e10fa684bd
Merge pull request #3074 from nasbench/master
...
Fix typo and quick update to "msdt" rule
2022-06-01 18:34:38 +02:00
90f22771a0
Merge pull request #3073 from Yochana-H/Yochana-H
...
Create azure_conditional_access_failure
2022-06-01 18:28:39 +02:00
5fd61875dc
fix title case
2022-06-01 17:37:17 +02:00
6b0584ddd2
Update azure_conditional_access_failure.yml
2022-06-01 17:27:00 +02:00
30225cab11
Update proc_creation_win_msdt.yml
...
- Add MITRE tag
2022-06-01 16:00:43 +01:00
7c9210a119
Update proc_creation_win_msdt.yml
2022-06-01 15:55:12 +01:00
6aad923023
Fix typo and Update Rule
...
- Fixed typo in PowerShell definition to "enabled"
- Removed leading space from "/af" flag in "msdt" rule as it can be used without leading space.
2022-06-01 15:54:40 +01:00
21da958f98
Delete azure_conditional_access_failure.txt
2022-06-01 12:58:34 +01:00
b912a8a7c2
Merge branch 'Yochana-H' of https://github.com/Yochana-H/sigma into Yochana-H
2022-06-01 12:04:28 +01:00
8d8e74d44d
Create azure_conditional_access_failure.txt
...
Sign-In failures due to Conditional Access requirements not being met.
2022-06-01 12:04:24 +01:00
eec0dfe821
Create azure_conditional_access_failure.txt
...
Sign-In failures due to Conditional Access requirements not being met.
2022-06-01 10:22:43 +01:00
587b5aa6a7
Merge pull request #3070 from leegengyu/patch-1
...
Update proc_creation_win_susp_conhost_option.yml - Remove Empty Reference Line
2022-06-01 06:34:51 +02:00
5ac620b555
Merge pull request #3069 from redsand/fp_UserInitMprLogonScript_citrix_icast
...
FP: citrix icast default userinit logon script.
2022-06-01 06:29:16 +02:00
8fa6f8f3e7
Merge pull request #3068 from nasbench/master
...
Update proc_creation_win_msdt.yml
2022-06-01 06:27:47 +02:00
da044e5cb8
Update proc_creation_win_susp_conhost_option.yml
...
Remove empty line reference.
2022-06-01 09:39:03 +08:00
6d68d5bfb0
FP: citrix icast default userinit logon script.
2022-05-31 21:53:13 +00:00
40f4ab328a
Update proc_creation_win_msdt.yml
...
- Added possible answer flag "/af" for possible execution with answer files.
- Removed the parent selection as it's already covered by the rule: 23daeb52-e6eb-493c-8607-c4f0246cb7d8
2022-05-31 21:48:01 +01:00
945f44ac45
Merge pull request #3062 from Corissalea/corissalea
...
Create azure_aad_secops _signin_failure_bad_password_threshold.yml
2022-05-31 20:50:12 +02:00
95a0263799
Rename azure_aad_secops _signin_failure_bad_password_threshold.yml to azure_aad_secops_signin_failure_bad_password_threshold.yml
2022-05-31 20:43:32 +02:00
cafc12e334
Update azure_aad_secops _signin_failure_bad_password_threshold.yml
2022-05-31 20:36:37 +02:00
9f115af449
Update azure_aad_secops _signin_failure_bad_password_threshold.yml
...
updated title to remove capital letters and replaced a tag with the proper MITRE tactic check.
2022-05-31 11:25:03 -05:00
6d868a1964
Merge pull request #3065 from nasbench/master
...
Update proc_creation_win_msdt.yml
2022-05-31 11:19:54 +02:00
9586863433
Update proc_creation_win_msdt.yml
2022-05-31 10:11:09 +01:00
14d81bae06
Update proc_creation_win_msdt.yml
2022-05-31 09:46:40 +01:00
1e16ed0090
Merge pull request #3055 from phantinuss/master
...
Rule Harmonization
2022-05-31 08:27:35 +02:00
b5a47ef967
Create azure_aad_secops _signin_failure_bad_password_threshold.yml
2022-05-30 05:35:52 -05:00
f954273d0a
Merge pull request #3060 from frack113/fix_date
...
update date
2022-05-30 11:41:43 +02:00
4010249934
update date
2022-05-30 11:24:54 +02:00
204df4b094
Merge pull request #3057 from frack113/lolbas_20220528
...
Lolbas
2022-05-30 08:46:46 +02:00
81fd9c80b9
chore: move deprecated rule instead of deleting
2022-05-30 08:43:40 +02:00
87ce5e3fe7
Update registry_set_lolbas_onedrivestandaloneupdater.yml
2022-05-30 08:40:29 +02:00
41d5ea5042
Update proc_creation_win_lolbas_utilityfunctions.yml
2022-05-30 08:35:06 +02:00
c2e5ca2f12
Merge pull request #3056 from maximelb/OriginalFilename-case
...
Support alternate case for OriginalFileName.
2022-05-30 06:51:08 +02:00
6e41ecdaaf
Merge pull request #3059 from c3rb3ru5d3d53c/patch-1
...
Follina — a Microsoft Office code execution vulnerability
2022-05-30 06:50:53 +02:00
9f64bf26a9
Merge pull request #3058 from nasbench/master
...
Create proc_creation_win_msdt.yml
2022-05-30 06:48:00 +02:00
18dc60858a
Fix selection1
2022-05-30 06:44:45 +02:00
7cd648a1ed
Update proc_creation_win_lolbins_by_office_applications.yml
...
https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
2022-05-29 21:28:35 -03:00
e9d18b5075
Create proc_creation_win_msdt.yml
2022-05-29 12:53:45 +01:00
7897192050
Merge branch 'master' of github.com:frack113/sigma into lolbas_20220528
2022-05-28 17:05:39 +02:00
b243c65d8a
Fix date
2022-05-28 17:04:12 +02:00
5b2ab692dc
Lolbas rule
2022-05-28 16:54:45 +02:00
3fdaf8b9f1
Support alternate case for OriginalFileName.
2022-05-27 11:01:22 -07:00
7266c9ff62
fix: specify for local system user
2022-05-27 15:46:56 +02:00
54c2977ddb
chore: harmonize wuauclt rules - kept the oldest, most generic, highest level one
2022-05-27 15:16:31 +02:00
32169dbc33
chore: harmonization of generic 'nt system' user checks
...
also a simple (non-commprehensive) test case to find
usages of localized user names
2022-05-27 15:16:31 +02:00
465886d6e3
fix: FP found in testing
2022-05-27 15:16:30 +02:00
ff6c54ded6
Merge pull request #3044 from redsand/fp_file_event_win_webshell_creation
...
FP: System image (driver) restoring files. Valid behavior
2022-05-27 15:11:58 +02:00
9c0e7cf3e8
Merge pull request #3049 from MarkMorow/markmorow
...
Create azure_app_credential_added.yml
2022-05-27 07:01:39 +02:00
61ee06897a
Merge pull request #3054 from redsand/fp_proc_creation_ibm_desktop
...
FP: IBM ClientSolutions is valid directory
2022-05-27 07:00:01 +02:00
dc6640678a
Merge pull request #3053 from redsand/fp_net_connection_from_desktop_ibm
...
Fp net connection from desktop ibm
2022-05-27 06:58:45 +02:00
frack113