 Florian Roth
|
e78d7e6aee
|
Merge pull request #1296 from mat-gas/fix-references
fix "references" field + add test for references in plural form
|
2020-12-21 18:25:35 +01:00 |
|
|
Florian Roth
|
377454cb31
|
Merge pull request #1299 from tjgeorgen/patch-1
ATT&CK subtechnique tag updates
|
2020-12-21 18:24:00 +01:00 |
|
|
Florian Roth
|
35ab80b39e
|
Merge pull request #1306 from d4rk-d4nph3/master
Added rule for Impacket's PsExec execution
|
2020-12-21 18:23:41 +01:00 |
|
|
Florian Roth
|
1bb249c6ec
|
Merge pull request #1312 from Neo23x0/rule-devel
rule: Solarwinds SUPERNOVA web shell access
|
2020-12-21 11:30:56 +01:00 |
|
|
Florian Roth
|
9c8e1387a9
|
rule: Solarwinds SUPERNOVA web shell access
|
2020-12-17 09:05:08 +01:00 |
|
|
Bhabesh Rai
|
0a7e95954e
|
Fix for fail build
|
2020-12-14 12:55:08 +05:45 |
|
|
Bhabesh Rai
|
63fb31882e
|
Added rule for Impacket's PsExec execution
|
2020-12-14 12:48:26 +05:45 |
|
|
Florian Roth
|
80e1a5e7eb
|
Merge pull request #1292 from toffeebr33k/master
Create 2 new rules on AWS Privilege Escalation and AWS Enumeration
|
2020-12-13 19:06:44 +01:00 |
|
|
Florian Roth
|
1b0aaf62c3
|
Merge pull request #1266 from omkar72/ryuk
modifying couple of rules
|
2020-12-13 19:05:54 +01:00 |
|
|
Florian Roth
|
e2ade077ed
|
Merge pull request #1275 from bczyz1/patch-3
update win_apt_slingshot.yml
|
2020-12-13 19:04:47 +01:00 |
|
|
Florian Roth
|
d1f7a206b9
|
Merge pull request #1289 from weslambert/master
Fix typo
|
2020-12-13 19:04:07 +01:00 |
|
|
Florian Roth
|
9f70bcab23
|
Merge pull request #1300 from shilch/master
Add sigmac flag to delimit results by NUL instead of \n
|
2020-12-13 19:03:27 +01:00 |
|
|
Florian Roth
|
5197f21ed1
|
fix: duplicate ID
|
2020-12-13 18:59:04 +01:00 |
|
|
Florian Roth
|
c6eadea9d9
|
Merge pull request #1304 from hieuttmmo/master
Detects suspicious shell spawn from MSSQL process, this might be sigh…
|
2020-12-11 18:40:27 +01:00 |
|
|
Florian Roth
|
612008a4d8
|
fix identation
|
2020-12-11 18:40:17 +01:00 |
|
|
Tran Trung Hieu
|
edc79a8bb6
|
Detects suspicious shell spawn from MSSQL process, this might be sight of RCE or SQL Injection
|
2020-12-11 15:17:23 +07:00 |
|
|
Florian Roth
|
cfe60d180b
|
Merge pull request #1301 from d4rk-d4nph3/master
Added rule for Fortinet CVE-2018-13379 preauth file read exploitation.
|
2020-12-08 11:09:51 +01:00 |
|
|
Florian Roth
|
b6d62b7a21
|
Merge pull request #1302 from Neo23x0/rule-devel
TA505 Dropper, minor fix in PowerShell Rule
|
2020-12-08 10:40:07 +01:00 |
|
|
Florian Roth
|
2c642c64d2
|
Removed a value
|
2020-12-08 10:38:32 +01:00 |
|
|
Florian Roth
|
a87a81d8cc
|
Update web_fortinet_cve_2018_13379_preauth_read_exploit.yml
|
2020-12-08 10:33:52 +01:00 |
|
|
Florian Roth
|
640470cefd
|
TA505 Loader Rule
|
2020-12-08 10:15:30 +01:00 |
|
|
Bhabesh Rai
|
3ddf940812
|
Added rule for Fortinet CVE-2018-13379 preauth file read exploitation.
