da54e89f30
Merge pull request #976 from diskurse/rule-devel
...
Rule devel
2020-08-17 15:02:31 +02:00
8a02541b0a
style: removed lists where unnecessary
2020-08-17 15:02:16 +02:00
6dc8dbb6d8
style: removed lists where unnecessary
2020-08-17 15:01:52 +02:00
b378b3d62b
win_mouse_lock.yml
...
In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.
2020-08-13 12:09:07 +01:00
d1e9f01d23
win_dnscat2_powershell_implementation.yml
...
The PowerShell implementation of DNSCat2 calls nslookup to craft queries. Counting nslookup processes spawned by PowerShell will show hundreds or thousands of instances if PS DNSCat2 is active locally.
2020-08-13 12:06:48 +01:00
052379a512
fix: tightened TAIDOOR rule
2020-08-04 14:37:18 +02:00
c4953409aa
rule: TAIDOOR malware load
...
https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a
2020-08-04 14:31:29 +02:00
df3bfb1b37
rule: Winnti Pipemon
2020-07-30 18:55:47 +02:00
5abf101c0b
Merge pull request #954 from Neo23x0/rule-devel
...
Rule devel
2020-07-28 10:22:52 +02:00
8970d03f6f
Merge pull request #952 from Neo23x0/devel
...
feat: Detect duplicate rule tags
2020-07-28 10:21:59 +02:00
80f4b4ec71
fix: rules with duplicate tags
2020-07-27 11:44:47 +02:00
77a8ac59ef
remove duplicate
2020-07-24 16:38:08 +02:00
8a4b53eb3a
fix: rule leads to FPs on systems that don't log the cmdline parameters
2020-07-23 17:04:16 +02:00
13cf0488ae
Add 'contains' for the ps encoded chars rule
2020-07-22 10:49:22 -04:00
769a9212a5
Merge pull request #943 from diskurse/rule-devel
...
Webshell Recon Detection Via CommandLine & ProcessesAdd files via upload
2020-07-22 13:02:44 +02:00
023bf76363
Add files via upload
...
Looking for processes spawned by web server components that indicate reconnaissance by popular public domain webshells for whether perl, python or wget are installed.
2020-07-22 09:05:50 +01:00
ff3f9fe9b3
Updated tags
2020-07-18 03:02:43 +01:00
4ffe9cb042
Updated tags with sub-techniques
2020-07-18 02:53:46 +01:00
3bd768e49b
Updated tags with sub-techniques
2020-07-18 02:52:15 +01:00
1442812681
Updated tags
2020-07-18 02:44:53 +01:00
30bd591c96
Update win_apt_ke3chang to include sub-techniques
2020-07-18 02:37:56 +01:00
3025d6850c
Merge pull request #932 from rtkdmasse/rule-selection-typos
...
Change the selection from Command to CommandLine in a couple of rules
2020-07-16 09:10:15 +02:00
b1de627e94
Update win_apt_zxshell.yml
2020-07-16 08:47:24 +02:00
0489a50bd0
Change the selection from Command to CommandLine in a couple of rules
2020-07-15 15:55:26 -04:00
8f66803ddf
Merge pull request #927 from Neo23x0/rule-devel
...
improved CVE-2020-1350 rule
2020-07-15 12:06:31 +02:00
1c103a749f
fix: more FPs based on feedback
...
https://twitter.com/GossiTheDog/status/1283341486680166400
2020-07-15 12:05:50 +02:00
c2eb110fca
fix: more exact patterns
2020-07-15 11:56:11 +02:00
ae7fbb9245
fix: false positive filters based on SOC Prime's rule
2020-07-15 11:49:20 +02:00
e5a34a965c
Merge pull request #926 from Neo23x0/rule-devel
...
rule: CVE-2020-1350
2020-07-15 11:19:07 +02:00
80639afd43
rule: CVE-2020-1350
2020-07-15 11:03:31 +02:00
c7e412788a
Merge pull request #924 from Neo23x0/devel
...
Live MITRE ATT&CK data from TAXI service in Test Scripts
2020-07-14 18:15:29 +02:00
38c29977ff
Merge pull request #925 from Neo23x0/rule-devel
...
fix: issue reported as https://github.com/Neo23x0/sigma/issues/923
2020-07-14 18:14:51 +02:00
741d42ce88
fix: issue reported as https://github.com/Neo23x0/sigma/issues/923
2020-07-14 17:59:59 +02:00
58b68758b4
fix: wrong MITRE ATT&CK ids used in the beta version
2020-07-14 17:53:32 +02:00
437a567e4f
Merge pull request #917 from Neo23x0/rule-devel
...
New Empire Rules and Updates
2020-07-13 16:37:59 +02:00
557e8b0faf
rule: improved Empire detection
2020-07-13 15:47:53 +02:00
7e8aa7b12b
Merge pull request #915 from Neo23x0/rule-devel
...
rule: regsvr32 flags anomaly
2020-07-13 12:16:05 +02:00
7a63fd56da
rule: regsvr32 flags anomaly
2020-07-13 11:59:44 +02:00
168952840b
Merge pull request #910 from Neo23x0/rule-devel
...
Rule devel
2020-07-10 14:17:22 +02:00
268a28daed
rule: Evilnum Golden Chicken rule OCX
2020-07-10 13:02:52 +02:00
7949729fa4
rule: PowerShell encoded character syntax
2020-07-09 08:52:32 +02:00
3e17cc1900
Merge pull request #894 from caliskanfurkan/master
...
ditsnap, a credential access tool used in ransomware attacks
2020-07-07 23:21:36 +02:00
8ef82e48eb
ditsnap
2020-07-04 23:21:52 +03:00
11517edbd7
rule: suspicious curl usage
2020-07-03 18:55:44 +02:00
c4267a4614
rule: suspicious curl file upload
2020-07-03 18:20:44 +02:00
4d9e2e8c16
fix: trailing white space
2020-07-03 17:59:50 +02:00
4dc818aafd
fix: rar flags rule caused too many FPs
2020-07-03 13:20:24 +02:00
abf5f799d6
docs: more references
2020-07-03 13:19:44 +02:00
5f04fcccf5
fix: broken links
2020-07-03 11:22:06 +02:00
3111ab8396
refactor: new way to write that rule
2020-07-03 11:20:36 +02:00
Florian Roth