 Dennis Potashnik
|
e12d710ab4
|
Fixed config typo
|
2021-03-02 11:51:46 +02:00 |
|
|
Dennis Potashnik
|
563fd3c7e2
|
Fixed error mapping for stix-shifter configuration
|
2021-02-08 17:55:03 +02:00 |
|
|
Dennis Potashnik
|
5143cbeaa7
|
Fixed sigmac stix test invocation
|
2021-02-08 12:23:57 +02:00 |
|
|
Dennis Potashnik
|
08ee6d7f1f
|
deleted missed file
|
2021-02-08 11:44:00 +02:00 |
|
|
Dennis Potashnik
|
2b917d6f97
|
Merge branch 'align-sigmac-stixshifter' into align-simac-stixshifter
|
2021-02-08 11:40:47 +02:00 |
|
|
Dennis P
|
e401750c91
|
Merge pull request #1 from Neo23x0/master
update from upstream
|
2021-02-08 11:03:35 +02:00 |
|
|
Dennis Potashnik
|
08c8db25e9
|
New configuration layout: stix2.0 for basic stix mapings, stix-shifter to match the OCA stix-shifter mappings and stix-custom for the unsupported mappings
|
2021-02-08 10:56:31 +02:00 |
|
|
Florian Roth
|
da570ba173
|
Merge pull request #1217 from noraj/patch-2
readme: package in linux distros
|
2021-02-08 09:29:08 +01:00 |
|
|
Florian Roth
|
08a5f400ba
|
Update README.md
|
2021-02-07 15:27:59 +01:00 |
|
|
Florian Roth
|
8ae8c213a9
|
Merge pull request #1337 from architect00/master
rule: scheduled task deletion
|
2021-02-07 15:26:13 +01:00 |
|
|
Florian Roth
|
10d440eb15
|
Merge pull request #1349 from bartlomiej-czyz/patch-2
Create win_rundll32_without_parameters.yml
|
2021-02-07 15:21:45 +01:00 |
|
|
Florian Roth
|
12054544bb
|
Merge pull request #1350 from Christopolos94/master
Updated fields to align with MS Advanced Threat Hunting Schema.
|
2021-02-04 13:23:38 +01:00 |
|
|
Chris Brake
|
4aa7505b40
|
Updated fields to align with MS Advanced Threat Hunting Schema. Standardised and sorted fields across schemas.
|
2021-02-04 11:54:29 +00:00 |
|
|
bartlomiej-czyz
|
e79168ee56
|
Create win_rundll32_without_parameters.yml
|
2021-02-03 22:18:23 +01:00 |
|
|
Thomas Patzke
|
9eafc8d6a5
|
Merge pull request #1342 from k3mpaxl/master
Fixing Qradar implementation for creating valid AQL queries
|
2021-02-01 19:58:39 +01:00 |
|
|
Florian Roth
|
179db920ec
|
Merge pull request #1343 from Neo23x0/rule-devel
Rule devel
|
2021-02-01 12:28:22 +01:00 |
|
|
Florian Roth
|
aaeb72a2b6
|
fix: FPs
|
2021-02-01 11:47:23 +01:00 |
|
|
Florian Roth
|
33fee6af8b
|
rule: security product uninstallation
|
2021-01-30 11:24:08 +01:00 |
|
|
Florian Roth
|
e533b4effb
|
fix: tags
|
2021-01-28 13:51:51 +01:00 |
|
|
Florian Roth
|
cd4491cba2
|
rule: disable volume snaptshots
|
2021-01-28 13:48:30 +01:00 |
|
|
Gregor
|
921ebf7445
|
Optimizing Qradar query generation in cases where field definitions are missing
|
2021-01-26 15:24:44 +01:00 |
|
|
Gregor
|
ac3730d2fa
|
Fixing Qradar implementation for create valid AQL queries
|
2021-01-25 15:37:05 +01:00 |
|
|
Florian Roth
|
6b9eef58da
|
Merge pull request #1338 from Neo23x0/rule-devel
Improved UNC2452 activity rules
|
2021-01-25 14:36:44 +01:00 |
|
|
Florian Roth
|
7d99a48bb2
|
rule: new Quakbot pattern
|
2021-01-25 12:03:30 +01:00 |
|
|
Florian Roth
|
a4bec724a6
|
