 phantinuss
|
109b7890db
|
fix: taking windows security 4688 events into account for filter out
|
2021-04-01 14:36:57 +02:00 |
|
|
Florian Roth
|
b296c643de
|
Merge pull request #1346 from blueteam0ps/patch-3
Added win_ad_find_discovery.yml
|
2021-03-29 11:20:49 +02:00 |
|
|
Florian Roth
|
33af006479
|
Merge pull request #1389 from ZikyHD/patch_win_susp_wuauclt
Fix ProcessCommandLine field
|
2021-03-20 08:29:23 +01:00 |
|
|
Florian Roth
|
01fcfd4f76
|
Merge pull request #1390 from ZikyHD/patch_win_proc_wrong_parent
Add "Microsoft Security Client" directory for MsMpEng.exe (Win<8)
|
2021-03-20 08:29:09 +01:00 |
|
|
Florian Roth
|
2472926c48
|
Merge pull request #1391 from ZikyHD/patch_win_etw_trace_evasion
Fix win_etw_trace_evasion rule
|
2021-03-20 08:28:51 +01:00 |
|
|
Florian Roth
|
6b2bcd3d87
|
Merge pull request #1395 from SigmaHQ/rule-devel
Rule devel
|
2021-03-18 10:52:02 +01:00 |
|
|
Florian Roth
|
92510e2507
|
extended Exchange post-exploitation rule
|
2021-03-17 18:01:45 +01:00 |
|
|
Florian Roth
|
943f8513e2
|
Merge pull request #1393 from SigmaHQ/rule-devel
Rule devel
|
2021-03-16 16:35:55 +01:00 |
|
|
Florian Roth
|
bfc99996b5
|
fix: Bug in rule condition
|
2021-03-16 16:35:21 +01:00 |
|
|
Florian Roth
|
32adf0c3ce
|
fix: prone to FPs
|
2021-03-16 15:52:35 +01:00 |
|
|
zikyhd
|
e91822e070
|
Fix win_etw_trace_evasion rule
|
2021-03-15 15:02:18 +01:00 |
|
|
Cedric HIEN
|
864973888e
|
Add "Microsoft Security Client" directory for MsMpEng.exe (Win<8)
|
2021-03-15 12:07:05 +01:00 |
|
|
Cedric HIEN
|
e4f24f4e1f
|
Fix ProcessCommandLine field
|
2021-03-15 11:56:19 +01:00 |
|
|
Florian Roth
|
310888bae7
|
Merge pull request #1386 from SigmaHQ/rule-devel
Rule devel
|
2021-03-15 10:52:57 +01:00 |
|
|
Florian Roth
|
70f9480ec5
|
fix: wrong field name
|
2021-03-15 08:14:43 +01:00 |
|
|
Florian Roth
|
a0b034aa2b
|
fix: better exclusion
|
2021-03-13 09:09:43 +01:00 |
|
|
Florian Roth
|
145c3bc2ca
|
refactor: more hafnium indicators
|
2021-03-13 09:07:58 +01:00 |
|
|
Florian Roth
|
69ee1cece2
|
fix: FPs
|
2021-03-13 09:07:44 +01:00 |
|
|
Florian Roth
|
48da4e1314
|
Update win_apt_hafnium.yml
|
2021-03-11 13:55:31 +01:00 |
|
|
Florian Roth
|
9084fc4fa7
|
Update on HAFNIUM rule
https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3
|
2021-03-11 13:38:07 +01:00 |
|
|
concorde18
|
87059fe80b
|
Merge branch 'oscd' into DLL-execution-via-register-cimprovider.exe
|
2021-03-10 11:35:55 +03:00 |
|
|
concorde18
|
f694de74aa
|
Create win_susp_diskshadow.yml
|
2021-03-10 11:33:12 +03:00 |
|
|
concorde18
|
b73815e883
|
Update win_susp_Register_cimprovider.yml
|
2021-03-10 11:25:13 +03:00 |
|
|
Florian Roth
|
f0051ffcf6
|
Merge pull request #1378 from SigmaHQ/rule-devel
HAFNIUM activity
|
2021-03-09 15:42:32 +01:00 |
|
|
Florian Roth
|
dca5c870d7
|
Merge pull request #1374 from hieuttmmo/master
Detect HAFNIUM operations
|
2021-03-09 09:16:52 +01:00 |
|
|
Florian Roth
|
ec490b40ec
|
fix: 1 of them condition
|
2021-03-09 09:15:12 +01:00 |
|
|
Florian Roth
|
563335ec5a
|
rule: suspicious service binary location
|
2021-03-09 09:01:36 +01:00 |
|
|
Florian Roth
|
2ded9543f3
|
rule: HAFNIUM post-exploitation activity
|
2021-03-09 09:01:24 +01:00 |
|
|
BlueTeamOps
|
26a5300208
|
added spaces for oudmp and dclist
|
2021-03-09 08:22:36 +11:00 |
|
|
Anton Kutepov
|
e4a38a8b71
|
Merge branch 'master' into oscd
|
2021-03-07 23:41:11 +03:00 |
|
|
Anton Kutepov
|
626d7ebd61
|
Applied the fixes made by the participants during the second sprint.
