 Cedric HIEN
|
e4f24f4e1f
|
Fix ProcessCommandLine field
|
2021-03-15 11:56:19 +01:00 |
|
|
Florian Roth
|
310888bae7
|
Merge pull request #1386 from SigmaHQ/rule-devel
Rule devel
|
2021-03-15 10:52:57 +01:00 |
|
|
Florian Roth
|
70f9480ec5
|
fix: wrong field name
|
2021-03-15 08:14:43 +01:00 |
|
|
Thomas Patzke
|
f4734cd5e5
|
Merge pull request #1309 from WuerthIT:logsourcemerging
functionality for parameter logsourcemerging
|
2021-03-13 22:25:29 +01:00 |
|
|
Thomas Patzke
|
c13f3f1383
|
Merge pull request #1325 from dennispo/align-simac-stixshifter
sigmac to STIX enhancements
|
2021-03-13 18:49:12 +01:00 |
|
|
Thomas Patzke
|
bbe41fff95
|
Merge pull request #1364 from SigmaHQ/dependabot/pip/aiohttp-3.7.4
build(deps): bump aiohttp from 3.6.2 to 3.7.4
|
2021-03-13 18:47:33 +01:00 |
|
|
Thomas Patzke
|
99c7889363
|
Merge pull request #1368 from roysjosh/stable-risk-scores
es-rule: make risk scores stable
|
2021-03-13 18:46:37 +01:00 |
|
|
Thomas Patzke
|
d4aa34c0ae
|
Merge pull request #1385 from socprime/chronicle_security_backend
Chronicle Security Backend contributed by SOC Prime.
|
2021-03-13 18:45:12 +01:00 |
|
|
Florian Roth
|
a0b034aa2b
|
fix: better exclusion
|
2021-03-13 09:09:43 +01:00 |
|
|
Florian Roth
|
145c3bc2ca
|
refactor: more hafnium indicators
|
2021-03-13 09:07:58 +01:00 |
|
|
Florian Roth
|
69ee1cece2
|
fix: FPs
|
2021-03-13 09:07:44 +01:00 |
|
|
vh
|
7eeed68fb4
|
Chronicle Security Backend contributed by SOC Prime.
|
2021-03-12 12:21:44 +02:00 |
|
|
Florian Roth
|
48da4e1314
|
Update win_apt_hafnium.yml
|
2021-03-11 13:55:31 +01:00 |
|
|
Florian Roth
|
9084fc4fa7
|
Update on HAFNIUM rule
https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3
|
2021-03-11 13:38:07 +01:00 |
|
|
Florian Roth
|
27fef60ace
|
Merge pull request #1383 from SigmaHQ/rule-devel
fix: FPs with LSASS Access from Non System Account
|
2021-03-10 18:59:29 +01:00 |
|
|
Florian Roth
|
78004cc29c
|
fix: condition contains - values without 0x
|
2021-03-10 18:56:05 +01:00 |
|
|
Florian Roth
|
29dec7dd8b
|
fix: FPs with LSASS Access from Non System Account
|
2021-03-10 18:51:27 +01:00 |
|
|
Florian Roth
|
f0051ffcf6
|
Merge pull request #1378 from SigmaHQ/rule-devel
HAFNIUM activity
|
2021-03-09 15:42:32 +01:00 |
|
|
Florian Roth
|
dca5c870d7
|
Merge pull request #1374 from hieuttmmo/master
Detect HAFNIUM operations
|
2021-03-09 09:16:52 +01:00 |
|
|
Florian Roth
|
ec490b40ec
|
fix: 1 of them condition
|
2021-03-09 09:15:12 +01:00 |
|
|
Florian Roth
|
563335ec5a
|
rule: suspicious service binary location
|
2021-03-09 09:01:36 +01:00 |
|
|
Florian Roth
|
2ded9543f3
|
rule: HAFNIUM post-exploitation activity
|
2021-03-09 09:01:24 +01:00 |
|
|
Florian Roth
|
2b5f9f994f
|
Merge pull request #1376 from SigmaHQ/rule-devel
UNC2452 rules - GoldMax, GoldFinder, Sibot
|
2021-03-05 18:17:20 +01:00 |
|
|
Florian Roth
|
a61fbe6bd8
|
fix: duplicate UUID
|
2021-03-05 12:09:43 +01:00 |
|
|
Florian Roth
|
3a0fc4835a
|
