 Florian Roth
|
85b25bf17e
|
fix: FP noticed with Aurora
VSCode installer uses .tmp extension
|
2022-02-11 20:21:35 +01:00 |
|
|
Florian Roth
|
891475dccb
|
Merge pull request #2684 from SigmaHQ/rule-devel
rules: SAM dump, suspicious program names, iso/img mount
|
2022-02-11 18:06:20 +01:00 |
|
|
Tim Shelton
|
6d27058ce0
|
updating, with suggestions
|
2022-02-11 16:12:43 +00:00 |
|
|
Florian Roth
|
635a5c7d41
|
fix: wrong condition
|
2022-02-11 12:47:34 +01:00 |
|
|
Florian Roth
|
1bf00333f7
|
fix: exclude empty OriginalName fields
|
2022-02-11 12:01:02 +01:00 |
|
|
Florian Roth
|
e6989f9efb
|
rules: samdumps, suspicious program names
|
2022-02-11 11:58:02 +01:00 |
|
|
frack113
|
6a69a06ea9
|
Merge pull request #2681 from johnpaulglab/patch-1
Update win_pc_msiexec_install_quiet.yml
|
2022-02-11 06:35:18 +01:00 |
|
|
johnpaulglab
|
a8f8f88c34
|
Update win_pc_msiexec_execute_dll.yml
Spelling error
|
2022-02-10 14:41:22 -06:00 |
|
|
johnpaulglab
|
89e98db927
|
Update win_pc_msiexec_install_quiet.yml
Spelling error
|
2022-02-10 14:38:51 -06:00 |
|
|
phantinuss
|
6ad44598ee
|
fix: several FPs against a fresh installed Windows with example applications and basic user interaction 2
|
2022-02-10 16:12:17 +01:00 |
|
|
Florian Roth
|
47d9595123
|
Merge pull request #2677 from SigmaHQ/rule-devel
refactor and new: lsass process dumping rules
|
2022-02-10 15:51:19 +01:00 |
|
|
Tobias Michalski
|
6af5d4b6f5
|
fix: False Positive fix
Empty field CurrentDirectory should be "or"-ed
|
2022-02-10 12:15:18 +01:00 |
|
|
Florian Roth
|
a05b3e50e5
|
refactor and new: lsass process dumping rules
|
2022-02-10 09:17:25 +01:00 |
|
|
Tim Shelton
|
330450cae6
|
fixing error
|
2022-02-10 00:01:55 +00:00 |
|
|
Tim Shelton
|
bc40160444
|
fixing more yaml lint complaints
|
2022-02-10 00:00:03 +00:00 |
|
|
Tim Shelton
|
a72f843081
|
i think the yaml is angry
|
2022-02-09 23:50:07 +00:00 |
|
|
Tim Shelton
|
2ce7d60729
|
splitting up filters
|
2022-02-09 23:46:07 +00:00 |
|
|
Florian Roth
|
11af922740
|
Update win_file_permission_modifications.yml
|
2022-02-09 23:17:32 +01:00 |
|
|
Florian Roth
|
0dc9234176
|
Merge pull request #2675 from redsand/fp_win_apt_bluemashroom
Adds false positive filter to win apt bluemashroom
|
2022-02-09 23:11:55 +01:00 |
|
|
Tim Shelton
|
ae2c0f0a7f
|
fixing test
|
2022-02-09 21:26:43 +00:00 |
|
|
Tim Shelton
|
d48b6beaf5
|
Filtering fp of dynatrace behavior
|
2022-02-09 20:24:59 +00:00 |
|
|
Tim Shelton
|
531f9a61f1
|
Adds false positive filter to win apt bluemashroom and process for adding additional filters in the future
|
2022-02-09 20:11:45 +00:00 |
|
|
phantinuss
|
43bae23f23
|
fix: several FPs against a fresh installed Windows with example applications and basic user interaction
|
2022-02-09 17:47:22 +01:00 |
|
|
phantinuss
|
0a5f2a020a
|
fix: filter events with empty sysmon field
|
2022-02-09 17:47:22 +01:00 |
|
|
Florian Roth
|
ef23efa60f
|
Merge pull request #2668 from SigmaHQ/rule-devel
