 Nasreddine Bencherchali
|
6d8a4571cd
|
fix: add missing - in selection
|
2022-11-10 18:29:15 +01:00 |
|
|
Nasreddine Bencherchali
|
0a51dcdf5c
|
fix: rename rule to reflect new title
|
2022-11-10 18:24:36 +01:00 |
|
|
Nasreddine Bencherchali
|
1ab9e9640e
|
fix: enhance description
|
2022-11-10 18:19:39 +01:00 |
|
|
Nasreddine Bencherchali
|
f09ea65ec4
|
fix: update code integrity rules
|
2022-11-10 17:43:22 +01:00 |
|
|
Nasreddine Bencherchali
|
ddf7f1b345
|
fix: fix duplicates in id field
|
2022-11-10 17:25:55 +01:00 |
|
|
Nasreddine Bencherchali
|
30869e1b2b
|
fix: fp with defender def updates
|
2022-11-10 17:15:22 +01:00 |
|
|
Nasreddine Bencherchali
|
14d13ef9ac
|
fix: rename ftp.exe rule to lolbin rule
|
2022-11-10 17:06:28 +01:00 |
|
|
Nasreddine Bencherchali
|
c102b26bcf
|
feat: new sftp lolbin rule
|
2022-11-10 17:05:18 +01:00 |
|
|
Nasreddine Bencherchali
|
ee5a8733dd
|
fix: update ftp.exe rules
|
2022-11-10 17:05:05 +01:00 |
|
|
Nasreddine Bencherchali
|
cd871bbc04
|
fix: update rules with more cases
|
2022-11-10 17:04:52 +01:00 |
|
|
Nasreddine Bencherchali
|
a2fc57fa52
|
fix: update rule to move takeown
|
2022-11-10 17:04:02 +01:00 |
|
|
Nasreddine Bencherchali
|
fb957e2897
|
fix: add missing quotes and OriginalFileName field
|
2022-11-10 17:03:31 +01:00 |
|
|
Nasreddine Bencherchali
|
649bbc86ec
|
fix: renamed and updated the "sc query" rule
|
2022-11-10 17:03:01 +01:00 |
|
|
Nasreddine Bencherchali
|
c9e755acbf
|
fix: add missing quotes and additional metadata
|
2022-11-10 17:02:29 +01:00 |
|
|
Florian Roth
|
2ed2452305
|
Merge pull request #3689 from phantinuss/master
Fix yesterday's fix
|
2022-11-10 16:40:53 +01:00 |
|
|
Florian Roth
|
99d8c96ccd
|
Merge pull request #3688 from SigmaHQ/rule-devel
rule: vuln Lenovo driver load, fix: Dell driver load condition, rule: Sysmon parent proc
|
2022-11-10 16:34:21 +01:00 |
|
|
phantinuss
|
9317454bc8
|
fix: bcdedit by svchost FP
|
2022-11-10 16:31:54 +01:00 |
|
|
Florian Roth
|
3278292559
|
fix: FPs
|
2022-11-10 15:01:09 +01:00 |
|
|
Florian Roth
|
254766170f
|
docs: update description and tags
|
2022-11-10 14:57:26 +01:00 |
|
|
Florian Roth
|
19fbbf8265
|
rule: Sysmon as parent
|
2022-11-10 14:52:31 +01:00 |
|
|
Florian Roth
|
71431efd16
|
fix: hash selection with OR in Dell driver rule
|
2022-11-10 13:22:04 +01:00 |
|
|
Florian Roth
|
7ef9893579
|
rule: vulnerable Lenovo driver
|
2022-11-10 13:21:31 +01:00 |
|
|
phantinuss
|
4e60b8abf0
|
Merge pull request #3686 from qasimqlf/patch-11
Minor Fix
|
2022-11-10 11:54:23 +01:00 |
|
|
phantinuss
|
160d081062
|
Merge pull request #3687 from qasimqlf/patch-12
Minor Fix
|
2022-11-10 11:51:57 +01:00 |
|
|
Qasim Qlf
|
097e673df8
|
Minor Fix
|
2022-11-10 12:41:43 +05:00 |
|
|
Qasim Qlf
|
52daec4489
|
Minor Fix
|
2022-11-10 12:40:13 +05:00 |
|
|
Florian Roth
|
9e68c45df0
|
Merge pull request #3684 from nasbench/nasbench-rule-devel
Rule Dev
|
2022-11-09 20:04:15 +01:00 |
