e16974522b
Update sysmon_process_hollowing.yml
...
Update filters
2022-02-01 15:19:36 +07:00
0d27cf9681
Merge pull request #2624 from SigmaHQ/rule-devel
...
Some TeamViewer rules
2022-01-31 16:38:58 +01:00
926f9b588c
Merge pull request #2605 from securepeacock/patch-9
...
Rundll32 From Abnormal Drive
2022-01-31 16:38:46 +01:00
7ceb3968d8
Update file_event_susp_teamviewer_remote_session.yml
2022-01-31 06:24:02 +01:00
c35973d6e7
rule: TeamViewer remote session
2022-01-30 22:26:13 +01:00
ba3065e943
refactor: added another TV domain
2022-01-30 22:26:01 +01:00
1b57916890
rule: suspicious renamed teamviewer
2022-01-30 22:05:47 +01:00
fb44e9ae56
Update process_creation_rundll32_not_from_c_drive.yml
2022-01-30 21:48:57 +01:00
d27deada7d
Merge pull request #2622 from frack113/red_20220130
...
win_pc_susp_takeown
2022-01-30 18:06:36 +01:00
542a901f57
add win_pc_susp_takeown
2022-01-30 12:03:32 +01:00
545e8c1c03
Merge pull request #2606 from securepeacock/patch-10
...
Create sysmon_process_hollowing.yml
2022-01-30 11:33:58 +01:00
027fce7f13
Update sysmon_process_hollowing.yml
2022-01-29 23:55:21 +01:00
e0425f2167
Merge pull request #2620 from SigmaHQ/aurora-false-positive-fixing
...
Aurora false positive fixing
2022-01-29 19:34:02 +01:00
8d5742e83e
fix: fixing FPs with LSASS access mask in old rule
2022-01-29 18:17:46 +01:00
642b3748fe
Merge pull request #2615 from frack113/redcannary_20220128
...
Add windows redcannary rules
2022-01-29 15:25:40 +01:00
dc19846101
fix: FPs in deprecated rule
2022-01-28 23:43:11 +01:00
56fba15638
Update process_creation_tool_nircmd.yml
2022-01-28 23:14:17 +01:00
34c8de908d
Update process_creation_tool_nircmd_as_system.yml
2022-01-28 23:08:41 +01:00
6f96372ece
Update process_creation_tool_nircmd_as_system.yml
2022-01-28 21:10:52 +01:00
b0b9d32dfa
Update process_creation_tool_nircmd.yml
2022-01-28 21:10:03 +01:00
0b09dbdcd1
Update process_creation_tool_nircmd_as_system.yml
2022-01-28 21:01:43 +01:00
883040ee96
Merge pull request #2617 from SigmaHQ/aurora-false-positive-fixing
...
fix: FPs noticed with Aurora
2022-01-28 18:06:39 +01:00
0391cffab4
Merge pull request #2616 from SigmaHQ/rule-devel
...
rule: xordump
2022-01-28 18:06:21 +01:00
7b05827326
fix: FPs noticed with Aurora
2022-01-28 17:26:51 +01:00
bfee0f8067
rule: xordump
2022-01-28 17:26:12 +01:00
5b30db61b0
Add windows redcannary rules
2022-01-28 16:12:38 +01:00
a5cb3ba37f
Merge pull request #2598 from SigmaHQ/rule-devel
...
rules: NirCmd, NSudo, RunX
2022-01-28 12:18:15 +01:00
9a517bae7c
Merge pull request #2614 from frack113/update_ref
...
sysmon_proxy_execution_wuauclt Update References
2022-01-28 11:51:45 +01:00
982808c3db
refactor: whoami / authority, rule: whoami as trusted installer
2022-01-28 11:30:30 +01:00
a6e3b4691b
Update References
2022-01-28 10:30:39 +01:00
d4b4d4e382
Merge pull request #2612 from glennbarrett/patch-1
...
Typo fix in win_plugx_susp_exe_locations.yml
2022-01-28 10:00:07 +01:00
069d4ac8bd
Update modified
2022-01-28 09:09:26 +01:00
4ef359a96f
Merge pull request #2611 from redsand/fp_for_iexplorer
...
adding filter for fp of iexplorer calling cpl
2022-01-28 06:59:35 +01:00
edb769b086
Typo fix in win_plugx_susp_exe_locations.yml
...
