security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,089 Commits 1 Branch 57 Tags
d14e287cdf91e2a8b995de5bfbc3fa8540c1922b
Commit Graph

15089 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
frack113 21435629a0 Merge pull request #3482 from nasbench/nasbench-rule-devel 
Rule Devel (New+Update)
 2022-09-10 12:34:26 +02:00
frack113 97cecc6de7 Merge pull request #3479 from elhoim/add_sigmac_deprecation_readme 
Add deprecation notice in README page
 2022-09-10 12:34:07 +02:00
Florian Roth e7084eee04 Merge pull request #3487 from SigmaHQ/aurora-false-positive-fixing 
fix: fixing multiple FPs with the use of VSCode
 2022-09-10 12:07:01 +02:00
Florian Roth 0a5cfb93b3 fix: condition 2022-09-10 11:53:42 +02:00
Florian Roth 7dbdd4d1c6 fix: fixing multiple FPs with the use of VSCode 2022-09-10 11:42:44 +02:00
Florian Roth a053be791c Update proc_creation_win_user_discovery_get_aduser.yml 2022-09-10 09:49:14 +02:00
Florian Roth a616647b08 lowered score of scheduled task + SYSTEM rule 2022-09-10 09:48:50 +02:00
Florian Roth 9ed14ce571 tightened the regular expression 2022-09-10 09:34:16 +02:00
Nasreddine Bencherchali 2552b75e72 Delete proc_creation_win_net_add_local_user.yml 2022-09-09 23:11:28 +02:00
Thomas Patzke 21c016b0ed Merge branch 'master' of https://github.com/SigmaHQ/sigma 2022-09-09 22:56:58 +02:00
Thomas Patzke c6e633bf30 Release 0.22.1 2022-09-09 22:48:08 +02:00
Thomas Patzke 7afcf24d21 Splunk puts AND always into parentheses 
New fix for issue #3443
 2022-09-09 22:30:00 +02:00
Thomas Patzke 3396414bda Revert "Wrapped all-modifier result into NodeSubexpression" 
This reverts commit 1fbd2bba4d.
 2022-09-09 22:26:13 +02:00
frack113 b9cc206d9d Update win_susp_computer_name.yml 2022-09-09 18:53:48 +02:00
frack113 3b8184a6b7 Merge pull request #3480 from phantinuss/master 
fix: FP with windows defender
 2022-09-09 18:49:37 +02:00
Florian Roth 860c45a038 added time frame 2022-09-09 17:07:45 +02:00
David André 2ed9e37a7e Merge branch 'SigmaHQ:master' into add_renamed_vmnat 2022-09-09 16:56:40 +02:00
David ANDRE 6c1761a7b7 Revert "Merge branch 'master' of github.com:elhoim/sigma" 
This reverts commit fc98278b19.
 2022-09-09 16:55:12 +02:00
David ANDRE 6182b43279 Add rule for renamed vmnat.exe 2022-09-09 16:40:17 +02:00
David ANDRE fc98278b19 Merge branch 'master' of github.com:elhoim/sigma 2022-09-09 16:12:59 +02:00
David ANDRE 9a77542bc6 Add comment to explain lack of eventID\nBetter description 2022-09-09 16:11:07 +02:00
Florian Roth 02edc2977c Merge pull request #3483 from elhoim/rename_suspicious2 
Renamed suspicious in rules file names to susp
 2022-09-09 16:09:42 +02:00
David ANDRE b170af5687 Added rule for sam the admin suspicious computer 2022-09-09 16:08:19 +02:00
nasreddine.bencherchali@nextron-systems.com 14db9c9fb1 Update proc_creation_win_wmic_computersystem_recon.yml 2022-09-09 15:43:07 +02:00
nasreddine.bencherchali@nextron-systems.com a71ce185d7 Fix 2022-09-09 15:32:03 +02:00
David André ae5dc248c8 Merge branch 'SigmaHQ:master' into rename_suspicious2 2022-09-09 15:18:35 +02:00
David ANDRE b75fb5abf5 Renamed suspicious in rules file names to susp 2022-09-09 15:12:47 +02:00
nasreddine.bencherchali@nextron-systems.com 051397b533 Update proc_creation_win_susp_schtasks_delete_all.yml 2022-09-09 15:10:49 +02:00
nasreddine.bencherchali@nextron-systems.com c8fc1cf21e Update proc_creation_win_user_discovery_get_aduser.yml 2022-09-09 15:04:36 +02:00
nasreddine.bencherchali@nextron-systems.com 70f9ff61ca Big Update 2022-09-09 15:02:31 +02:00
phantinuss 43e0d4fe6a fix: FP with windows defender 2022-09-09 13:51:53 +02:00
David ANDRE 607521f6bd Added depcration notice in README page 2022-09-09 12:33:00 +02:00
David ANDRE 6b9470f8e4 New message as requested.\n Only displayed on full help and when no arguments is passed 2022-09-09 12:24:30 +02:00
David André 5b853611fe Merge branch 'SigmaHQ:master' into sigmac_deprecation_warning 2022-09-09 12:18:06 +02:00
Florian Roth 6af333cd24 Merge pull request #3478 from phantinuss/master 
fix: general filter should filter on both selections
 2022-09-09 11:06:54 +02:00
phantinuss 38a2e76af8 fix: general filter should filter on both selections 2022-09-09 10:03:50 +02:00
David ANDRE 9711afd0d6 Added deprecating warning in sigmac with color 2022-09-09 09:08:50 +02:00
Nasreddine Bencherchali fbc7733078 Update proc_creation_win_susp_reg_add.yml 2022-09-08 22:52:24 +02:00
Nasreddine Bencherchali dd67c4fd73 Dev 2022-09-08 22:50:57 +02:00
Thomas Patzke 57243e91e7 Sigmatools release 0.22 0.22 2022-09-08 21:24:23 +02:00
Thomas Patzke b05a61aff0 Merge branch 'master' of https://github.com/SigmaHQ/sigma 2022-09-08 18:57:53 +02:00
Florian Roth fc3391761a Merge pull request #3476 from phantinuss/master 
fix: FP on race condition
 2022-09-08 18:01:00 +02:00
Thomas Patzke 1fbd2bba4d Wrapped all-modifier result into NodeSubexpression 
Fixes sigmac splunk backend: Wrong conversion for |contains|all #3443
 2022-09-08 17:57:36 +02:00
phantinuss 586b1c449f fix: FP on race condition 2022-09-08 16:28:05 +02:00
Nasreddine Bencherchali 15713918cd Rename 2022-09-08 10:26:23 +02:00
Nasreddine Bencherchali baf603bb5c Fix FP in testing 2022-09-08 10:24:27 +02:00
Thomas Patzke 19dea55e2c Merge branch 'windash' 2022-09-08 09:34:19 +02:00
Florian Roth 358e8a567e Merge pull request #3474 from SigmaHQ/aurora-false-positive-fixing 
fix: schtasks in suspicious parents rule
 2022-09-08 09:09:26 +02:00
Florian Roth de68bf5559 fix: schtasks in suspicious parents rule 2022-09-08 09:00:58 +02:00
frack113 6813043323 Merge pull request #3468 from nasbench/nasbench-rule-devel 
Rule Devel
 2022-09-08 06:29:36 +02:00