 frack113
|
c4c720cc30
|
Correct cast-sensitive Key "OriginalFileName"
|
2021-05-11 11:16:12 +02:00 |
|
|
frack113
|
720dd24814
|
Correct cast-sensitive Key "OriginalFilename"
|
2021-05-11 11:13:33 +02:00 |
|
|
Bhabesh Rai
|
d90965af38
|
Updated rule for Advanced IP Scanner
|
2021-05-10 20:28:37 +05:45 |
|
|
Florian Roth
|
67e807983c
|
Merge pull request #1470 from SigmaHQ/rule-devel
New CS rule for malformed UAs, FP fixes
|
2021-05-10 13:40:27 +02:00 |
|
|
Florian Roth
|
fcb7aa3bcf
|
fix: FPs with rules
|
2021-05-10 12:42:59 +02:00 |
|
|
Florian Roth
|
270aedfd62
|
Merge pull request #1469 from d4rk-d4nph3/master
Added rule for RClone usage for exfiltration
|
2021-05-10 10:50:35 +02:00 |
|
|
Bhabesh Rai
|
9c8b9756e5
|
Added rule for RClone usage for exfiltration
|
2021-05-10 14:06:53 +05:45 |
|
|
Austin Songer
|
39a21a9e89
|
Got Rid of References that are no longer valid.
|
2021-05-06 14:14:08 -05:00 |
|
|
Florian Roth
|
80c7899c56
|
rule: whoami priv
|
2021-05-05 14:27:36 +02:00 |
|
|
Florian Roth
|
ff50b5b659
|
Merge pull request #1451 from SigmaHQ/rule-devel
Different FP filters
|
2021-04-30 08:31:02 +02:00 |
|
|
Florian Roth
|
020e6c9e29
|
fix: FP with Edge and call by ordinal
|
2021-04-29 18:23:14 +02:00 |
|
|
Florian Roth
|
04709ab9f4
|
refactor: renamed procdump rule
|
2021-04-29 17:59:49 +02:00 |
|
|
Florian Roth
|
4b86d3f407
|
Merge pull request #1449 from SigmaHQ/rule-devel
Rule devel
|
2021-04-29 12:28:12 +02:00 |
|
|
Florian Roth
|
3e5f7aeb5e
|
rule: PowerShell Cmdlet Defender Exclusions
|
2021-04-29 09:56:26 +02:00 |
|
|
Florian Roth
|
9166167447
|
Merge pull request #1433 from d4rk-d4nph3/master
Added rule for Lazarus activity of Apr 2021
|
2021-04-26 20:34:51 +02:00 |
|
|
Florian Roth
|
3008e5b9e7
|
Merge pull request #1438 from ZikyHD/fix_process_creation_msdeploy
Fix typo on CommandLine field
|
2021-04-26 20:33:56 +02:00 |
|
|
Florian Roth
|
194b0af4d2
|
Merge pull request #1439 from ZikyHD/fix_win_manage-bde_lolbas
Fix typo on CommandLine field
|
2021-04-26 20:33:45 +02:00 |
|
|
Florian Roth
|
d24f0b8988
|
feat: generic registry events compatible with native audit logging
|
2021-04-26 09:31:36 +02:00 |
|
|
Cedric Hien
|
748005fc14
|
Fix typo on CommandLine field
|
2021-04-25 15:52:59 +02:00 |
|
|
Cedric Hien
|
c580db166c
|
Fix typo on CommandLine field
|
2021-04-25 15:50:44 +02:00 |
|
|
Florian Roth
|
1ff5e226ad
|
Merge pull request #1436 from SigmaHQ/rule-devel
Rule devel
|
2021-04-23 17:33:07 +02:00 |
|
|
Florian Roth
|
c7ce9154d1
|
Merge pull request #1030 from stevengoossensB/master
Updated sysmon config and rewrite rules to use categories
|
2021-04-23 16:52:25 +02:00 |
|
|
Florian Roth
|
a29ac79a3f
|
refactor: extended comsvcs.dll MiniDump rule
|
2021-04-23 16:46:04 +02:00 |
|
|
Florian Roth
|
6f12a1b099
|
docs: FPs and changed level
|
2021-04-23 16:45:52 +02:00 |
|
|
Florian Roth
|
1333a95c51
|
rule: get-process lsass
