da54e89f30
Merge pull request #976 from diskurse/rule-devel
...
Rule devel
2020-08-17 15:02:31 +02:00
8a02541b0a
style: removed lists where unnecessary
2020-08-17 15:02:16 +02:00
6dc8dbb6d8
style: removed lists where unnecessary
2020-08-17 15:01:52 +02:00
b378b3d62b
win_mouse_lock.yml
...
In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.
2020-08-13 12:09:07 +01:00
6fa5a6c93d
Delete win_mouse_lock.yml
2020-08-13 12:08:04 +01:00
b8b4ab5a2a
win_mouse_lock.yml
...
In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.
2020-08-13 12:07:34 +01:00
d1e9f01d23
win_dnscat2_powershell_implementation.yml
...
The PowerShell implementation of DNSCat2 calls nslookup to craft queries. Counting nslookup processes spawned by PowerShell will show hundreds or thousands of instances if PS DNSCat2 is active locally.
2020-08-13 12:06:48 +01:00
052379a512
fix: tightened TAIDOOR rule
2020-08-04 14:37:18 +02:00
c4953409aa
rule: TAIDOOR malware load
...
https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a
2020-08-04 14:31:29 +02:00
5625f471d7
Merge pull request #963 from diskurse/rule-devel
...
win_webshell_regeorg.yml
2020-08-03 13:51:16 +02:00
3abc3d0a76
docs: add FP condition
2020-08-03 13:50:47 +02:00
6f7aecbe06
fix: preventive change to avoid FPs
2020-08-03 13:49:52 +02:00
de33b953ba
Add files via upload
...
Webshell ReGeorg Detection Via Web Logs
2020-08-03 12:20:04 +01:00
df3bfb1b37
rule: Winnti Pipemon
2020-07-30 18:55:47 +02:00
5abf101c0b
Merge pull request #954 from Neo23x0/rule-devel
...
Rule devel
2020-07-28 10:22:52 +02:00
8970d03f6f
Merge pull request #952 from Neo23x0/devel
...
feat: Detect duplicate rule tags
2020-07-28 10:21:59 +02:00
80f4b4ec71
fix: rules with duplicate tags
2020-07-27 11:44:47 +02:00
051e2ce905
feat: detect duplicate tags
2020-07-27 11:37:58 +02:00
481b695eff
Merge pull request #950 from barvhaim/master
...
STIX Backend bug-fix and mapping updates
2020-07-26 18:33:35 +02:00
32cf352236
Merge remote-tracking branch 'upstream/master'
2020-07-26 14:56:06 +03:00
9643e01b54
extension should use '..'
2020-07-26 12:16:48 +03:00
dcb07bab2f
Merge pull request #949 from 0xballistics/powershell_backend_fix
...
partial(?) fix of #762
2020-07-25 10:18:05 +02:00
a0ac6c46c7
Merge pull request #948 from IPv777/patch-1
...
remove duplicate tag
2020-07-24 20:32:40 +02:00
b8b1f83ae6
Merge pull request #3 from simrankaursoin/master
...
Fix bug with NOT handling
2020-07-24 11:55:17 -04:00
77a8ac59ef
remove duplicate
2020-07-24 16:38:08 +02:00
a55630f02c
Merge pull request #947 from ryanplasma/master
...
Minor fixes to two rules
2020-07-24 09:25:55 +02:00
aa548ba1a9
Add quotes due to a colon in the falsepositives string
2020-07-23 23:33:36 -04:00
e52489aaf6
Change production status to stable
2020-07-23 23:33:36 -04:00
c329f6412d
Fix bug with NOT handling
2020-07-23 11:47:55 -04:00
7e32557ffc
Merge pull request #2 from simrankaursoin/master
...
Update base.py and qradar.py
2020-07-23 11:12:17 -04:00
8a4b53eb3a
fix: rule leads to FPs on systems that don't log the cmdline parameters
2020-07-23 17:04:16 +02:00
6c7b4cf408
Revert additional change in base.py
2020-07-23 10:47:22 -04:00
ef9af3730a
Remove unnecessary edits from qradar.py
2020-07-23 10:34:29 -04:00
0e49a6acdf
Default NOT to false for all functions
2020-07-23 10:18:16 -04:00
0fac21f4a3
Remove modifications from base file and override in stix.py
2020-07-23 10:13:30 -04:00
a03d1b091e
Merge pull request #1 from simrankaursoin/master
...
Fix NOT bug
2020-07-23 09:50:18 -04:00
30ff22776a
Fix NOT bug
2020-07-23 09:41:33 -04:00
951c6fee8b
Update sysmon_password_dumper_lsass.yml
2020-07-23 14:31:21 +02:00
5019f2f160
added mapping for stix web, cloud, linux
2020-07-22 21:41:46 +03:00
02a6b20f5f
Merge pull request #944 from rtkdmasse/update-rule-selections
...
Add 'contains' for the ps encoded chars rule
2020-07-22 17:48:18 +02:00
13cf0488ae
Add 'contains' for the ps encoded chars rule
2020-07-22 10:49:22 -04:00
db98fe79b0
Revert "rule: update - MATA framework UserAgent"
...
This reverts commit 81ef0137c5
2020-07-22 14:02:51 +02:00
81ef0137c5
rule: update - MATA framework UserAgent
2020-07-22 14:02:13 +02:00
9682d37ead
Merge pull request #941 from architect00/master
...
fixed wrong function call for elastalert aggregation. fixes #940
2020-07-22 13:13:18 +02:00
769a9212a5
Merge pull request #943 from diskurse/rule-devel
...
Webshell Recon Detection Via CommandLine & ProcessesAdd files via upload
2020-07-22 13:02:44 +02:00
023bf76363
Add files via upload
...
Looking for processes spawned by web server components that indicate reconnaissance by popular public domain webshells for whether perl, python or wget are installed.
2020-07-22 09:05:50 +01:00
0543ec1ae3
mapping update, removed unused fields
2020-07-21 19:49:26 +03:00
83623f396c
Merge remote-tracking branch 'upstream/master'
2020-07-21 17:22:06 +03:00
da30266c60
ImageLoaded mapping added
2020-07-21 17:21:14 +03:00
875360f373
fixed wrong function call for elastalert aggregation. fixes #940
2020-07-20 14:32:30 +02:00
Florian Roth