rule: suspicious execution from suspicious folders
|
2022-02-08 19:14:23 +01:00 |
|
|
Florian Roth
|
3e0f45d11e
|
rule: suspicious execution from temp folders
|
2022-02-08 16:15:46 +01:00 |
|
|
Florian Roth
|
93767430fa
|
Merge pull request #2666 from SigmaHQ/rule-devel
Network Recon Activity : nslookup _ldap._tcp.dc._msdcs
|
2022-02-08 13:30:32 +01:00 |
|
|
Florian Roth
|
ed06403d04
|
fix: unneeded list
|
2022-02-08 12:21:43 +01:00 |
|
|
Florian Roth
|
9bc8bb5c20
|
fix: remove old link to removed part of rule
|
2022-02-08 09:36:31 +01:00 |
|
|
Florian Roth
|
88ce0ed97d
|
rule: Network Reconnaissance Activity
|
2022-02-08 09:36:03 +01:00 |
|
|
Florian Roth
|
7e17c2bbd2
|
Merge pull request #2658 from Karneades/patch-1
rule: ACTINIUM Scheduled Task Persistence
|
2022-02-07 21:20:22 +01:00 |
|
|
Tim Shelton
|
f3ce179f76
|
fixing false positive when loading the powershell function Convert-GuidToCompressedGuid
|
2022-02-07 17:10:57 +00:00 |
|
|
Florian Roth
|
aef0bd2a2d
|
Update process_creation_apt_actinium_persistence.yml
|
2022-02-07 16:15:48 +01:00 |
|
|
Andreas Hunkeler
|
40411f0596
|
Fix list issue in new wscript persistence rule
|
2022-02-07 15:54:42 +01:00 |
|
|
Andreas Hunkeler
|
0a78c3966b
|
rule: ACTINIUM Scheduled Task Persistence
|
2022-02-07 15:43:30 +01:00 |
|
|
Florian Roth
|
094215a7e0
|
Update win_pc_embed_exe_lnk.yml
|
2022-02-06 14:20:30 +01:00 |
|
|
frack113
|
f1f38a2df4
|
add win_pc_embed_exe_lnk
|
2022-02-06 14:01:48 +01:00 |
|
|
frack113
|
ebd09793d7
|
Merge pull request #2643 from elhoim/patch-1
Avoiding being too narrow for paths
|
2022-02-05 12:03:46 +01:00 |
|
|
Florian Roth
|
8dc0835b2a
|
Update win_pc_redirect_to_stream.yml
|
2022-02-04 23:18:08 +01:00 |
|
|
Florian Roth
|
affd73506d
|
Update win_pc_susp_instalutil.yml
|
2022-02-04 23:16:05 +01:00 |
|
|
David André
|
391d73a2c2
|
Avoiding being too narrow for paths
InstallUtil.exe is also available under 32 bits path for .net framework
|
2022-02-04 21:08:47 +01:00 |
|
|
frack113
|
16fed13bb0
|
Order files
|
2022-02-04 10:52:55 +01:00 |
|
|
frack113
|
2887cf2800
|
Merge pull request #2623 from frack113/red_t1555_003
Redcannary windows
|
2022-02-03 22:23:19 +01:00 |
|
|
Florian Roth
|
20a7bad5d8
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-02-02 20:40:21 +01:00 |
|
|
Florian Roth
|
885651efae
|
fix: FPs noticed with Aurora
|
2022-02-02 20:39:47 +01:00 |
|
|
Florian Roth
|
ef955b92ae
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-02-02 13:49:23 +01:00 |
|
|
Florian Roth
|
cb8a0a6e73
|
Revert "fix: FPs with GoogleDrive update"
This reverts commit 86f3302a33.
|
2022-02-02 13:49:06 +01:00 |
|
|
phantinuss
|
b627c62fe8
|
fix: filter out googledrivesync.exe FP
|
2022-02-02 12:25:55 +01:00 |
|
|
Florian Roth
|
86f3302a33
|
fix: FPs with GoogleDrive update
|
2022-02-02 11:45:42 +01:00 |
|
|
phantinuss
|
a22d57fc87
|
fix: rename filter
|
2022-02-02 11:12:39 +01:00 |
|