 Nasreddine Bencherchali
|
7abe4a7c50
|
Update proc_creation_win_nslookup_poweshell_download.yml
|
2022-09-06 16:42:53 +02:00 |
|
|
Tim Shelton
|
70f9a16149
|
FIX: fixes missing string indicator. does not pass validate() check inside base.py
|
2022-09-06 13:11:37 +00:00 |
|
|
Florian Roth
|
5de8a1b2f6
|
Merge pull request #3464 from YamatoSecurity/rule--nslookup-pwsh-download-cradle
rule add: nslookup pwsh download cradle
|
2022-09-06 11:21:15 +02:00 |
|
|
Florian Roth
|
4cdd5a5fec
|
Update proc_creation_win_nslookup_pwsh_download_cradle.yml
|
2022-09-06 10:53:10 +02:00 |
|
|
Florian Roth
|
d8d5ec09f2
|
Merge pull request #3463 from frack113/folder_exe
Add file_event_win_susp_executable_creation
|
2022-09-06 10:35:41 +02:00 |
|
|
Florian Roth
|
1fff6c3bb6
|
Merge branch 'master' into rule-devel
|
2022-09-06 09:40:07 +02:00 |
|
|
Florian Roth
|
c81f87c333
|
refactor: renamed sdelete and increased level
|
2022-09-06 09:39:45 +02:00 |
|
|
Florian Roth
|
65cc3b2dc8
|
Update file_event_win_susp_executable_creation.yml
|
2022-09-06 09:17:35 +02:00 |
|
|
Florian Roth
|
97d65f4bfd
|
Merge pull request #3465 from SigmaHQ/rule-devel
Havana Ransomware UA
|
2022-09-06 09:15:31 +02:00 |
|
|
Nasreddine Bencherchali
|
b70e42b206
|
Create proc_creation_win_inline_win_api_access.yml
|
2022-09-06 09:14:03 +02:00 |
|
|
Florian Roth
|
efe4d62a54
|
Merge pull request #3459 from SigmaHQ/aurora-false-positive-fixing
Aurora false positive fixing
|
2022-09-06 08:41:02 +02:00 |
|
|
Nasreddine Bencherchali
|
e7c53dafa1
|
New rules
|
2022-09-06 08:05:02 +02:00 |
|
|
Yamato Security
|
9abdc5ab38
|
update
|
2022-09-06 09:12:40 +09:00 |
|
|
Yamato Security
|
b90b4ad3a6
|
update
|
2022-09-06 09:03:43 +09:00 |
|
|
Yamato Security
|
a5f5992dcb
|
update
|
2022-09-06 08:59:20 +09:00 |
|
|
Yamato Security
|
7c0c8996c6
|
update
|
2022-09-06 08:56:39 +09:00 |
|
|
Yamato Security
|
ad6e085124
|
rule add: nslookup pwsh download cradle
|
2022-09-06 08:49:45 +09:00 |
|
|
Florian Roth
|
ab6e9551d9
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-09-05 23:01:43 +02:00 |
|
|
Florian Roth
|
f188b9abfd
|
fix: FPs with crypto miner cmdlines
|
2022-09-05 23:01:42 +02:00 |
|
|
Florian Roth
|
55d479302d
|
Merge pull request #3460 from frack113/certutil_net
Certutil network connection
|
2022-09-05 21:06:49 +02:00 |
|
|
frack113
|
26923f2d83
|
Add file_event_win_susp_executable_creation
|
2022-09-05 18:48:40 +02:00 |
|
|
Florian Roth
|
cab6ccc18a
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-09-05 16:57:10 +02:00 |
|
|
Florian Roth
|
96a55cc3cb
|
refactor: extend values
|
2022-09-05 16:52:01 +02:00 |
|
|
Florian Roth
|
7b5c887596
|
fix: FPs with File Creation Date Changed to Another Year
|
2022-09-05 16:50:49 +02:00 |
|
|
Florian Roth
|
b4cae0d551
|