|
|
Florian Roth
|
2f4eed2fe4
|
no need to update the modified date here
|
2022-11-09 18:33:13 +01:00 |
|
|
Florian Roth
|
b4e2530df5
|
updated modified date
|
2022-11-09 18:32:47 +01:00 |
|
|
Florian Roth
|
48c1e3058c
|
Merge pull request #3685 from phantinuss/master
Fix FPs
|
2022-11-09 18:31:28 +01:00 |
|
|
phantinuss
|
9136963672
|
fix: filter empty ParentImage which might happen as a race condition on startup
|
2022-11-09 16:45:00 +01:00 |
|
|
phantinuss
|
691649d932
|
fix: bcedit downloaded to C:\Windows\SoftwareDistribution
|
2022-11-09 16:44:58 +01:00 |
|
|
Nasreddine Bencherchali
|
39d66b4e94
|
Merge branch 'master' into nasbench-rule-devel
|
2022-11-09 16:14:38 +01:00 |
|
|
Nasreddine Bencherchali
|
5a70e402b3
|
Update rules
|
2022-11-09 16:13:17 +01:00 |
|
|
Florian Roth
|
928f07c366
|
Merge pull request #3683 from SigmaHQ/rule-devel
rule: KDC RC4-HMAC downgrade CVE-2022-37966
|
2022-11-09 10:19:04 +01:00 |
|
|
Florian Roth
|
017287804c
|
Merge pull request #3532 from Pooch11/cobalt-pipenames-redcanary
Update pipe_create_mal__cobaltstrike - Additional criteria from Redcanary
|
2022-11-09 10:17:28 +01:00 |
|
|
Florian Roth
|
026af279de
|
fix: duplicate UUID
|
2022-11-09 09:56:04 +01:00 |
|
|
Florian Roth
|
50baf18a68
|
rule: amsi bypass script - psh rule
|
2022-11-09 09:48:19 +01:00 |
|
|
Florian Roth
|
c9fe367eae
|
rule: amsi bypass
|
2022-11-09 09:44:31 +01:00 |
|
|
Yamato Security
|
5de1fd6f2d
|
Rule add: windows access token abuse (#3675)
Co-authored-by: Florian Roth <venom14@gmail.com>
|
2022-11-09 09:43:15 +01:00 |
|
|
Ilya_Krestinichev
|
ffb726b6df
|
Create proc_creation_win_susp_ping_del.yml (#3671)
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-11-09 09:42:33 +01:00 |
|
|
Florian Roth
|
0de60f2b9f
|
revert: changes in krbrelay service rule
|
2022-11-09 09:33:37 +01:00 |
|
|
Florian Roth
|
f7b91b0f05
|
rule: kerberos rc4 rule
|
2022-11-09 09:31:31 +01:00 |
|
|
Florian Roth
|
869b0962b3
|
rule: KDC RC4-HMAC downgrade CVE-2022-37966
|
2022-11-09 09:08:22 +01:00 |
|
|
frack113
|
ee156b8c46
|
Merge pull request #3681 from nasbench/fix-false-positives
Aurora - Fix FP Found In Testing
|
2022-11-09 06:20:41 +01:00 |
|
|
frack113
|
2ebb9159fb
|
Update raw_access_thread_disk_access_using_illegitimate_tools.yml
|
2022-11-08 19:10:05 +01:00 |
|
|
Nasreddine Bencherchali
|
13fbab9a87
|
Update image_load_susp_python_image_load.yml
|
2022-11-08 17:33:45 +01:00 |
|
|
Nasreddine Bencherchali
|
f312455db5
|
Update rules/windows/image_load/image_load_alternate_powershell_hosts_moduleload.yml
|
2022-11-08 17:26:24 +01:00 |
|
|
Nasreddine Bencherchali
|
ae2c09f866
|
Update rules/windows/image_load/image_load_in_memory_powershell.yml
Co-authored-by: Florian Roth <venom14@gmail.com>
|
2022-11-08 17:25:53 +01:00 |
|
|
Nasreddine Bencherchali
|
f7c1d9fe9d
|
Update proc_creation_win_weak_or_abused_passwords.yml
|
2022-11-08 14:52:42 +01:00 |
|