Change SysWowo64 to SysWow64
2022-01-27 15:08:54 -05:00
1431992e4e
Merge pull request #2604 from frack113/add_ps_version
...
add posh_ps_clear_powershell_history
2022-01-27 18:24:37 +01:00
f8ce6d87a8
adding filter for fp of iexplorer calling cpls: C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:276824072 WinX:0 WinY:0 IEFrame:0000000000000000
2022-01-27 16:31:37 +00:00
a8cbfa832d
Merge pull request #2609 from SigmaHQ/aurora-false-positive-fixing
...
fix: too many false positives with certain access masks
2022-01-27 16:53:34 +01:00
1aa7697ca8
Update posh_ps_clear_powershell_history.yml
2022-01-27 16:16:57 +01:00
79de1631de
Merge pull request #2601 from secDre4mer/master
...
fix: Add filter for empty image to rule
2022-01-27 16:16:06 +01:00
82d5f4a511
fix: too many false positives with certain access masks
2022-01-27 09:08:40 +01:00
d52602dd5e
Update posh_ps_clear_powershell_history.yml
2022-01-26 18:09:09 +01:00
feedcee6bf
Update posh_ps_clear_powershell_history.yml
2022-01-26 17:57:26 +01:00
e08e8dd3d4
Update sysmon_process_hollowing.yml
2022-01-26 17:53:46 +01:00
b3b37719e7
Update sysmon_lsass_memdump.yml
...
Updated Sysmon Lsass Memdump to detect other memory dumping techniques from mimikatz, nanodump, invoke-mimikatz, and so forth. This adds additional GrantedAccess permissions and adds ntdll.dll to CallTrace. Tested with Atomic Red Team T1003.001, MimiKatz, Invoke-Mimikatz and Cobalt Strike.
2022-01-26 08:12:49 -07:00
364b5c9620
Create sysmon_process_hollowing.yml
...
Closed old request, and put rule into its appropriate file directory.
2022-01-25 15:57:03 -05:00
1cfa06e6e6
Update process_creation_rundll32_not_from_c_drive.yml
2022-01-25 14:43:30 -05:00
076b0c9246
Create process_creation_rundll32_not_from_c_drive.yml
...
Sample Log:
Process Create: RuleName: - UtcTime: 2022-01-25 17:12:12.156 ProcessGuid: {A931971D-2F6C-61F0-D700-000000005200} ProcessId: 724 Image: C:\Windows\notepad.exe FileVersion: 10.0.14393.0 (rs1_release.160715-1616) Description: Notepad Product: Microsoft® Windows® Operating System Company: Microsoft Corporation OriginalFileName: NOTEPAD.EXE CommandLine: "c:\windows\notepad.exe" CurrentDirectory: E:\ User: WINDOMAIN\vagrant LogonGuid: {A931971D-283E-61F0-3DF7-080000000000} LogonId: 0x8F73D TerminalSessionId: 1 IntegrityLevel: Medium Hashes: SHA1=40F2E778CF1EFFA957C719D2398E641EFF20E613,MD5=3B508CAE5DEBCBA928B5BC355517E2E6,SHA256=DA0ACEE8F60A460CFB5249E262D3D53211EBC4C777579E99C8202B761541110A,IMPHASH=968239BE2020F1C0DAFFDCDBD49E9C82 ParentProcessGuid: {A931971D-2F57-61F0-D600-000000005200} ParentProcessId: 936 ParentImage: C:\Windows\System32\rundll32.exe ParentCommandLine: "C:\Windows\System32\rundll32.exe" SharedFiles.dll,BasicScore ParentUser: WINDOMAIN\vagrant
2022-01-25 14:42:13 -05:00
a68cf58264
Merge pull request #2596 from frack113/blackbyte
...
Add win_re_blackbyte_ransomware
2022-01-25 20:39:05 +01:00
818b20b949
add posh_ps_clear_powershell_history
2022-01-25 19:58:18 +01:00
51d9aca239
chore: update modified date
2022-01-25 11:46:16 +01:00
Sittikorn S