 Florian Roth
|
59499f926e
|
Bugfix: Taskscheduler log source definition
|
2017-03-17 16:09:31 +01:00 |
|
|
Florian Roth
|
dd81b18d6e
|
Rule: Suspicious interactive console logons to servers
|
2017-03-17 09:44:24 +01:00 |
|
|
Florian Roth
|
bcc250e1c7
|
Added missing description
|
2017-03-17 08:43:21 +01:00 |
|
|
Florian Roth
|
e46ecd2aff
|
Rule: Rare scheduled task installs
|
2017-03-17 08:41:27 +01:00 |
|
|
Florian Roth
|
3a7652fff9
|
Added references to rule
|
2017-03-17 00:25:54 +01:00 |
|
|
Florian Roth
|
c6843d41bc
|
Rule: Vssadmin / NTDS.dit activity
|
2017-03-17 00:23:55 +01:00 |
|
|
Florian Roth
|
d00bbd9fb5
|
Rule: Windows recon activity
|
2017-03-16 18:59:17 +01:00 |
|
|
Florian Roth
|
140141b7a2
|
Rule: Suspicious PowerShell parent image combination
|
2017-03-16 18:58:59 +01:00 |
|
|
Florian Roth
|
091bb8fab7
|
Renamed and removed double space
|
2017-03-16 18:58:32 +01:00 |
|
|
Florian Roth
|
dd558e941c
|
Rule: Access to ADMIN$ share
|
2017-03-14 14:53:03 +01:00 |
|
|
Florian Roth
|
3eae1f2710
|
Bug and typo fixes
|
2017-03-14 14:52:28 +01:00 |
|
|
Florian Roth
|
2e32e1bb43
|
Rule: User account added to local Administrators
|
2017-03-14 12:51:50 +01:00 |
|
|
Florian Roth
|
cb683a6b56
|
Rule: Suspicious executions in web folders / non-exe folders
|
2017-03-13 23:56:06 +01:00 |
|
|
Florian Roth
|
c571848e9b
|
Rule: Scheduled task creation
|
2017-03-13 20:45:28 +01:00 |
|
|
Florian Roth
|
de46c8c0a0
|
Reduced to user accounts
|
2017-03-13 19:09:29 +01:00 |
|
|
Florian Roth
|
36c941d5d8
|
Restrict rule to non-private IP ranges only
|
2017-03-13 18:45:15 +01:00 |
|
|
Florian Roth
|
8d36e2a1b5
|
Rule: Suspicious PowerShell Parameter Substring
|
2017-03-13 17:23:25 +01:00 |
|
|
Florian Roth
|
ff8e3fe584
|
Merge pull request #9 from iliaselmatani/patch-1
Create win_pass_the_hash.yml
|
2017-03-13 16:16:55 +01:00 |
|
|
Florian Roth
|
a66955013c
|
Update win_pass_the_hash.yml
|
2017-03-13 16:16:34 +01:00 |
|
|
IeM
|
9f5e5a2366
|
Update win_pass_the_hash.yml
Added placeholders for WorkstationName to detect network logons between Workstations.
|
2017-03-13 16:09:32 +01:00 |
|
|
Florian Roth
|
85c298c43c
|
Bugfix in rule
|
2017-03-13 15:09:48 +01:00 |
|
|
Florian Roth
|
606d74546a
|
Rule: PowerShell with network connections
|
2017-03-13 13:57:41 +01:00 |
|
|
Florian Roth
|
a0047f7c67
|
Sysmon as 'service' of product 'windows'
|
2017-03-13 09:23:08 +01:00 |
|
|
Florian Roth
|
4470c2f893
|
PowerShell Suspicious Invocation > Sysmon
|
2017-03-12 17:11:05 +01:00 |
|
|
Florian Roth
|
de689c32b5
|
Suspicious PowerShell Invocation
|
2017-03-12 17:06:53 +01:00 |
|
|
Florian Roth
|
d6957f1c2e
|
Merge pull request #10 from MHaggis/master
Sysmon
|
2017-03-09 08:05:22 +01:00 |
|
|
Michael Haag
|
c5f05dd829
|
bitsadmin & VSSAdmin
+Bitsadmin download
+VSSAdmin delete
|
2017-03-08 22:49:35 -08:00 |
|
|
IeM
|
4d5ded46e6
|
Update win_pass_the_hash.yml
|
2017-03-08 20:35:26 +01:00 |
|
|
Florian Roth
|
3507a5e644
|
Rule: Rare Windows Service Installs
|
2017-03-08 19:09:34 +01:00 |
|
|
IeM
|
381b85fd94
|
Update win_pass_the_hash.yml
Edited, added additional indicators.
