 Florian Roth
|
2f44ed315b
|
refactor: extend ngrok rule
|
2022-12-02 13:07:41 +01:00 |
|
|
Florian Roth
|
8fd31d5d11
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-12-02 12:18:17 +01:00 |
|
|
Florian Roth
|
9b5560844f
|
fix: FP with Avast software
|
2022-12-02 12:18:11 +01:00 |
|
|
fukusuket
|
7b1d23621c
|
refactor: remove unnesessary escape.
|
2022-12-02 20:17:39 +09:00 |
|
|
Florian Roth
|
ce803476de
|
refactor: rule with ??? causing issues in some backends
|
2022-12-01 14:02:15 +01:00 |
|
|
BlueTeamOps
|
e936ae4e27
|
deleted win_sus_auditpol_usage.yaml
|
2022-11-30 22:10:26 +11:00 |
|
|
frack113
|
a674ee246b
|
Update Title (#3739)
|
2022-11-30 11:44:15 +01:00 |
|
|
Fukusuke Takahashi
|
76fece654a
|
fix: explicitly escape { to make it clear that it is a literal (#3737)
|
2022-11-30 11:43:49 +01:00 |
|
|
Nasreddine Bencherchali
|
25c41ea73c
|
fix: update error message
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
|
2022-11-30 10:21:24 +01:00 |
|
|
Nasreddine Bencherchali
|
c2e85f4080
|
feat: update the test to test for lowercase
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
|
2022-11-30 10:06:10 +01:00 |
|
|
phantinuss
|
82afa90499
|
Merge pull request #3741 from nasbench/nasbench-rule-devel
feat: new rules, fixes and general updates
|
2022-11-30 08:51:15 +01:00 |
|
|
Nasreddine Bencherchali
|
d82e3de11c
|
fix: fix empty field in selection
|
2022-11-30 00:57:38 +01:00 |
|
|
Nasreddine Bencherchali
|
92965e6f7e
|
fix: fix broken description
|
2022-11-29 23:43:03 +01:00 |
|
|
Nasreddine Bencherchali
|
18d974c751
|
feat: new test for references case
|
2022-11-29 23:29:38 +01:00 |
|
|
Nasreddine Bencherchali
|
02e68a3d26
|
feat: new powertool rule
|
2022-11-29 23:24:49 +01:00 |
|
|
Nasreddine Bencherchali
|
04a1d29eac
|
feat: update driver rules
|
2022-11-29 23:24:34 +01:00 |
|
|
frack113
|
ae3d7f4389
|
Merge pull request #3738 from phantinuss/master
fix: FP found in testing
|
2022-11-29 18:36:49 +01:00 |
|
|
phantinuss
|
9c8e00fe66
|
fix: FP found in testing
|
2022-11-29 16:41:57 +01:00 |
|
|
Nasreddine Bencherchali
|
1ff75ce60e
|
Merge branch 'SigmaHQ:master' into nasbench-rule-devel
|
2022-11-29 16:20:55 +01:00 |
|
|
Nasreddine Bencherchali
|
1d7ee1cd19
|
feat: enhance duplicate test (#3736)
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
|
2022-11-29 13:47:09 +01:00 |
|
|
Florian Roth
|
2ccf5a72cd
|
Merge pull request #3735 from SigmaHQ/rule-devel
fix: some rules using ??? placeholders
|
2022-11-29 10:40:33 +01:00 |
|
|
Florian Roth
|
b56537bffb
|
fix: some rules using ??? placeholders
|
2022-11-29 10:31:18 +01:00 |
|
|
jstnk9
|
647f6dc2ef
|
Update title (#3734)
|
2022-11-29 07:36:45 +01:00 |
|
|
Nasreddine Bencherchali
|
81e8acf535
|
fix: fix fp in testing
|
2022-11-28 13:19:37 +01:00 |
|
|
Nasreddine Bencherchali
|
4b9075e557
|
feat: new rules related to service creation