|
2021-03-07 23:40:08 +03:00 |
|
|
Anton Kutepov
|
d7ef865bb9
|
Merge remote-tracking branch 'upstream/master' and fix conflicts
|
2021-03-07 23:36:13 +03:00 |
|
|
Anton Kutepov
|
ff6f10b484
|
Added the author of the duplicated rule (finger.exe)
|
2021-03-07 23:20:21 +03:00 |
|
|
Florian Roth
|
2b5f9f994f
|
Merge pull request #1376 from SigmaHQ/rule-devel
UNC2452 rules - GoldMax, GoldFinder, Sibot
|
2021-03-05 18:17:20 +01:00 |
|
|
Florian Roth
|
a61fbe6bd8
|
fix: duplicate UUID
|
2021-03-05 12:09:43 +01:00 |
|
|
Florian Roth
|
b864768de8
|
fix: wrong conditions
|
2021-03-05 11:55:49 +01:00 |
|
|
Florian Roth
|
c3b84f2d5b
|
UNC2452 rules - GoldMax, Sibot, GoldFinder
https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
|
2021-03-05 11:54:35 +01:00 |
|
|
Florian Roth
|
bdc35aa3ec
|
Update win_webshell_spawn.yml
|
2021-03-05 11:34:17 +01:00 |
|
|
Tran Trung Hieu
|
5f74a58081
|
Detect HAFNIUM operations
|
2021-03-04 00:01:54 +07:00 |
|
|
Florian Roth
|
9e921115bc
|
Merge pull request #1373 from SigmaHQ/rule-devel
HAFNIUM rule
|
2021-03-03 10:34:08 +01:00 |
|
|
Florian Roth
|
73a3a1e5cd
|
Merge pull request #1360 from d4rk-d4nph3/master
Added sigma rule for vSphere RCE CVE-2021-21972
|
2021-03-03 09:32:05 +01:00 |
|
|
Bhabesh Rai
|
56eed19fba
|
Added rules for successful exploitation fo CVE-2021-26857/8 in Exchannge
|
2021-03-03 12:46:50 +05:45 |
|
|
Florian Roth
|
6d30f87c0c
|
refactor: procdump use
|
2021-03-02 23:36:25 +01:00 |
|
|
Anton Kutepov
|
f461becc58
|
Added missed changes in win_net_ntlm_downgrade and merged duplicate rules
|
2021-03-02 23:34:34 +03:00 |
|
|
Anton Kutepov
|
3f45269296
|
Merge branch 'oscd'
B
B
B
B
A
|
2021-03-02 22:58:41 +03:00 |
|
|
Florian Roth
|
5c1dc30a13
|
Merge pull request #1369 from SigmaHQ/rule-devel
fix: FPs with rule and avast sandbox
|
2021-03-02 15:30:30 +01:00 |
|
|
Florian Roth
|
c873d878b9
|
fix: FPs with rule and avast sandbox
|
2021-03-02 10:08:30 +01:00 |
|
|
Florian Roth
|
40710fe89a
|
Merge pull request #1357 from Neo23x0/rule-devel
Rule FP fixes
|
2021-02-26 11:05:00 +01:00 |
|
|
Florian Roth
|
9d937705c0
|
fix: null values in separate filter expression
> null value in lists cause problems in some backends
|
2021-02-25 15:19:26 +01:00 |
|
|
Anton Kutepov
|
120fd413b8
|
fix author field
|
2021-02-25 02:17:28 +03:00 |
|