c0ab9c5745
Merge pull request #671 from HarishHary/powershell_downgrade_attack
...
Powershell downgrade attack (small improvements)
2020-04-03 09:31:33 +02:00
fe5dbece3d
Date typos...more than I thought...
2020-04-02 10:00:00 +02:00
97c0872c81
Date typo.
2020-04-02 09:53:09 +02:00
95e0b12d88
Fixed date typo - by the looks of the commit date the month/date were swapped.
2020-04-01 18:18:13 +02:00
fe5b5a7782
Merge pull request #673 from j91321/rules-minor-fixes
...
Minor fixes to several rules
2020-03-28 13:27:05 +01:00
bbb10a51f4
Update win_powershell_downgrade_attack.yml
2020-03-28 13:17:58 +01:00
0e94eb9e86
Update win_powershell_downgrade_attack.yml
2020-03-28 13:12:07 +01:00
dabc759136
Eliminate title collision
...
Fixing the problem described in HELK here: https://github.com/Cyb3rWard0g/HELK/issues/442 where when running sigmac to generate elastalert rules, this rule has a title collision with another rule in the same directory and causes elastalert to fail to start.
2020-03-26 09:13:52 -05:00
28953a2942
fix: MITRE tags in rule
2020-03-25 18:11:04 +01:00
6584729a0d
rule: powershell downloadfile
2020-03-25 14:58:14 +01:00
35e43db7a7
fix: converted CRLF line break to LF
2020-03-25 14:36:34 +01:00
17297193c7
Merge branch 'master' into devel
2020-03-25 14:18:11 +01:00
50b0d04ee8
rule: Exploited CVE-2020-10189 Zoho ManageEngine
2020-03-25 14:02:53 +01:00
28d8b87a0f
rule: extended web shell spawn rule
2020-03-25 14:02:39 +01:00
1d86e0b4a5
Change falsepositives to array
2020-03-24 19:59:54 +01:00
c784adb10b
Wrong indentation falsepositives
2020-03-24 19:55:41 +01:00
98a633e54c
Add missing status and falsepositives
2020-03-24 19:53:41 +01:00
bc442d3021
Add path with lowercase system32
2020-03-24 19:48:24 +01:00
c10332b06c
Merge pull request #663 from neu5ron/updates_sigmac_and_rules
...
Updates sigmac and rules
2020-03-22 00:22:31 +01:00
ba3994f319
Fix of '1 of x' condition
2020-03-21 12:19:01 +01:00
81b277ba1a
suspicious powershell parent process...
2020-03-21 00:26:30 +01:00
a88b22a1bd
Fix namefield.
2020-03-20 23:34:15 +01:00
67694e4ba7
Restructure new improvement to process_creation folder.
2020-03-20 23:29:32 +01:00
6040b1f1f8
Merge pull request #668 from Neo23x0/devel
...
Devel
2020-03-19 18:36:31 +01:00
8454f60a8e
fix: reduced level due to false positives
2020-03-17 20:40:28 +01:00
4c94906d53
rule should be wildcard AND had a prepended ^ in one of the CommandLine conditions that would have caused to not trigger
2020-03-14 15:00:42 -04:00
cbf0f43934
Merge pull request #655 from msec1203/msec1203-patch-1
...
add rule for suspicious use of csharp console by scripting utility
2020-03-09 18:01:12 +01:00
6845fa21b3
fix: fixed several issues
2020-03-09 17:43:16 +01:00
0947538228
MDATP schema changes
...
WDATP was renamed to MDATP (Microsoft Defendre ATP).
MDATP also had schema changes recently: https://techcommunity.microsoft.com/t5/microsoft-defender-atp/advanced-hunting-data-schema-changes/ba-p/1043914
The updates reflect these changes
2020-03-09 17:12:41 +01:00
ddefb3bc58
Merge branch 'master' into devel
2020-03-07 11:06:25 +01:00
b9e4734087
fix sysmon registry rules with HKLM/HKU format as used since 02/2017 in sysmon
2020-03-04 12:47:42 -05:00
6bbb166f3d
rule: extended webshell rule with tomcat.exe
2020-03-04 14:25:57 +01:00
53278c2a46
Merge pull request #649 from Neo23x0/devel
...
fix: avoiding FPs with Citrix software
2020-03-03 11:35:02 +01:00
f98ad7a8df
fix: wrong identifier
2020-03-03 11:25:02 +01:00
be4242aca8
fix avoiding FPs with MpCmdRun
...
ParentImage: C:\Windows\System32\services.exe
CommandLine: C:\Program Files\Microsoft Security Client\\MpCmdRun.exe
2020-03-03 11:16:59 +01:00
b63889af75
Fixed rules that likely will cause false negatives by fix
2020-03-01 23:14:53 +01:00
0a62b8747e
Merge pull request #634 from EccoTheFlintstone/fp_fix3
...
Rule: restore initial behaviour matching single word with spaces on each side
2020-03-01 22:40:24 +01:00
ada0edb822
Merge pull request #621 from wagga40/new_koadic_rule
...
New Koadic detection rule
2020-02-26 13:25:03 +01:00
0ba6874645
Merge pull request #638 from Neo23x0/devel
...
Several false positives with new rules
2020-02-26 09:46:02 +01:00
1c90d6badd
level increased
2020-02-26 09:42:31 +01:00
c8afd4a16b
Merge pull request #637 from tjgeorgen/patch-1
...
fix missing status & description in status field
2020-02-26 09:40:55 +01:00
4f3e3166d3
fixing false positives
2020-02-26 09:33:55 +01:00
74f3fe70cc
fix missing status & description in status field
2020-02-25 16:30:41 -05:00
3247d5692a
wmiprvse subprocess: add fallback check on username instead of only logonid
2020-02-24 09:25:20 -05:00
df7356e829
Rule: restore initial behaviour matching single word with spaces on each side
2020-02-24 08:00:06 -05:00
aa1eff5419
fix FP on rmdir matching dir
2020-02-24 05:23:23 -05:00
bfab143c7c
Merge pull request #632 from EccoTheFlintstone/fp_fix
...
fix false positive on taskkill.exe not related to service stop at all
2020-02-24 09:58:33 +01:00
f807dae69a
fix false positive on taskkill.exe not related to service stop at all
2020-02-24 03:03:46 -05:00
1703b725d3
fix non ascii character in rule
2020-02-24 02:58:34 -05:00
48d95f027c
Merge branch 'oscd'
2020-02-20 23:11:57 +01:00
Florian Roth