New service creation rules related to remote software tools
|
2022-11-28 12:09:00 +01:00 |
|
|
frack113
|
c820216541
|
Update Title (#3733)
|
2022-11-28 06:43:17 +01:00 |
|
|
Aurakal
|
c536b262c9
|
Create file_event_win_remote_cred_dump.yml (#3732)
|
2022-11-27 19:31:48 +01:00 |
|
|
frack113
|
cd4121d966
|
Update Title (#3731)
Co-authored-by: Florian Roth <venom14@gmail.com>
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-11-27 19:19:27 +01:00 |
|
|
BlueTeamOps
|
0b03a835dd
|
Merge branch 'SigmaHQ:master' into master
|
2022-11-27 18:25:36 +11:00 |
|
|
jstnk9
|
3572e9d9ea
|
titles modified (#3730)
|
2022-11-26 08:49:30 +01:00 |
|
|
frack113
|
aa07d74f03
|
Merge pull request #3729 from phantinuss/master
fix: rare case where Image is not populated
|
2022-11-25 18:19:50 +01:00 |
|
|
Florian Roth
|
afa2adce92
|
Update proc_creation_win_termserv_proc_spawn.yml
|
2022-11-25 17:07:52 +01:00 |
|
|
phantinuss
|
f1bd1117e9
|
fix: rare case where Image is not populated
|
2022-11-25 16:48:13 +01:00 |
|
|
jstnk9
|
a573a8e1bc
|
Title modified in several rules (#3728)
|
2022-11-25 15:34:38 +01:00 |
|
|
Florian Roth
|
9a8c5a134e
|
Merge pull request #3726 from phantinuss/master
fix: FP in testing environment
|
2022-11-24 16:59:17 +01:00 |
|
|
phantinuss
|
671b60e42f
|
fix: FP in testing environment
|
2022-11-24 16:21:28 +01:00 |
|
|
BlueTeamOps
|
2698481b6d
|
Merge branch 'SigmaHQ:master' into master
|
2022-11-24 22:06:57 +11:00 |
|
|
Florian Roth
|
5542c8c9d9
|
Merge pull request #3720 from nasbench/nasbench-rule-devel
feat: general updates and fixes
|
2022-11-22 23:25:26 +01:00 |
|
|
Florian Roth
|
4c0e1e0043
|
Merge pull request #3721 from qasimqlf/patch-13
Minor Fix
|
2022-11-22 17:10:09 +01:00 |
|
|
Florian Roth
|
11d8bc1dbe
|
Merge pull request #3722 from phantinuss/master
FP Fixes and cti submodule update
|
2022-11-22 17:08:01 +01:00 |
|
|
phantinuss
|
62358809a1
|
fix: FP in testing environment
|
2022-11-22 16:26:55 +01:00 |
|
|
phantinuss
|
6ecdd77f6d
|
chore: update submodule cti
|
2022-11-22 16:21:25 +01:00 |
|
|
Qasim Qlf
|
ed54bf44a5
|
Minor Fix
|
2022-11-22 18:13:34 +05:00 |
|
|
Nasreddine Bencherchali
|
b6dce4b6a5
|
feat: general fixes
|
2022-11-22 01:22:36 +01:00 |
|
|
Nasreddine Bencherchali
|
89d69de27f
|
fix: rename + update rule
|
2022-11-21 12:40:54 +01:00 |
|
|
Nasreddine Bencherchali
|
471d7a8919
|
fix: rename rule
|
2022-11-21 12:35:01 +01:00 |
|
|
Nasreddine Bencherchali
|
e22875f3fa
|
fix: update metadata of the rule
|
2022-11-21 12:34:34 +01:00 |
|
|
Nasreddine Bencherchali
|
80c60681e4
|
fix: add missing related field
|
2022-11-21 12:31:11 +01:00 |
|
|
Nasreddine Bencherchali
|
8bd85273c1
|
fix: deprecate f67dbfce-93bc-440d-86ad-a95ae8858c90
|
2022-11-21 12:31:01 +01:00 |
|
|
Nasreddine Bencherchali
|
4532c77a4e
|
fix: fix typo in title and add FP comment
|
2022-11-21 12:27:54 +01:00 |
|