 Jonhnathan
|
d2d49c445a
|
Update sysmon_powershell_exploit_scripts.yml
|
2020-10-15 16:00:20 -03:00 |
|
|
Jonhnathan
|
b6b34b37d9
|
Update sysmon_ghostpack_safetykatz.yml
|
2020-10-15 15:59:09 -03:00 |
|
|
Jonhnathan
|
099843470e
|
Update sysmon_creation_system_file.yml
|
2020-10-15 15:58:10 -03:00 |
|
|
Jonhnathan
|
427962937b
|
Update sysmon_susp_driver_load.yml
|
2020-10-15 15:57:05 -03:00 |
|
|
Jonhnathan
|
1cd56f5dae
|
Update win_vul_cve_2020_0688.yml
|
2020-10-15 15:56:36 -03:00 |
|
|
Jonhnathan
|
ef3af551e9
|
Update win_user_driver_loaded.yml
|
2020-10-15 15:56:16 -03:00 |
|
|
Jonhnathan
|
4e70b2d797
|
Update win_user_added_to_local_administrators.yml
|
2020-10-15 15:55:21 -03:00 |
|
|
Jonhnathan
|
c0892c63c8
|
Update win_svcctl_remote_service.yml
|
2020-10-15 15:54:47 -03:00 |
|
|
Jonhnathan
|
d96bd0d9f3
|
Update win_susp_wmi_login.yml
|
2020-10-15 15:54:21 -03:00 |
|
|
Jonhnathan
|
496cfcb26a
|
Update win_susp_sdelete.yml
|
2020-10-15 15:53:51 -03:00 |
|
|
Jonhnathan
|
600c7057b1
|
Update win_susp_sam_dump.yml
|
2020-10-15 15:53:26 -03:00 |
|
|
Jonhnathan
|
754e67c0d9
|
Update win_susp_rc4_kerberos.yml
|
2020-10-15 15:52:48 -03:00 |
|
|
Jonhnathan
|
43a56b6759
|
Update win_susp_raccess_sensitive_fext.yml
|
2020-10-15 15:51:57 -03:00 |
|
|
Jonhnathan
|
054255fb17
|
Update win_susp_psexec.yml
|
2020-10-15 15:51:16 -03:00 |
|
|
Jonhnathan
|
dae1f3fa71
|
Update win_susp_ntlm_rdp.yml
|
2020-10-15 15:50:44 -03:00 |
|
|
Jonhnathan
|
9b8817f489
|
Update win_susp_msmpeng_crash.yml
|
2020-10-15 15:50:01 -03:00 |
|
|
Jonhnathan
|
c310d72e2b
|
Update win_susp_mshta_execution.yml
|
2020-10-15 15:49:39 -03:00 |
|
|
Jonhnathan
|
7419396351
|
Update win_susp_mshta_execution.yml
|
2020-10-15 15:49:26 -03:00 |
|
|
Jonhnathan
|
1eb0ccbf14
|
Update win_susp_local_anon_logon_created.yml
|
2020-10-15 15:48:36 -03:00 |
|
|
Jonhnathan
|
e089118718
|
Update win_possible_dc_shadow.yml
|
2020-10-15 15:45:55 -03:00 |
|
|
Jonhnathan
|
6961ee4986
|
Update win_net_ntlm_downgrade.yml
|
2020-10-15 15:44:24 -03:00 |
|
|
Jonhnathan
|
8261737728
|
Update win_mmc20_lateral_movement.yml
|
2020-10-15 15:42:07 -03:00 |
|
|
Jonhnathan
|
8f3542a73e
|
Update win_mal_wceaux_dll.yml
|
2020-10-15 15:41:13 -03:00 |
|
|
Jonhnathan
|
9bfd63ec26
|
Update win_hack_smbexec.yml
|
2020-10-15 15:20:08 -03:00 |
|
|
Jonhnathan
|
e5789a2a52
|
Update win_dcsync.yml
|
2020-10-15 15:19:18 -03:00 |
|
|
Jonhnathan
|
777e49b76c
|
Update win_av_relevant_match.yml
|
2020-10-15 15:17:33 -03:00 |
|
|
Jonhnathan
|
b555628321
|
Update win_atsvc_task.yml
|
2020-10-15 15:15:01 -03:00 |
|
|
Jonhnathan
|
44735049b6
|
Update win_apt_stonedrill.yml
|
2020-10-15 15:14:27 -03:00 |
