 Thomas Patzke
|
33c80b8428
|
Merge pull request #1092 from zBlurr/win_susp_sqldumper_activity
[OSCD] Sqldumper.exe LOLbin
|
2020-10-13 11:51:41 +02:00 |
|
|
Thomas Patzke
|
bf0f2fcec8
|
Merge pull request #1117 from aw350m33d/oscd_lolbin_settingsynchost
[OSCD] Using SettingSyncHost.exe as LOLBin
|
2020-10-13 11:46:04 +02:00 |
|
|
Thomas Patzke
|
acb02d8d65
|
Merge pull request #1148 from sn0w0tter/oscd
[OSCD] LOLBAS atbroker suspicious execution of ATs
|
2020-10-13 11:45:07 +02:00 |
|
|
Thomas Patzke
|
1684db93d8
|
Merge pull request #1143 from NikitaStormwind/regular28(2)
[OSCD] Detects Obfuscated Powershell via Stdin in Scripts #28 (process_creation)
|
2020-10-13 11:39:46 +02:00 |
|
|
Thomas Patzke
|
2ac29e0fee
|
Merge pull request #1152 from zinint/1009-27-3
[OSCD] Detects Obfuscated Powershell via VAR++ Launcher #27 (process_creation)
|
2020-10-13 11:24:28 +02:00 |
|
|
invrep-de
|
55201a94c0
|
[OSCD] Powershell Disable Windows Defender AV
|
2020-10-13 02:05:00 +02:00 |
|
|
Timur Zinniatullin
|
5bd75521f2
|
Add win_invoke_obfuscation_via_var++.yml
|
2020-10-13 02:23:50 +03:00 |
|
|
sn0w0tter
|
863b880845
|
Titile capitalization
|
2020-10-12 16:04:41 -07:00 |
|
|
Thomas Patzke
|
a289eeaae6
|
Merge pull request #1089 from zBlurr/oscd
[OSCD] Presentationhost.exe LOLbin
|
2020-10-13 01:01:20 +02:00 |
|
|
Thomas Patzke
|
d89ca07daa
|
Merge pull request #1133 from omkar72/oscd-1
[OSCD]updated adfind command line
|
2020-10-13 00:58:56 +02:00 |
|
|
sn0w0tter
|
c6ddbc78ce
|
OSCD LOLBAS atbroker suspicious execution of ATs
|
2020-10-12 15:55:38 -07:00 |
|
|
Thomas Patzke
|
e2e3177e46
|
Merge pull request #1135 from omkar72/oscd-2
[OSCD] finger executable suspicious execution
|
2020-10-13 00:52:27 +02:00 |
|
|
Thomas Patzke
|
80e3c4b587
|
Merge pull request #1137 from banzay021/oscd
[OSCD] Pcwrun.exe detection added
|
2020-10-13 00:51:04 +02:00 |
|
|
Thomas Patzke
|
8bee7272ab
|
Merge pull request #1051 from esebese/oscd
[OSCD] win_syncappvpublishingserver_exe.yml added
|
2020-10-13 00:45:22 +02:00 |
|
|
Thomas Patzke
|
14fcdc9899
|
Merge pull request #1038 from caliskanfurkan/master
[OSCD] Added explorer.exe lolbin
|
2020-10-13 00:36:29 +02:00 |
|
|
Nikita P. Nazarov
|
ec383d9784
|
Detects Obfuscated Powershell via Stdin in Scripts
|
2020-10-12 18:52:28 +03:00 |
|
|
omkargudhate22
|
e2911a025e
|
added tags and corrected image condition format
|
2020-10-12 17:00:57 +05:30 |
|
|
Alexander Sungurov
|
175834fe90
|
Pcwrun.exe detection added
|
2020-10-12 13:52:49 +03:00 |
|
|
Florian Roth
|
b8dc8d3f7e
|
reduced to avoid FPs
|
2020-10-12 10:46:34 +02:00 |
|
|
omkar72
|
0fab2c0930
|
finger executable suspicious execution
|
2020-10-12 13:28:52 +05:30 |
|
|
omkar72
|
99d87d60ec
|
updated adfind command line
|
2020-10-12 12:52:54 +05:30 |
|
|
omkar72
|
cf5ad9197c
|
updated adfind command line
|
2020-10-12 12:42:05 +05:30 |
|
|
omkar72
|
d29a28a4a8
|
updated adfind command line
|
2020-10-12 12:40:50 +05:30 |
|
|
Furkan ÇALIŞKAN
|
edb5b7718e
|
Deleted a part of an already-defined rule
Lolbin rule for explorer.exe proxy execution;
Test scenario;
cd c:\windows\system32
explorer.exe calc.exe
(pops calc.exe) as in https://twitter.com/bohops/status/986984122563391488/photo/1
|
2020-10-11 21:08:17 +03:00 |
|
|
Anton Kutepov
|
b4ae5cb747
|
Fix ATTACK technique.