Merge pull request #1363 from markus-nclose/master
Fix CobaltStrike typo
|
2021-03-05 12:06:31 +01:00 |
|
|
Florian Roth
|
b864768de8
|
fix: wrong conditions
|
2021-03-05 11:55:49 +01:00 |
|
|
Florian Roth
|
c3b84f2d5b
|
UNC2452 rules - GoldMax, Sibot, GoldFinder
https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
|
2021-03-05 11:54:35 +01:00 |
|
|
Florian Roth
|
bdc35aa3ec
|
Update win_webshell_spawn.yml
|
2021-03-05 11:34:17 +01:00 |
|
|
Florian Roth
|
62b65a3578
|
Merge pull request #1375 from SigmaHQ/rule-devel
fix: description
|
2021-03-04 17:35:53 +01:00 |
|
|
Florian Roth
|
bea2f226c6
|
fix: description
|
2021-03-04 17:35:25 +01:00 |
|
|
Tran Trung Hieu
|
5f74a58081
|
Detect HAFNIUM operations
|
2021-03-04 00:01:54 +07:00 |
|
|
Florian Roth
|
9e921115bc
|
Merge pull request #1373 from SigmaHQ/rule-devel
HAFNIUM rule
|
2021-03-03 10:34:08 +01:00 |
|
|
Florian Roth
|
d8ded5ebdc
|
refactor: changed symbols after feedback from Volexity
|
2021-03-03 10:15:45 +01:00 |
|
|
Florian Roth
|
e17986ebd3
|
rule: HAFNIUM Exchange exploitation
|
2021-03-03 09:58:43 +01:00 |
|
|
Florian Roth
|
73a3a1e5cd
|
Merge pull request #1360 from d4rk-d4nph3/master
Added sigma rule for vSphere RCE CVE-2021-21972
|
2021-03-03 09:32:05 +01:00 |
|
|
Florian Roth
|
8c95f90075
|
Update web_vsphere_cve_2021_21972_unauth_rce_exploit.yml
|
2021-03-03 09:08:24 +01:00 |
|
|
Bhabesh Rai
|
56eed19fba
|
Added rules for successful exploitation fo CVE-2021-26857/8 in Exchannge
|
2021-03-03 12:46:50 +05:45 |
|
|
Florian Roth
|
6d30f87c0c
|
refactor: procdump use
|
2021-03-02 23:36:25 +01:00 |
|
|
Florian Roth
|
5c1dc30a13
|
Merge pull request #1369 from SigmaHQ/rule-devel
fix: FPs with rule and avast sandbox
|
2021-03-02 15:30:30 +01:00 |
|
|
Dennis Potashnik
|
12cc2cade1
|
Moved references to binary file from custom config to stix-2.0 config
|
2021-03-02 12:04:22 +02:00 |
|
|
Dennis Potashnik
|
e12d710ab4
|
Fixed config typo
|
2021-03-02 11:51:46 +02:00 |
|
|
Florian Roth
|
c873d878b9
|
fix: FPs with rule and avast sandbox
|
2021-03-02 10:08:30 +01:00 |
|
|
Joshua Roys
|
92fcc314bf
|
es-rule: make risk scores stable
Don't create unnecessary deltas between runs.
|
2021-03-01 10:13:34 -05:00 |
|
|
Thomas Patzke
|
a08571be91
|
Merge branch 'master' of https://github.com/Neo23x0/sigma
|
2021-02-28 21:57:51 +01:00 |
|
|
Thomas Patzke
|
778d1c15ab
|
Increased required Python version to 3.8
0.19.1
|
2021-02-28 21:38:09 +01:00 |
|
|
Thomas Patzke
|
6995e6378b
|
Added LGPL to distribution
|
2021-02-28 21:32:38 +01:00 |
|
|
Florian Roth
|
b65dbee01f
|
Merge pull request #1366 from Neo23x0/rule-devel
rule: SilentProcessExit monitors
|
2021-02-26 18:09:44 +01:00 |
|
|
Florian Roth
|
ba7c7409a3
|
fix: typo in modified
|
2021-02-26 17:48:50 +01:00 |
|
|
Florian Roth
|
79acbbef9f
|
rule: SilentProcessExit monitors
|
2021-02-26 17:35:42 +01:00 |
|
|
Florian Roth
|
40710fe89a
|
Merge pull request #1357 from Neo23x0/rule-devel
Rule FP fixes
|
2021-02-26 11:05:00 +01:00 |
|