612f66e8a0
Msiexec update in sigma rules
2022-10-24 08:18:25 +02:00
e9d7c3fdfc
Merge pull request #3611 from nasbench/fix-false-positives
...
Fix FP In Testing
2022-10-21 18:11:27 +02:00
c21904620d
fix: FP with conhost / csrss
2022-10-21 13:26:59 +02:00
7bb2832e0f
Merge pull request #3613 from nasbench/nasbench-rule-devel
...
Rule Dev
2022-10-21 08:57:43 +02:00
bdddb3945c
Update proc_creation_win_lolbin_susp_wsl.yml
2022-10-21 08:55:51 +02:00
2b78d921c4
Update proc_creation_win_hack_rubeus.yml
2022-10-20 12:41:23 +02:00
b4cbd6b2ee
Rework Rule Condition
2022-10-20 12:25:52 +02:00
21f8477e43
Add missing OriginalFileName
...
Add missing OriginalFileName for some rules
2022-10-20 12:25:32 +02:00
aabd6efbc1
Create proc_creation_win_susp_service_dacl_modification_set_service.yml
...
Add variation of the technique described in the rule 99cf1e02-00fb-4c0d-8375-563f978dfd37 using the "set-service" cmdlet
2022-10-20 11:57:24 +02:00
3cdd105355
Add SafetyKatz+Seatbelt Rules
2022-10-20 11:56:19 +02:00
1ee657b1fc
Update Hacktool Rules
2022-10-20 11:55:59 +02:00
1512c50b4d
Update proc_creation_win_lolbin_susp_wsl.yml
2022-10-20 11:19:54 +02:00
09b94e2081
fix: FP on test system
2022-10-20 11:08:41 +02:00
f976ad48c1
Merge pull request #3602 from nasbench/nasbench-rule-devel
...
Rule Dev
2022-10-20 10:28:56 +02:00
7a6bb720d9
fix: FPs on test system
2022-10-19 15:44:00 +02:00
676578d2c4
Add PowerShell version of the rule + Fix rule
2022-10-18 16:03:26 +02:00
0fc2e75c0d
Merge branch 'SigmaHQ:master' into nasbench-rule-devel
2022-10-18 14:12:39 +02:00
a72aedb1cc
Small Update To FP
2022-10-18 11:51:37 +02:00
cef6ea0b6b
Update proc_creation_win_renamed_binary.yml
...
Added InstallUtil
https://twitter.com/424f424f/status/1582048291294162946?s=20&t=5uYGiwA_fJP8-7pnK2yViQ
2022-10-17 12:58:29 -04:00
b5500687fa
Add Hide Service Via SDDL Rule
...
Ref: https://twitter.com/Alh4zr3d/status/1580925761996828672
2022-10-17 14:26:29 +02:00
450229537e
Merge pull request #3595 from SigmaHQ/rule-devel
...
rule: extended susp adfind rule, rule: susp wermgr process patterns
2022-10-15 10:49:50 +02:00
404a1b4c6a
Merge pull request #3590 from dmuensterer/patch-1
...
Filter Dell Update Utility: proc_creation_win_susp_non_exe_image.yml
2022-10-14 18:04:59 +02:00
77a61facd2
fix: wrong selector in condition
2022-10-14 17:27:20 +02:00
cc8a1a5441
rule: suspicious wermgr process trees
2022-10-14 15:43:02 +02:00
cca32d824a
fix: FP on testing system
2022-10-14 14:08:45 +02:00
c4ea037717
Merge pull request #3549 from aaronherman/add-susp-lolbin-non-c
...
Add rule for suspicious lolbin executing in non-c drive
2022-10-14 13:23:35 +02:00
d4ed33b84b
fix: typo in filter
2022-10-14 12:42:49 +02:00
b4e1bd1659
Update proc_creation_win_susp_non_exe_image.yml
2022-10-14 12:25:48 +02:00
6706a67bb8
refactor: move few apt rules to categories, del 'apt' folder
2022-10-14 11:44:49 +02:00
7c44a58e5d
refactor: extended renamed adfind detection
2022-10-14 11:40:49 +02:00
329e0f33d0
Merge pull request #3586 from nasbench/nasbench-rule-devel
...
Rule Dev - New+Updated Rules
2022-10-14 10:57:44 +02:00
84daaa0c76
Update proc_creation_win_susp_non_exe_image.yml
...
Added false positive filter for Dell Dockingstation Update Utility.
The Image has a value similar to: C:\Windows\Temp\Helper\C9632CF058AE4321B6B0B5EA39B710FE
ParentImage will always be: C:\Windows\Temp\*\TBT_Dock_Firmware\GetDockVer32W.exe
SHA256: cd2688a74a151b03282388dadb8b6aaca309f2535c8b2b21d1243846d2b259dc
MD5:
2022-10-14 10:36:08 +02:00
0d5dba2d94
Merge pull request #3587 from nasbench/fix-false-positives
...
Fix False Positives
2022-10-14 10:22:24 +02:00
64ade5eb3c
Update proc_creation_win_get_localgroup_member_recon.yml
2022-10-14 01:01:43 +02:00
48e7f9e302
Merge branch 'master' into nasbench-rule-devel
2022-10-14 00:49:20 +02:00
992538ce09
Update proc_creation_win_system_exe_anomaly.yml
2022-10-14 00:39:12 +02:00
48af508541
Create proc_creation_win_office_svchost_child.yml
2022-10-13 13:20:58 +02:00
69b0b9bf93
Merge pull request #3541 from Gude5/master
...
Added some rules based on elastic rules
2022-10-12 18:01:39 +02:00
677cf08bab
Merge pull request #3583 from SigmaHQ/rule-devel
...
refactor: addition to Rubeus rule
2022-10-12 18:01:00 +02:00
0a330250ea
Merge pull request #3576 from phantinuss/master
...
FP fixes and minor QA
2022-10-12 18:00:11 +02:00
3ac4ad7643
Rename+Update Browser Remote Debugging Rule
2022-10-12 15:58:34 +02:00
626effcad4
Update proc_creation_win_susp_plink_usage.yml
2022-10-12 11:25:01 +02:00
d3ca351834
New SSH.EXE rules
2022-10-12 11:24:54 +02:00
faad0209de
Rename Plink Port Forward Rule
2022-10-12 11:24:28 +02:00
f55f4ca2d6
Update Rules
2022-10-12 10:04:15 +02:00
d42e5b5435
New Rules
2022-10-12 10:04:04 +02:00
f2aa1cacf0
Add OriginalFileName
2022-10-12 06:36:32 +02:00
8eed237931
Update proc_creation_win_unusual_parent_for_cmd.yml
2022-10-12 06:28:58 +02:00
4acc692633
Update proc_creation_win_susp_certutil_command.yml
2022-10-12 06:28:34 +02:00
d5b6451f90
Fix modified
2022-10-11 20:30:31 +02:00
schatzimangou