Also made a couple of minor cosmetic changes.
|
2020-10-10 20:27:00 +03:00 |
|
|
aw350m3
|
8693bd024f
|
Added a rule to detect the use of SettingSyncHost.exe to run hijacked binary
|
2020-10-10 17:07:22 +00:00 |
|
|
Thomas Patzke
|
fe554a88cb
|
Merge pull request #1035 from svch0stz/oscd3
[OSCD] Update win_susp_copy_lateral_movement.yml
|
2020-10-10 00:03:26 +02:00 |
|
|
Furkan ÇALIŞKAN
|
a6112dc268
|
Fixed OSCD wording
|
2020-10-09 11:59:08 +03:00 |
|
|
Furkan ÇALIŞKAN
|
abcc4a59c2
|
Fixed OSCD wording
|
2020-10-09 09:26:01 +03:00 |
|
|
Furkan ÇALIŞKAN
|
789a0c174f
|
Fixed OSCD wording
|
2020-10-09 09:25:38 +03:00 |
|
|
Kirill Kiryanov
|
04d56bade4
|
Removed redundant tag
|
2020-10-08 23:26:51 +03:00 |
|
|
Kirill Kiryanov
|
d00e1073ee
|
Revert "Created rule win_susp_presentationhost_execution.yml"
This reverts commit a38c021876.
|
2020-10-08 22:49:52 +03:00 |
|
|
Kirill Kiryanov
|
7e28bf4df8
|
Fixed title format
|
2020-10-08 14:38:47 +03:00 |
|
|
Kirill Kiryanov
|
55ea538841
|
Created rule win_susp_sqldumper_activity.yml
|
2020-10-08 14:29:21 +03:00 |
|
|
Kirill Kiryanov
|
a09488a90f
|
revert changes for making new pull request
|
2020-10-08 14:20:32 +03:00 |
|
|
Kirill Kiryanov
|
1581be1ec2
|
Created rule win_susp_sqldumper_activity.yml
|
2020-10-08 14:00:43 +03:00 |
|
|
Kirill Kiryanov
|
a38c021876
|
Created rule win_susp_presentationhost_execution.yml
|
2020-10-08 13:24:59 +03:00 |
|
|
Furkan CALISKAN
|
1c413bcf6d
|
Fixed status
|
2020-10-07 20:45:34 +03:00 |
|
|
svch0stz
|
3d048ceba0
|
Update win_susp_copy_lateral_movement.yml
|
2020-10-07 08:18:09 +11:00 |
|
|
svch0stz
|
ee2c79745f
|
Update win_susp_wsl_lolbin.yml
|
2020-10-07 08:12:51 +11:00 |
|
|
Furkan CALISKAN
|
bbb9fed3e6
|
Fixed for FP issues
|
2020-10-06 19:51:55 +03:00 |
|
|
ensar-pcs
|
60b3450fa8
|
[OSCD] win_syncappvpublishingserver_exe.yml added
|
2020-10-06 19:22:16 +03:00 |
|
|
Furkan CALISKAN
|
0023a22ead
|
Added FP conditions and fileshare part for cmdline
|
2020-10-06 19:20:19 +03:00 |
|
|
Furkan CALISKAN
|
a5ceba93a9
|
Fixed conditions
|
2020-10-06 19:15:30 +03:00 |
|
|
Furkan CALISKAN
|
52edc13d15
|
Fixed dates
|
2020-10-06 19:10:33 +03:00 |
|
|
Furkan CALISKAN
|
ea6d60c58f
|
Added print lolbin
|
2020-10-05 23:26:57 +03:00 |
|
|
Furkan CALISKAN
|
db4804d6bf
|
Merge branch 'master' of https://github.com/caliskanfurkan/sigma
|
2020-10-05 23:03:21 +03:00 |
|
|
Furkan CALISKAN
|
4d655138b2
|
Added findstr lolbin
|
2020-10-05 23:03:05 +03:00 |
|
|
Furkan ÇALIŞKAN
|
b147fc3296
|
Update win_susp_explorer.yml
Added known-fp
|
2020-10-05 13:22:43 +03:00 |
|
|
Furkan ÇALIŞKAN
|
85962665fd
|
Update win_susp_explorer.yml
|
2020-10-05 10:49:54 +03:00 |
|