4 Commits

Author	SHA1	Message	Date
Steven	ecbd730dad	Fix syntax errors in some rules	2021-04-15 02:07:43 +02:00
Steven	850a002840	Merge branch 'master' of https://github.com/SigmaHQ/sigma	2021-04-15 01:25:48 +02:00
Steven	05d2de4c26	- Cleaned up some more rules where 'service: sysmon' was combined with category ... - Replaced 'service: sysmon' with category: ... for some more events to make the rules more product independent modified: rules/windows/builtin/win_invoke_obfuscation_obfuscated_iex_services.yml modified: rules/windows/malware/mal_azorult_reg.yml modified: rules/windows/powershell/powershell_suspicious_profile_create.yml modified: rules/windows/process_creation/sysmon_cmstp_execution.yml modified: rules/windows/process_creation/win_apt_chafer_mar18.yml modified: rules/windows/process_creation/win_apt_unidentified_nov_18.yml modified: rules/windows/process_creation/win_hktl_createminidump.yml modified: rules/windows/process_creation/win_mal_adwind.yml modified: rules/windows/process_creation/win_silenttrinity_stage_use.yml	2020-10-02 10:45:29 +02:00
Steven	8b74abe0bc	- Created new categories for sysmon events ... - Replaced the explicit EventIDs with the reference to the category - Moved the rules to the corresponding directories	2020-09-30 20:44:14 +02:00