dcf236fede
Quick Updates and Fixes
...
- Added "Invoke-EventViewer.ps1" script to the rule "file_event_win_powershell_exploit_scripts"
- Added "OriginalFileName" to "proc_creation_win_susp_taskkill"
- Created rule for "winword" being used as a LOLBIN to download and load arbitrary DLLs
2022-05-18 12:50:59 +01:00
354e8ded4e
Merge pull request #3020 from nasbench/master
...
Rule Update (Batch 2)
2022-05-18 07:05:34 +02:00
07a79acede
Update proc_creation_win_lolbas_extrac32.yml
2022-05-17 15:33:18 +01:00
389240855d
Update proc_creation_win_lolbas_extrac32.yml
2022-05-17 15:17:09 +01:00
3bbeab2a7b
Requested Changes
2022-05-17 15:04:26 +01:00
7ea6ed3db6
Merge pull request #3016 from frack113/ttdinjec
...
ttdinject lolbin
2022-05-17 06:28:22 +02:00
3a629e8a2e
Update proc_creation_win_certoc_download.yml
2022-05-16 22:05:00 +01:00
f0e05ccb3c
Rule Update (Batch 2)
...
- Added 5 more PowerShell scripts for the rule "file_event_win_powershell_exploit_scripts.yml"
- Created new rule for "certoc" lolbin to cover "Download" option as described in the LOLBAS project
- Created specific rule for the "IEExec" lolbin to cover "Download" option as described in the LOLBAS Project
- Updated some rules to use "OriginalFileName" in addition to the "Image" selection
- Updated some rules to increase coverage.
2022-05-16 22:02:41 +01:00
1da3f8a8dc
Merge pull request #3019 from redsand/fp_taskname_noise
...
FP: filter m$ removaltools from %system32%\MRT.exe and reducing level…
2022-05-16 17:10:37 +02:00
f0f8d601c0
Update proc_creation_win_lolbin_ttdinject.yml
2022-05-16 16:53:41 +02:00
69afab9b9a
Update create_remote_thread_win_ttdinjec.yml
2022-05-16 16:52:27 +02:00
ed5963493c
Merge pull request #3012 from svch0stz/patch-2
...
Update proc_creation_win_webshell_spawn.yml
2022-05-16 16:51:04 +02:00
4ae8fa322d
Merge pull request #3014 from frack113/missing_status
...
Add status
2022-05-16 16:50:18 +02:00
9d4ce6db7d
FP: filter m$ removaltools from %system32%\MRT.exe and reducing level to low from medium. Task removal could possibly even be just informational.
2022-05-16 14:48:01 +00:00
5ec29f38f8
Merge branch 'master' into aurora-false-positive-fixing
2022-05-16 16:05:02 +02:00
55d5766bf9
fix: FPs with lsass as source
2022-05-16 16:04:13 +02:00
17369f2671
Merge pull request #3015 from redsand/fp_ntopenprocess_ms_edge_update
...
FP: ignoreing microsoft edge when performing NtOpenProcess
2022-05-16 10:12:09 +02:00
c240824bd0
ttdinject lolbin
2022-05-16 09:10:28 +02:00
ca6b4d7862
FP: fixing error in labels
2022-05-15 17:41:22 +00:00
1019015473
FP: ignoring vmware to systeminfo.exe
2022-05-15 17:35:02 +00:00
71249ff7e0
FP: ignoring microsoft vc redistributable when performing NtOpenProcess
2022-05-15 17:33:31 +00:00
67e78ef455
FP: ignoreing microsoft edge when performing NtOpenProcess
2022-05-15 17:23:53 +00:00
f386440bb3
Add status
2022-05-15 16:17:02 +02:00
3ec531979a
Update proc_creation_win_webshell_spawn.yml
...
Example pulled from manage engine below:
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ParentImage: C:\Program Files\ManageEngine\SupportCenterPlus\jre\bin\java.exe
ParentCommandline: "..\jre\bin\java" -Dcatalina.home=.. -Dserver.home=.. -Dserver.stats=1000 <snip>
2022-05-15 14:57:21 +10:00
196aa6d83d
move deprecated rules
2022-05-14 09:42:32 +02:00
4241a5d13e
Update proc_creation_win_wmi_spwns_powershell.yml
2022-05-13 15:33:48 +01:00
ae2ddae5aa
Fix Requested Changes
2022-05-13 15:28:22 +01:00
2e689eca54
Quick Fix
...
- Removed "Contains" modifier from "OriginalFileName" across all rules.
- Added "Image" field back in the rules highlighted by Florian
2022-05-13 11:52:31 +01:00
1e494e508a
Update proc_creation_win_powershell_defender_exclusion.yml
...
Added ' -ExclusionIpAddress' Option
2022-05-12 23:28:14 +01:00
d8a3ca6919
Updated Rules to Use OriginalFileName
2022-05-12 23:27:48 +01:00
93caa59248
fix: lowercase false positive
2022-05-12 21:56:46 +02:00
26e041f13a
fix: VSCode icacls
2022-05-12 21:48:05 +02:00
8692140b26
Merge pull request #2982 from jstnk9/master
...
Create registry_set_scr_file_executed_by_rundll32.yml
2022-05-12 17:40:24 +02:00
9e218149d9
Merge pull request #3008 from SigmaHQ/rule-devel
...
refactor: AV rules, changes, new PW protected ZIP rules
2022-05-12 17:38:11 +02:00
1b9ce19b2c
fix: several issues
2022-05-12 17:30:30 +02:00
23fbf66679
Removed duplicate rule
2022-05-12 17:19:57 +02:00
2cd5a93fb6
refactor: update antivirus rules
2022-05-12 17:19:46 +02:00
1f7021fedd
Merge pull request #2996 from frack113/WerFault
...
Add file_event_win_werfault_dll_hijacking
2022-05-12 17:13:11 +02:00
ccfa7742da
Update file_event_win_werfault_dll_hijacking.yml
2022-05-12 13:59:49 +02:00
d74d287bac
Merge pull request #2998 from redsand/spotify_co_for_bits_admin
...
Adds allow for spotify streaming, which uses this service
2022-05-12 13:02:48 +02:00
ee3aba2541
Merge pull request #3005 from BlackB0lt/patch-27
...
Create win_security_krbrelayup_service_installation.yml
2022-05-12 13:01:44 +02:00
fe312319d3
Update win_security_krbrelayup_service_installation.yml
2022-05-12 13:01:24 +02:00
69b4bd551c
Merge pull request #3004 from redsand/fp_dnsZoneScope
...
filtering out dnsZoneScope
2022-05-12 06:56:50 +02:00
ca19c41192
Merge pull request #3001 from redsand/fp_zeek_add_ip6_non_routable
...
FP - adding ip6 non routable filter for zeek
2022-05-11 16:48:23 +02:00
3f3f986259
unifying detection
2022-05-11 14:30:14 +00:00
20e09530cf
removing leading carrot. moved to startswith usage
2022-05-11 14:07:47 +00:00
2b0db86440
Merge pull request #3002 from phantinuss/master
...
Various new Rule Tests
2022-05-11 15:49:46 +02:00
800669d90c
Update win_security_krbrelayup_service_installation.yml
2022-05-11 18:59:37 +07:00
df8c6c118f
Create win_security_krbrelayup_service_installation.yml
...
Detects service creation from KrbRelayUp tool
2022-05-11 18:59:14 +07:00
6f92a11c02
chore: test rules: check for all modifier with single item
2022-05-11 11:06:09 +02:00
Nasreddine Bencherchali