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
|
2022-09-05 16:50:28 +02:00 |
|
|
Florian Roth
|
69308b035a
|
rule: havana ransomware UA
|
2022-09-05 16:50:26 +02:00 |
|
|
Florian Roth
|
468b303660
|
Update net_connection_win_certutil.yml
|
2022-09-05 11:59:15 +02:00 |
|
|
David André
|
8a595cd3fd
|
Merge branch 'SigmaHQ:master' into add_quotes_to_strings
|
2022-09-04 10:10:14 +02:00 |
|
|
frack113
|
92f694a013
|
Merge pull request #3461 from danielgottt/patch-8
Create proc_creation_win_ldifde_file_load.yml
|
2022-09-04 08:17:43 +02:00 |
|
|
Gott
|
38d6a52e4d
|
Update proc_creation_win_ldifde_file_load.yml
Implemented suggestions
|
2022-09-03 10:02:51 -04:00 |
|
|
Florian Roth
|
1af75b397d
|
fix: VSCode file permissions changes
|
2022-09-03 09:48:36 +02:00 |
|
|
Florian Roth
|
c7eddebe40
|
fix: Msiexec FPs noticed with Aurora
|
2022-09-03 09:30:24 +02:00 |
|
|
frack113
|
8162792c11
|
Merge pull request #3458 from frack113/frp
Add proc_creation_win_frp
|
2022-09-03 08:18:28 +02:00 |
|
|
frack113
|
fda96b4ea7
|
Merge pull request #3457 from nasbench/nasbench-rule-devel
Rule Devel (New+Update)
|
2022-09-03 08:18:03 +02:00 |
|
|
Gott
|
7530008f26
|
Create proc_creation_win_ldifde_file_load.yml
|
2022-09-02 19:18:52 -04:00 |
|
|
Nasreddine Bencherchali
|
1adbd8f0b3
|
Fix after review
|
2022-09-02 17:44:53 +02:00 |
|
|
frack113
|
99e3b5d440
|
Update proc_creation_win_frp.yml
|
2022-09-02 17:43:19 +02:00 |
|
|
Florian Roth
|
19d8cdbaed
|
Update proc_creation_win_susp_powershell_download_iex.yml
|
2022-09-02 17:36:54 +02:00 |
|
|
Florian Roth
|
168df94b73
|
Update proc_creation_win_susp_clsid_foldername.yml
|
2022-09-02 17:36:10 +02:00 |
|
|
frack113
|
5e5f3c803e
|
Fix tag
|
2022-09-02 17:32:50 +02:00 |
|
|
frack113
|
8f0ade9ad9
|
Fix name
|
2022-09-02 17:28:36 +02:00 |
|
|
Florian Roth
|
da6ca9ece7
|
Update proc_creation_win_certutil_ntlm_coercion.yml
|
2022-09-02 17:27:15 +02:00 |
|
|
Florian Roth
|
3d9d90f43e
|
Update win_susp_failed_admin_share_mount.yml
|
2022-09-02 17:24:28 +02:00 |
|
|
frack113
|
693b7761c1
|
Add net_connection_win_certutil
|
2022-09-02 17:23:23 +02:00 |
|
|
Florian Roth
|
dee6a6a7c8
|
Merge pull request #3451 from SigmaHQ/rule-devel
refactor: added extension to ransomware rule
|
2022-09-02 17:22:41 +02:00 |
|
|
Florian Roth
|
b33b2317c8
|
Update proc_creation_win_frp.yml
|
2022-09-02 17:22:23 +02:00 |
|
|
Florian Roth
|
3e1116bbfb
|
Update proc_creation_win_frp.yml
|
2022-09-02 17:19:27 +02:00 |
|
|
Florian Roth
|
6a6454cda9
|
fix: Health Service filter
|
2022-09-02 16:59:54 +02:00 |
|
|
Florian Roth
|
3ee77e1446
|
fix: FPs noticed with Aurora
|
2022-09-02 16:57:23 +02:00 |
|
|
Nasreddine Bencherchali
|
f6026b6972
|
Update proc_creation_win_susp_schtasks_disable.yml
|
2022-09-02 14:39:52 +02:00 |
|