rule: SonicWall exploitation
|
2021-01-25 11:54:23 +01:00 |
|
|
Thomas Patzke
|
72468e671f
|
Merge pull request #1340 from WuerthIT/bugfix_field_support
bugfix field support
|
2021-01-22 16:58:45 +01:00 |
|
|
Florian Roth
|
e34bed0f76
|
Merge pull request #1339 from WuerthIT/fix_for_pcap_rule
fix service from system to security for rule win_pcap_drivers.yml
|
2021-01-22 16:15:23 +01:00 |
|
|
k-vdv
|
89a4e48b0a
|
bugfix field support
|
2021-01-22 09:28:23 +01:00 |
|
|
Florian Roth
|
b62c705bf0
|
Improved UNC2452 activity rules
|
2021-01-22 09:18:11 +01:00 |
|
|
k-vdv
|
e4edf7bc1b
|
fix service from system to security for rule win_pcap_drivers.yml
|
2021-01-22 09:10:02 +01:00 |
|
|
David Straßegger
|
6a6929cfb6
|
implemented rule for scheduled task deletion
|
2021-01-22 08:09:56 +01:00 |
|
|
Florian Roth
|
efa39eb18d
|
Merge pull request #1336 from Neo23x0/rule-devel
rule: Raccine uninstall
|
2021-01-21 18:17:31 +01:00 |
|
|
Florian Roth
|
4ad70f0aaa
|
rule: Raccine uninstall
|
2021-01-21 17:59:17 +01:00 |
|
|
Florian Roth
|
492d931138
|
Merge pull request #1335 from Neo23x0/rule-devel
rule: UNC2452 PowerShell pattern
|
2021-01-21 09:20:22 +01:00 |
|
|
Florian Roth
|
c5a7558ca0
|
fix: fixed actor name in description
|
2021-01-21 09:19:51 +01:00 |
|
|
Florian Roth
|
a0b8eeac6f
|
fix: minor issues
|
2021-01-20 18:52:50 +01:00 |
|
|
Florian Roth
|
8b319e3686
|
rule: UNC2452 PowerShell pattern
|
2021-01-20 18:51:49 +01:00 |
|
|
Florian Roth
|
cd4fbca66b
|
Merge pull request #1330 from d4rk-d4nph3/master
Added Stealthy Office Persistence via VSTO
|
2021-01-20 11:36:25 +01:00 |
|
|
Florian Roth
|
c00d3a8fe0
|
Merge pull request #1334 from Neo23x0/rule-devel
rule: plink anomaly rules
|
2021-01-20 11:36:16 +01:00 |
|
|
Bhabesh Rai
|
dac229a8bb
|
Added rule for Oracle WebLogic Exploit CVE-2021-2109
|
2021-01-20 14:28:18 +05:45 |
|
|
Florian Roth
|
eedc483be4
|
rework: impossible rule with Sysmon
|
2021-01-19 14:12:40 +01:00 |
|
|
Florian Roth
|
fdc969385a
|
rule: plink anomaly rules
|
2021-01-19 12:39:40 +01:00 |
|
|
Florian Roth
|
7162528a1a
|
docs: removed CVE
|
2021-01-15 13:25:10 +01:00 |
|
|
Florian Roth
|
3d2c6a118d
|
Merge pull request #1332 from 2d4d/master
Add xHunt Campaign: BumbleBee Webshell
|
2021-01-13 18:19:01 +01:00 |
|
|
Florian Roth
|
d58cdeab3a
|
Merge pull request #1331 from Neo23x0/rule-devel
rule: NTFS vulnerability
|
2021-01-12 09:09:33 +01:00 |
|
|
Arnim Rupp
|
b2860b870e
|
Update win_webshell_detection.yml
|
2021-01-11 21:08:20 +01:00 |
|
|
Florian Roth
|
cf37abee4d
|
docs: more details
|
2021-01-11 19:56:36 +01:00 |
|
|
Arnim Rupp
|
5d80d634c3
|
Add xHunt Campaign: BumbleBee Webshell
add commands and TTP from https://unit42.paloaltonetworks.com/bumblebee-webshell-xhunt-campaign/
|
2021-01-11 19:44:07 +01:00 |
|
|
Florian Roth
|
a0fccf8647
|
rule: NTFS vulnerability
https://twitter.com/jonasLyk/status/1347900440000811010
|
2021-01-11 14:51:26 +01:00 |
|
|
Bhabesh Rai
|
93c7931037
|
Added Stealthy Office Persistence via VSTO
|
2021-01-10 17:54:17 +05:45 |
|