 Florian Roth
|
c44b22b52f
|
Merge pull request #1762 from frack113/redcanary_collection
[OSCD] Redcanary TA0009 collection
|
2021-08-05 15:49:10 +02:00 |
|
|
Florian Roth
|
448868302d
|
Merge pull request #1767 from frack113/redcanary_t1497_001
[OSCD] Detect Virtualization Environment (Windows) T1497.001
|
2021-08-05 15:47:37 +02:00 |
|
|
Florian Roth
|
3634901bf1
|
Update poweshell_detect_vm_env.yml
|
2021-08-05 15:47:29 +02:00 |
|
|
Florian Roth
|
6a11190e79
|
Merge pull request #1769 from frack113/fix_powershell_400
Cleanup eventid 400 powershell-classic
|
2021-08-05 15:47:04 +02:00 |
|
|
Florian Roth
|
da6b5f8ec5
|
Merge pull request #1770 from frack113/redcanary_powershell_T1070.006
[OSCD] powershell_timestomp.yml T1070.006
|
2021-08-05 15:46:48 +02:00 |
|
|
Florian Roth
|
b1fb462c39
|
Update powershell_timestomp.yml
|
2021-08-05 15:46:01 +02:00 |
|
|
frack113
|
f040725dd8
|
fix EventID: 4104 ScriptBlockText
|
2021-08-04 14:49:50 +02:00 |
|
|
frack113
|
644fe80786
|
add powershell_timestomp.yml
|
2021-08-03 16:01:54 +02:00 |
|
|
frack113
|
b5e4b04cb5
|
fix eventid 400 powershell-classic
|
2021-08-03 10:04:15 +02:00 |
|
|
frack113
|
0efe69bd36
|
add poweshell_detect_vm_env.yml
|
2021-08-03 08:30:26 +02:00 |
|
|
frack113
|
e33ec91b9a
|
add powershell_keylogging.yml
|
2021-07-30 08:28:19 +02:00 |
|
|
frack113
|
38ede57cb4
|
add powershell_suspicious_recon.yml
|
2021-07-30 08:20:51 +02:00 |
|
|
frack113
|
2758c1aa93
|
add powershell_automated_collection.yml
|
2021-07-28 14:14:02 +02:00 |
|
|
frack113
|
aff5264096
|
Add check for status and level
|
2021-07-22 19:25:51 +02:00 |
|
|
Florian Roth
|
edfd082754
|
Merge pull request #1716 from frack113/elk_keyword_rule
powershell_nishang_malicious_commandlets Elk keywords trouble
|
2021-07-22 15:01:13 +02:00 |
|
|
Florian Roth
|
7a8fcf4237
|
Merge pull request #1718 from frack113/powercat
[OSCD] powershell_powercat.yml T1095
|
2021-07-22 14:53:34 +02:00 |
|
|
frack113
|
4cc4df35d8
|
add powershell_suspicious_mail_acces.yml
|
2021-07-21 15:27:12 +02:00 |
|
|
frack113
|
72da7a3053
|
fix tags attack.t1095
|
2021-07-21 13:08:35 +02:00 |
|
|
frack113
|
41c4f1d157
|
add powershell_powercat.yml
|
2021-07-21 13:04:27 +02:00 |
|
|
frack113
|
44254038d3
|
fix human error : test-sigmac Error 4
|
2021-07-21 10:01:46 +02:00 |
|
|
frack113
|
b9b0ef2066
|
convert keywords to correct field name Payload
|
2021-07-21 09:44:26 +02:00 |
|
|
frack113
|
ba50a2309c
|
fix case EventID
|
2021-07-20 16:26:13 +02:00 |
|
|
frack113
|
42005a07b7
|
update powershell_suspicious_download.yml
|
2021-07-20 16:12:24 +02:00 |
|
|
Florian Roth
|
8a75890b51
|
Merge pull request #1702 from d4rk-d4nph3/master
Added rule for ADRecon execution
|
2021-07-17 09:50:29 +02:00 |
|
|
Florian Roth
|
e838a1acc4
|
increased level
|
2021-07-17 09:50:11 +02:00 |
|
|
Bhabesh Rai
|
be8fce8e82
|
Added rule for ADRecon execution
|
2021-07-16 12:58:47 +05:45 |
|
|
Florian Roth
|
e40b859254
|
Merge pull request #1695 from frack113/fix_re
escape / in regex
|
2021-07-15 09:25:58 +02:00 |
|
|
frack113
|
0ef3dc2082
|
escape / in regex
|
2021-07-15 08:13:49 +02:00 |
|
|
k-vdv
|
12b172039f
|
fixed some typos and adjusted capitalization to original
|
2021-07-14 15:47:17 +02:00 |
|
|
leegengyu
|
3594b10d74
|
Insert modified date
|
2021-07-06 20:56:31 +08:00 |
|
|
G Y
|
c5d2a55f6d
|
powershell_data_compressed.yml - Update selection
Changed to ScriptBlockText (due to PowerShell logging-specific context).
