 Nasreddine Bencherchali
|
68f1ce8b9e
|
Merge branch 'SigmaHQ:master' into nasbench-rule-devel
|
2022-12-20 22:24:56 +01:00 |
|
|
Nasreddine Bencherchali
|
e72bc1dcaf
|
fix: add reference
|
2022-12-20 22:14:46 +01:00 |
|
|
Nasreddine Bencherchali
|
592e0062a1
|
fix: update condition and add new ref
|
2022-12-20 22:14:14 +01:00 |
|
|
zakibro
|
1a117d38e7
|
Update rules/linux/auditd/lnx_auditd_create_account.yml
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-12-20 19:30:26 +01:00 |
|
|
zakibro
|
59e4dc3e1c
|
Modifying Creation Of An User Account
Added additional test for record type of ADD_USER which should be generated whether you have created auditd rule or not.
|
2022-12-20 15:51:40 +01:00 |
|
|
Nasreddine Bencherchali
|
8a1c926ac2
|
Merge pull request #3800 from tropChaud/master
T1539 Steal Web Session Cookie rules
|
2022-12-20 14:48:14 +01:00 |
|
|
Nasreddine Bencherchali
|
7679d05706
|
fix: fp found in testing exchange server
|
2022-12-20 13:23:32 +01:00 |
|
|
Nasreddine Bencherchali
|
3f48eb4963
|
fix: selection name and add old path
|
2022-12-20 10:42:21 +01:00 |
|
|
Nasreddine Bencherchali
|
de5345cfd2
|
fix: add permalink instead of master
|
2022-12-20 10:25:52 +01:00 |
|
|
Nasreddine Bencherchali
|
22761ec2c3
|
fix: add missing id
|
2022-12-20 10:25:03 +01:00 |
|
|
frack113
|
0bdf5df446
|
Merge pull request #3797 from nasbench/update-license
feat: update license
|
2022-12-20 09:01:52 +01:00 |
|
|
MetaOSINT
|
ba52dc2aa8
|
T1539 Steal Web Session Cookie rules
Update existing rule and add one new rule related to Steal Web Session Cookie technique (T1539)
|
2022-12-19 23:20:13 -05:00 |
|
|
Nasreddine Bencherchali
|
c6c8c27fbc
|
Merge pull request #3799 from pbssubhash/master
DirCreate2System detection
|
2022-12-19 22:40:04 +01:00 |
|
|
Nasreddine Bencherchali
|
05bdb9af74
|
fix: rename files to fit logic
|
2022-12-19 19:28:23 +01:00 |
|
|
Nasreddine Bencherchali
|
ff94bfee2b
|
fix: update description to fit logic
|
2022-12-19 19:23:11 +01:00 |
|
|
Nasreddine Bencherchali
|
9c308642c7
|
fix: apply suggestions from code review
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
|
2022-12-19 19:21:55 +01:00 |
|
|
Nasreddine Bencherchali
|
c374413664
|
fix: change to permalink
|
2022-12-19 18:15:57 +01:00 |
|
|
Nasreddine Bencherchali
|
060174e2dd
|
fix: small fixes
- Added modified date
- Updated DLL sideload version
|
2022-12-19 18:14:01 +01:00 |
|
|
pbssubhash
|
8a9f1ee273
|
Update file_event_win_wermgr_local_privilege_escalation.yml
|
2022-12-19 22:39:05 +05:30 |
|
|
pbssubhash
|
ae974d8f15
|
Modifying existing rule instead of a new one
|
2022-12-19 22:35:36 +05:30 |
|
|
pbssubhash
|
b763ddd7c7
|
Update file_event_win_dircreate2system_privesc.yml
|
2022-12-19 22:21:37 +05:30 |
|
|
pbssubhash
|
8d617d2587
|
Create file_event_win_dircreate2system_privesc.yml
|
2022-12-19 22:14:25 +05:30 |
|
|
Nasreddine Bencherchali
|
ba3e985bed
|
feat: multiple update and enhancements
|
2022-12-19 17:41:40 +01:00 |
|
|
Nasreddine Bencherchali
|
9238d20d65
|
feat: update readme for license and markdown warnings
|
2022-12-19 17:28:09 +01:00 |
|
|
Nasreddine Bencherchali
|
14cb2f32eb
|
Merge pull request #3798 from qasimqlf/patch-17