|
2020-12-08 14:46:47 +05:45 |
|
|
Simon
|
97fcae56fd
|
Update sigmac.py
|
2020-12-06 20:08:00 +01:00 |
|
|
Florian Roth
|
540039cbc3
|
fix: Malicious Nishang PowerShell Commandlets FP with MDATP
|
2020-12-05 09:33:42 +01:00 |
|
|
Simon
|
4a4d3e1d35
|
Update sigmac.py
|
2020-12-04 18:22:24 +01:00 |
|
|
Simon Hilchenbach
|
a40ef7360d
|
Add sigmac flag to delimit results by NUL instead of \n
|
2020-12-04 18:05:23 +01:00 |
|
|
tjgeorgen
|
1c6c3a36fe
|
include updated RDP att&ck tag
|
2020-12-04 11:59:23 -05:00 |
|
|
tjgeorgen
|
0eda1ab462
|
also update tag for folder variant
|
2020-12-04 11:42:05 -05:00 |
|
|
tjgeorgen
|
5208bdd65a
|
add new version of ATT&CK T1500 tag
|
2020-12-04 11:19:16 -05:00 |
|
|
Thomas Patzke
|
578d2f0585
|
Merge pull request #1283 from 404d/mdatp-fixes
mdatp: Mapping and generic event changes, case insensitive search
|
2020-11-29 21:56:17 +01:00 |
|
|
OG
|
8e801ede32
|
Update win_susp_psexec_eula.yml
|
2020-11-29 17:45:29 +05:30 |
|
|
mat
|
b3e36281b5
|
fix reference field + add test for references in plural form
|
2020-11-27 10:17:45 +01:00 |
|
|
Florian Roth
|
3d39d49d65
|
Merge pull request #1295 from findthebad/fix-winlogbeat-config
Updated winlogbeat.yml config to include OriginalFileName
|
2020-11-26 23:17:45 +01:00 |
|
|
findthebad
|
ad899899ab
|
Updated winlogbeat.yml config to include OriginalFileName
|
2020-11-26 14:48:14 -05:00 |
|
|
Florian Roth
|
084cd39505
|
Merge pull request #1294 from Neo23x0/devel
Trickbot rules improved
|
2020-11-26 10:13:35 +01:00 |
|
|
Florian Roth
|
c6fc9de144
|
New Trickbot wermgr rule
|
2020-11-26 09:54:27 +01:00 |
|
|
Florian Roth
|
c111ab3141
|
Improved Trickbot recon rule
|
2020-11-26 09:54:13 +01:00 |
|
|
Florian Roth
|
b31ed47ccf
|
Merge branch 'master' into devel
|
2020-11-26 09:44:56 +01:00 |
|
|
Florian Roth
|
13354dd7a2
|
Merge pull request #1293 from hegga/cb-fix-domain-fieldmapping
Fix field mapping for DestinationHostname
|
2020-11-26 09:40:28 +01:00 |
|
|
Helge Aksdal
|
3a7c114ca3
|
Fix field mapping for DestinationHostname
|
2020-11-26 04:17:28 +01:00 |
|
|
bczyz1
|
05398ae95e
|
change field newprocessname -> image
|
2020-11-23 13:43:19 +01:00 |
|
|
toffeebr33k
|
c8c4183678
|
Update aws_enum_listing.yml
|
2020-11-22 01:53:58 +08:00 |
|
|
toffeebr33k
|
3d0e1988c6
|
Update aws_enum_listing.yml
|
2020-11-22 01:41:20 +08:00 |
|
|
toffeebr33k
|
273590b151
|
Update aws_enum_listing.yml
|
2020-11-22 01:17:42 +08:00 |
|
|
toffeebr33k
|
52fca0fe3a
|
Update aws_enum_listing.yml
|
2020-11-22 01:05:56 +08:00 |
|
|
toffeebr33k
|
e764ca687a
|
Update aws_enum_listing.yml
|
2020-11-22 00:50:34 +08:00 |
|
|
toffeebr33k
|
00504ee186
|
Update aws_update_login_profile.yml
|
2020-11-22 00:42:25 +08:00 |
|
|
toffeebr33k
|
3dd1525b98
|
Update aws_update_login_profile.yml
|
2020-11-22 00:38:41 +08:00 |
|
|
toffeebr33k
|
6b65180464
|
Add files via upload
|
2020-11-22 00:33:47 +08:00 |
|
|
toffeebr33k
|
cff82ff79a
|
Delete aws_update_login_profile.yml
|
2020-11-22 00:33:17 +08:00 |
|