|
2021-07-06 20:36:38 +08:00 |
|
|
leegengyu
|
7557732ca2
|
Updated ART reference links from .yaml to .md and sub-technique links.
|
2021-07-06 17:21:22 +08:00 |
|
|
frack113
|
d05f3efd1b
|
fix pr 869
|
2021-07-04 19:44:50 +02:00 |
|
|
Florian Roth
|
1e152bf594
|
Merge pull request #1615 from leegengyu/patch-1
Update powershell_data_compressed.yml - Outdated link
|
2021-07-04 14:19:55 +02:00 |
|
|
G Y
|
c63439e74d
|
Update powershell_data_compressed.yml
Changed reference link from `.yaml` to `.md`.
|
2021-07-04 08:15:29 +08:00 |
|
|
G Y
|
d247766a2e
|
Update powershell_data_compressed.yml
Corrected old link and formatting.
|
2021-07-03 20:48:03 +08:00 |
|
|
Florian Roth
|
e7144b34ee
|
fix: bug in syntax
|
2021-07-03 13:19:56 +02:00 |
|
|
Florian Roth
|
2d0cdc16fc
|
added modified date
|
2021-07-03 13:19:14 +02:00 |
|
|
G Y
|
7f067f7273
|
Update powershell_powerview_malicious_commandlets.yml
Added new commandlet names based on aliases seen in https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1, fixed a typo, and improved formatting.
|
2021-07-03 11:07:11 +08:00 |
|
|
Bhabesh Rai
|
206adbb2b6
|
Merging upstream updates
|
2021-07-01 12:18:30 +05:45 |
|
|
CriimBow
|
188b847670
|
Typo on Find-DomainObjectPropertyOutlier
|
2021-06-25 10:35:33 +02:00 |
|
|
Florian Roth
|
5e35e387dd
|
Merge pull request #1549 from SigmaHQ/rule-devel
Rule devel
|
2021-06-10 10:19:47 +02:00 |
|
|
Florian Roth
|
9c0700bc56
|
Powershell artefacts to critical
|
2021-06-10 09:42:07 +02:00 |
|
|
Florian Roth
|
04faf985d2
|
more PowerShell suspicious keywords
|
2021-06-10 09:41:55 +02:00 |
|
|
Florian Roth
|
cfdf3b7c08
|
Merge pull request #1538 from frack113/powershell_delete_volume_shadow_copies
Add t1490 powershell delete volume shadow copie
|
2021-06-08 11:02:34 +02:00 |
|
|
frack113
|
0a6f7763aa
|
Split original to existing file
|
2021-06-07 20:27:14 +02:00 |
|
|
frack113
|
537272c944
|
Add t1490 powershell delete volume shadow copie
|
2021-06-03 22:39:06 +02:00 |
|
|
frack113
|
bf98f43850
|
Set powershell_alternate_powershell_hosts.yml more accurate by adding the correct channel for EventID
|
2021-06-01 10:47:17 +02:00 |
|
|
Florian Roth
|
ea430c8823
|
Merge pull request #1471 from d4rk-d4nph3/master
Updated rule for Advanced IP Scanner and new rule for PowerView
|
2021-05-27 12:55:03 +02:00 |
|
|
Florian Roth
|
059e669ac6
|
Merge pull request #1496 from frack113/falsepositives_NOT_a_list
Fix rule where Falsepositives not a valid value
|
2021-05-27 12:51:54 +02:00 |
|