021_31979_CVE_2021_33771.yml
2021-07-16 22:21:34 +07:00
0954163e9d
Update sysmon_susp_devilstongue_CVE_2021_31979_CVE_2021_33771.yml
2021-07-16 22:19:07 +07:00
e094c76098
Update sysmon_susp_devilstongue_CVE_2021_31979_CVE_2021_33771.yml
2021-07-16 22:14:22 +07:00
Cyb3rEng