|
2021-04-23 16:44:53 +02:00 |
|
|
Florian Roth
|
5aed7c80db
|
Merge pull request #1435 from SigmaHQ/rule-devel
fix: FPs with certutil command and McAfee Chromium Container
|
2021-04-23 14:55:31 +02:00 |
|
|
Florian Roth
|
6256261d0e
|
fix: FPs with Certutil and McAfee Chromium Container
|
2021-04-23 12:49:16 +02:00 |
|
|
Bhabesh Rai
|
dd391cd0b9
|
Added rule for Lazarus activity of Apr 2021
|
2021-04-20 20:05:51 +05:45 |
|
|
Cedric Hien
|
1d6aec3c25
|
Fix typo on CommandLine
|
2021-04-19 08:20:44 +02:00 |
|
|
Steven
|
8703d9f352
|
Remove another reference to hardcoded event ID
|
2021-04-15 03:07:18 +02:00 |
|
|
Steven
|
a9f2a80b8c
|
- Remove duplicate rule
- Fix linux rule (categories -> category)
|
2021-04-15 02:23:08 +02:00 |
|
|
Steven
|
70b106ef52
|
Fix syntax error
|
2021-04-15 02:11:13 +02:00 |
|
|
Steven
|
ecbd730dad
|
Fix syntax errors in some rules
|
2021-04-15 02:07:43 +02:00 |
|
|
Steven
|
850a002840
|
Merge branch 'master' of https://github.com/SigmaHQ/sigma
|
2021-04-15 01:25:48 +02:00 |
|
|
Florian Roth
|
ce0111aa6a
|
fix: FP with Proxy Execution via Wuauclt
|
2021-04-12 08:47:29 +02:00 |
|
|
Florian Roth
|
4abebd98d9
|
Merge pull request #1418 from SigmaHQ/rule-devel
Fixing false positives with newest OSCD rules
|
2021-04-09 17:26:02 +02:00 |
|
|
Florian Roth
|
65a11dde52
|
fix: rules causing too many false positives
|
2021-04-09 15:55:14 +02:00 |
|
|
Thomas Patzke
|
08ca62cc88
|
Merge branch 'master' of https://github.com/SigmaHQ/sigma
|
2021-04-08 23:27:45 +02:00 |
|
|
Thomas Patzke
|
3fef2a10b8
|
Merge branch 'pr-1158'
|
2021-04-08 23:01:54 +02:00 |
|
|
Thomas Patzke
|
a10db2df89
|
Fixes&improvements
|
2021-04-08 01:06:40 +02:00 |
|
|
Vasiliy Burov
|
e73e27e44f
|
Update win_hack_rubeus.yml
Added commandline parameters for constrained delegation abuse and for hashes calculation
|
2021-04-06 20:18:54 +03:00 |
|
|
Thomas Patzke
|
d1de168295
|
Merge branch 'oscd'
|
2021-04-06 00:05:35 +02:00 |
|
|
Thomas Patzke
|
b1b0240692
|
Fixes
|
2021-04-03 23:21:13 +02:00 |
|
|
Thomas Patzke
|
90efe974b8
|
Fixes and improvements
|
2021-04-03 00:08:55 +02:00 |
|
|
phantinuss
|
4934f80601
|
fix: FP tuning for IIS Express and making use of value modifiers
|
2021-04-01 14:37:20 +02:00 |
|
|
phantinuss
|
8b4234de3b
|
refactor: make use of value modifiers
|
2021-04-01 14:37:17 +02:00 |
|
|
phantinuss
|
794865c79d
|
fix: adding filter to condition and reintroducing the users folder constraint
|
2021-04-01 14:37:17 +02:00 |
|
|
phantinuss
|
43be8c8cba
|
refactor: make use of value modifiers
|
2021-04-01 14:37:16 +02:00 |
|
|
phantinuss
|
65bc62d401
|
fix: adding filter out for CamMute.exe
|
2021-04-01 14:37:14 +02:00 |
|
|
phantinuss
|
2cab121c71
|
refactor: merging rule process_creation/win_susp_exec_folder.yml and process_creation/win_susp_prog_location_process_starts.yml because of significant overlap
|
2021-04-01 14:37:13 +02:00 |
|