fix: modify the detection and condition
|
2022-12-19 12:44:38 +01:00 |
|
|
Nasreddine Bencherchali
|
025c1a4aae
|
fix: enhance logic and severity
|
2022-12-19 11:21:24 +01:00 |
|
|
frack113
|
a3f87a10e3
|
Merge pull request #3796 from nasbench/nasbench-rule-devel
feat: add duplicate titles test
|
2022-12-19 11:19:17 +01:00 |
|
|
Qasim Qlf
|
9318c05751
|
fix: modify the detection and condtion
|
2022-12-19 15:00:00 +05:00 |
|
|
Nasreddine Bencherchali
|
4bb01e4cc1
|
fix: update license wording
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
|
2022-12-19 10:19:43 +01:00 |
|
|
Nasreddine Bencherchali
|
972720d42c
|
fix: apply code review suggestion
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
|
2022-12-19 10:17:49 +01:00 |
|
|
Nasreddine Bencherchali
|
238c18e4b7
|
feat: update license
|
2022-12-19 01:28:31 +01:00 |
|
|
Nasreddine Bencherchali
|
ecaf76f661
|
Merge pull request #1964 from BlackB0lt/patch-14
Create CVE-2021-26084 detection
|
2022-12-18 21:08:48 +01:00 |
|
|
frack113
|
646351808e
|
Refractor (#3794)
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-12-18 21:00:14 +01:00 |
|
|
Nasreddine Bencherchali
|
1ccee514e2
|
feat: add duplicate titles test
|
2022-12-18 20:55:32 +01:00 |
|
|
frack113
|
41d841ada2
|
Merge pull request #3793 from nasbench/nasbench-rule-devel
feat: updates and enhancements
|
2022-12-18 18:48:06 +01:00 |
|
|
Nasreddine Bencherchali
|
cfc5180865
|
Merge pull request #3795 from orenebahar/patch-1
Update net_connection_win_malware_backconnect_ports.yml
|
2022-12-18 15:34:47 +01:00 |
|
|
Nasreddine Bencherchali
|
1882a4a0c2
|
fix: remove unnecessary definition
|
2022-12-18 15:24:58 +01:00 |
|
|
Nasreddine Bencherchali
|
3f6bcb6cee
|
fix: fp found in testing
|
2022-12-18 15:07:47 +01:00 |
|
|
orenebahar
|
021499e6ef
|
Update net_connection_win_malware_backconnect_ports.yml
Add description about the right event ID in sysmon configuration
|
2022-12-18 12:13:29 +00:00 |
|
|
Nasreddine Bencherchali
|
a606223568
|
fix: add missing filename to the logic
|
2022-12-16 19:47:13 +01:00 |
|
|
Nasreddine Bencherchali
|
dbe3c80dd3
|
fix: fp found with baseline
|
2022-12-16 18:50:38 +01:00 |
|
|
Nasreddine Bencherchali
|
b108c1189d
|
Merge pull request #3717 from redsand/fp_convert_guidcompress
FP: ignore calling function Convert-GuidToCompressedGuid, …
|
2022-12-16 18:44:44 +01:00 |
|
|
Nasreddine Bencherchali
|
7ef1945ce5
|
Merge pull request #3791 from veramine/patch-6
Update proc_creation_win_rundll32_parent_explorer.yml
|
2022-12-16 18:43:54 +01:00 |
|
|
Nasreddine Bencherchali
|
1e2cd1655e
|
fix: add more filters and update image field
|
2022-12-16 17:59:24 +01:00 |
|
|
Nasreddine Bencherchali
|
c67960d162
|
fix: update logic
|
2022-12-16 17:46:35 +01:00 |
|
|
Nasreddine Bencherchali
|
2b9048b6c8
|
fix: update detection logic
|
2022-12-16 17:09:34 +01:00 |
|
|
Nasreddine Bencherchali
|
f0ff97be9b
|
fix: update description
|
2022-12-16 17:07:52 +01:00 |
|
|
Nasreddine Bencherchali
|
3868dd91c6
|
feat: updates and enhancements
|
2022-12-16 16:52:12 +01:00 |
|
|
Nasreddine Bencherchali
|
97c43eaa73
|
fix: duplicate id
|
2022-12-16 10:32:18 +01:00 |
|
|
frack113
|
066ab2680d
|
Change to LF
|
2022-12-16 09:24:19 +01:00 |
|