Reference: https://www.binarydefense.com/bds/reliably-detecting-pass-the-hash-through-event-log-analysis/
|
2017-03-08 18:48:06 +01:00 |
|
|
IeM
|
e4d764ceba
|
Create win_pass_the_hash.yml
Rule to detects the attack technique pass the hash which is used to move laterally inside the network
|
2017-03-08 18:04:31 +01:00 |
|
|
Florian Roth
|
5484886932
|
Rule: Windows - Recon Activity (improved)
|
2017-03-07 13:06:38 +01:00 |
|
|
Florian Roth
|
fa6f76f276
|
Rule: Windows - Recon Activity
|
2017-03-07 12:01:39 +01:00 |
|
|
Florian Roth
|
aad892c834
|
Windows Built-In rules > LogSource definition
|
2017-03-05 23:55:52 +01:00 |
|
|
Florian Roth
|
16c5192ee9
|
Windows Malicious Password Dumper Service Installs
|
2017-03-05 23:52:02 +01:00 |
|
|
Florian Roth
|
7b815ef3e5
|
Sysmon PowerShell - Suspicious Param Combination
|
2017-03-05 23:51:39 +01:00 |
|
|
Florian Roth
|
294df21c56
|
Added expression
|
2017-03-05 22:45:54 +01:00 |
|
|
Florian Roth
|
7fae49b183
|
More PowerShell rules
|
2017-03-05 15:01:51 +01:00 |
|
|
Florian Roth
|
1e1cf9cb9e
|
PowerShell Rules Revision
|
2017-03-05 14:14:31 +01:00 |
|
|
Omer Yampel
|
97b4078d01
|
Update powershell_malicious_commandlets.yml
Added https://github.com/putterpanda/mimikittenz reference
|
2017-03-04 20:26:39 -05:00 |
|
|
Florian Roth
|
12535417d9
|
Typo
|
2017-03-05 01:47:37 +01:00 |
|
|
Florian Roth
|
d397ee9f68
|
First PowerShell Ruleset
|
2017-03-05 01:47:25 +01:00 |
|
|
Michael Haag
|
a3cd7123a8
|
wscript/cscript
WSF, JSE, JS, VBA and VBE file execution
|
2017-03-04 14:40:34 -08:00 |
|
|
Michael Haag
|
4ac5d86479
|
mshta shells
🐚 for all!
|
2017-03-04 14:33:09 -08:00 |
|
|
Michael Haag
|
1317fe9df2
|
Modifications
+ Added Sysmon detection of Office binaries spawning Windows shells
+ Additional web servers added for webshell detection
|
2017-03-04 14:22:44 -08:00 |
|
|
Florian Roth
|
a9d6295791
|
Rule: Sysmon Malware Shellcode in Verclsid Process
|
2017-03-04 10:38:23 +01:00 |
|
|
Florian Roth
|
15e61a9681
|
Rule: Certutil Decode in AppData
|
2017-03-02 11:28:34 +01:00 |
|
|
Florian Roth
|
b6459a00ab
|
Two new Sysmon rules for Office Macro/PS detection
|
2017-03-02 11:06:53 +01:00 |
|
|
Florian Roth
|
8559837aab
|
Removed Sysmon EventLog from selection > via 'logsource'
|
2017-03-02 11:06:20 +01:00 |
|
|
Florian Roth
|
b4f2a74371
|
Proposed changes to mimimkatz-inmemory aggregation
|
2017-03-01 10:16:43 +01:00 |
|