b9a2c720a8
Redcannary 20220828
2022-08-28 11:16:24 +02:00
46d917f2ca
Merge pull request #3435 from nasbench/nasbench-rule-devel
...
Rule Dev (New + Update)
2022-08-27 08:56:23 +02:00
a85bd4c712
Merge pull request #3437 from SigmaHQ/rule-devel
...
New Rules: Sliver, Mercury, Others
2022-08-27 08:54:00 +02:00
33cd3e9fd9
Merge branch 'master' into rule-devel
2022-08-26 22:49:54 +02:00
7c486fcf83
refactor: removed unfitting tags
2022-08-26 20:53:54 +02:00
a75f443033
Delete win_sliver_c2_default_service.yml
2022-08-26 20:52:19 +02:00
bc46de2685
Delete proc_creation_win_sliver_default_shell_command.yml
2022-08-26 20:52:05 +02:00
dcec3280fc
merge: Nasreddine's Sliver rules
2022-08-26 20:51:39 +02:00
d74558c31d
fix: uuid
2022-08-26 20:46:23 +02:00
40ce21f3e8
Update proc_creation_win_schtasks_system.yml
2022-08-26 19:03:50 +01:00
fcd9236bae
Merge branch 'nasbench-rule-devel' of https://github.com/nasbench/sigma into nasbench-rule-devel
2022-08-26 19:02:04 +01:00
bdbce73c9d
Merge pull request #3434 from nasbench/revert-3433-patch-1
...
Revert "Fixing selection_user to match NT AUTHORITY\SYSTEM"
2022-08-26 19:56:59 +02:00
3c363f6bf4
refactor: sliver service rule, fix: FP
2022-08-26 18:09:11 +02:00
3424c191fc
revert: deleted rule
2022-08-26 18:04:02 +02:00
bee8468f6c
rule: sysaidserver child
2022-08-26 18:03:14 +02:00
48fb89cbfb
Merge pull request #3436 from phantinuss/master
...
fix: FPs found in testing environment
2022-08-26 17:59:06 +02:00
0dddfab086
rule: MuddyWater rules
2022-08-26 17:49:58 +02:00
bb1d30b79d
refactor: renamed rule
2022-08-26 17:48:14 +02:00
c374703ff5
rules: more sliver rules
2022-08-26 17:48:02 +02:00
e80116e704
fix: FPs found in testing environment
2022-08-26 17:29:49 +02:00
11a322f4f0
New + Update
2022-08-26 15:38:43 +01:00
060fbcda31
Revert "Fixing selection_user to match NT AUTHORITY\SYSTEM"
2022-08-26 11:25:41 +01:00
112d83fa36
Merge pull request #3430 from r00tik/master
...
Add new rules for detection msdt.exe create file to autorun
2022-08-26 08:21:29 +02:00
cadd4f3274
Merge pull request #3433 from jkb-s/patch-1
...
Fixing selection_user to match NT AUTHORITY\SYSTEM
2022-08-26 08:21:09 +02:00
f316469cd7
Fixing selection_user to match NT AUTHORITY\SYSTEM
...
This should be 'SYSTEM' not ' SYSTEM ' - these leading/trailing spaces are making this detection invalid since the /RU parameter value will be "NT AUTHORITY\SYSTEM".
2022-08-26 00:25:04 +02:00
83a384e1c7
Merge pull request #3413 from alwashali/Disable-powershell-psreadline-history
...
posh_ps_disable_psreadline_command_history
2022-08-25 21:18:56 +02:00
a40cce9a63
rule: Sliver implant shell activity pattern
2022-08-25 17:50:47 +02:00
27b282da04
Merge branch 'SigmaHQ:master' into master
2022-08-25 15:25:37 +03:00
c5e183cf2e
Merge pull request #3432 from SigmaHQ/rule-devel
...
Create Stream Hash Rules
2022-08-25 14:17:50 +02:00
732fae435b
Merge branch 'SigmaHQ:master' into master
2022-08-25 10:27:21 +03:00
3c5852b5f5
fix: line endings, level, description, fp
2022-08-25 08:45:39 +02:00
38ede6dd08
Merge pull request #3426 from Tomasuh/proxy-dev
...
proxy_ua_bitsadmin_susp_ip.yml falsepositive fix
2022-08-25 08:42:14 +02:00
0b0dc5a65e
Merge pull request #3429 from frack113/clean_reg
...
registry_event Clean up
2022-08-25 08:39:37 +02:00
61657f50e6
Update file_event_win_msdt_autorun.yml
2022-08-25 08:38:43 +02:00
4a8d4041ee
Update file_event_win_msdt_autorun.yml
2022-08-25 09:25:30 +03:00
02d7e8f2a4
fix: duplicate UUIDs
2022-08-25 08:23:48 +02:00
5cf940c0a8
Merge pull request #3425 from YamatoSecurity/fix-backend-bool-conversion-error
...
fix backend bool conversion errors
2022-08-25 06:41:43 +02:00
b637cd7304
Merge pull request #3423 from benmontour/azureOperationNameField
...
Azure Activity Logs - operationName Field
2022-08-25 06:41:20 +02:00
1c536e0698
Add new rules for detection msdt.exe create file to autorun
2022-08-24 22:18:13 +03:00
f324148291
Merge pull request #3424 from nasbench/nasbench-rule-devel
...
Rule Dev - Update + New Rules
2022-08-24 19:59:08 +02:00
728a7ccb66
Fix after review
2022-08-24 18:35:23 +01:00
583155df30
Order
2022-08-24 18:42:56 +02:00
057bdd3f0c
Merge pull request #3427 from phantinuss/master
...
fix: many FPs in testing environment
2022-08-24 18:26:19 +02:00
483693f7e4
Merge pull request #3428 from redsand/fp_sentinel_one
...
FP: sentinel one performs this
2022-08-24 18:25:20 +02:00
e310bda6ad
FP: sentinel one performs this
2022-08-24 15:34:36 +00:00
a8c258d842
Merge branch 'master' into rule-devel
2022-08-24 16:51:35 +02:00
6a81603d28
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
2022-08-24 16:51:27 +02:00
4baa18bd33
refactor: added transfer.sh domain
2022-08-24 16:51:26 +02:00
2b776cdfbb
refactor: renamed old sysmon_ file names w/ new prefix
2022-08-24 16:51:12 +02:00
d18fced5dd
rules: create stream hash rules
2022-08-24 16:50:40 +02:00
frack113