|
|
Jonhnathan
|
02a1ab4033
|
Update win_alert_mimikatz_keywords.yml
|
2020-10-15 15:11:10 -03:00 |
|
|
Jonhnathan
|
26b442ec48
|
Update win_alert_lsass_access.yml
Getting rid of '*' use
|
2020-10-15 15:09:35 -03:00 |
|
|
Jonhnathan
|
79c2b8d570
|
Update win_GPO_scheduledtasks.yml
Getting rid of '*' use
|
2020-10-15 15:07:16 -03:00 |
|
|
Jonhnathan
|
4aa96a2ac9
|
Update win_alert_enable_weak_encryption.yml
|
2020-10-15 15:05:49 -03:00 |
|
|
Jonhnathan
|
5765573907
|
Update win_alert_active_directory_user_control.yml
Getting rid of '*' use
|
2020-10-15 15:04:08 -03:00 |
|
|
Jonhnathan
|
1c06c9e166
|
Update win_admin_share_access.yml
Getting rid of '*' use
|
2020-10-15 15:03:31 -03:00 |
|
|
Jonhnathan
|
085dc21d25
|
Update win_admin_rdp_login.yml
Getting rid of '*' use
|
2020-10-15 15:02:40 -03:00 |
|
|
Jonhnathan
|
9c7a23e432
|
Update win_account_discovery.yml
Getting rid of '*' use
|
2020-10-15 15:01:31 -03:00 |
|
|
Jonhnathan
|
fdd9234acc
|
Revert "Create win_susp_replace_lolbin.yml"
This reverts commit e6a6549676.
|
2020-10-15 14:57:18 -03:00 |
|
|
Jonhnathan
|
17e7eee3a6
|
Revert "Changed the rule to download only and not the copy"
This reverts commit 1324bc1ad1.
|
2020-10-15 14:57:14 -03:00 |
|
|
Jonhnathan
|
1324bc1ad1
|
Changed the rule to download only and not the copy
|
2020-10-07 16:18:21 -03:00 |
|
|
Jonhnathan
|
e6a6549676
|
Create win_susp_replace_lolbin.yml
Item 77 of #1014
|
2020-10-07 10:37:15 -03:00 |
|
|
Florian Roth
|
c56cd2dfff
|
Merge pull request #1024 from omkar72/master
Com hijack shell folder
|
2020-10-02 09:24:16 +02:00 |
|
|
omkargudhate22
|
4487d9cc7e
|
added event type & changed technique
|
2020-10-02 09:22:14 +05:30 |
|
|
Florian Roth
|
d3ee1aba66
|
docs: MITRE ATT&CK(R) trademark references removed or adjusted
https://github.com/Neo23x0/sigma/issues/1028
|
2020-09-30 08:53:52 +02:00 |
|
|
Florian Roth
|
c17ca6d5fe
|
Merge pull request #1018 from savvyspoon/wcry-dns
WannaCry Killswitch domain DNS query
|
2020-09-29 09:27:21 +02:00 |
|
|
omkargudhate22
|
68a992d903
|
updated name
|
2020-09-27 21:57:19 +05:30 |
|
|
omkargudhate22
|
e7c8197e34
|
Updated fields & renamed
|
2020-09-27 21:52:59 +05:30 |
|
|
omkargudhate22
|
ebe3dce1d7
|
Update sysmon_comhijack_uac_bypass.yml
|
2020-09-27 21:44:41 +05:30 |
|
|
omkar72
|
3f148e6c7c
|
COM hijack of shell folder to execute arbitrary application & UAC bypass using sdclt.
|
2020-09-27 21:19:04 +05:30 |
|
|
Florian Roth
|
d7d9c0e772
|
Merge pull request #1021 from hieuttmmo/master
Sigma rule to detect AdFind.exe execution
|
2020-09-27 09:50:41 +02:00 |
|
|
Florian Roth
|
8020fe3c40
|
false positive condition
|
2020-09-26 17:03:29 +02:00 |
|