87c8326133
T1033
2019-10-27 23:49:07 +03:00
55eaae1cea
Rename win_app_windows_descovery.yml to win_app_windows_discovery.yml
2019-10-27 23:15:10 +03:00
93b867024c
T1012
2019-10-27 23:13:03 +03:00
fde949174d
OSCD Task 1 - Privilege Escalation
2019-10-27 20:54:07 +03:00
ca819d8707
Update win_susp_net_execution.yml
...
Updated tags to pass Travis CI checks.
2019-10-27 14:06:52 +11:00
717e40e8ed
modified win_susp_dxcap.yml
2019-10-26 20:27:32 +02:00
9bf0150100
modified win_susp_dnx.yml
2019-10-26 20:20:21 +02:00
3b70f2edd6
modified win_susp_dnx.yml
2019-10-26 20:16:40 +02:00
3528afeef7
modified win_susp_dnx.yml
2019-10-26 20:13:53 +02:00
1dca0456ee
modified win_susp_dxcap.yml
2019-10-26 20:09:25 +02:00
cbe0d73ce8
add win_susp_dxcap.yml
2019-10-26 20:06:02 +02:00
aaf63d2238
add win_susp_dxcap.yml
2019-10-26 20:02:25 +02:00
0616c2c39d
add win_susp_dnx.yml
2019-10-26 19:58:45 +02:00
ee21888e67
add win_susp_cdb.yml
2019-10-26 19:49:45 +02:00
42808b7eb8
rule: webshell detection improved
2019-10-26 09:14:54 +02:00
844d55c781
add win_susp_bginfo.yml
2019-10-26 08:18:37 +02:00
5bb5938e86
add win_susp_bginfo.yml
2019-10-26 08:16:08 +02:00
01c4c7cdbd
modifed win_susp_msoffice.yml
2019-10-26 08:11:09 +02:00
bea2daac45
modifed win_susp_msoffice.yml
2019-10-26 07:55:44 +02:00
fc7f8ecea3
add win_susp_msoffice.yml
2019-10-26 07:48:38 +02:00
611c193826
modifed win_susp_odbcconf.yml
2019-10-26 07:45:53 +02:00
aa9a22e662
add win_susp_odbcconf.yml
2019-10-25 19:02:17 +02:00
8c2b7e9f85
fix
2019-10-25 18:30:40 +03:00
7aa804fe90
added new rules
...
Packet capture Windows command prompt, ODBCCONF execution dll, Windows Registry Persistence - COM key linking
2019-10-25 18:01:36 +03:00
6e94e798be
t1010
2019-10-25 16:12:51 +03:00
dcaacd07bf
4 rules to cover ART
2019-10-25 15:38:47 +04:00
5eb484a062
add tieto dns exfiltration rules
2019-10-25 04:30:55 +02:00
5678357f4e
Update win_susp_net_execution.yml
...
Added tag for:
References:
https://attack.mitre.org/techniques/T1077/
https://eqllib.readthedocs.io/en/latest/analytics/9b3dd402-891c-4c4d-a662-28947168ce61.html
2019-10-25 12:20:47 +11:00
a7a753862c
Update win_susp_net_execution.yml
...
Added:
1. Additional tags for techniques as defined by Atomic Blue.
2. Detection for OriginalFileName as net.exe can easily be renamed.
Part of oscd.community effort.
2019-10-25 12:06:32 +11:00
a5ec6722a1
rule: the actual changes to hwp rule
2019-10-24 15:35:13 +02:00
7c5dc0ca01
Update win_data_compressed.yml
2019-10-24 15:34:13 +03:00
86c1b4ae4b
rule: hwp exploits
2019-10-24 11:46:56 +02:00
cc998aa667
fix
2019-10-24 00:48:43 +03:00
499627edf3
File permissions modification (T1222)
2019-10-23 11:24:13 -07:00
4979b56296
Domain Trust Discovery rule (T1482)
2019-10-23 11:23:12 -07:00
262514c782
Windows Service stop rule (T1489)
2019-10-23 11:22:09 -07:00
4c84412944
added new rule
...
silenttrinity_stage_ use, sysmon_mimikatz_сreds_dump, sysmon_registry_persistence_key_linking, sysmon_сreds_dump
2019-10-23 18:08:30 +03:00
bc943343df
update win_sysmon_driver_unload
2019-10-23 15:41:14 +03:00
215e500894
fix
2019-10-23 14:43:01 +03:00
193c95a11a
add new rule1
2019-10-23 14:27:52 +03:00
edcbc49ce8
add rule win_susp_open with_execution.yml win_susp_devt oolslauncher_execution.yml
2019-10-23 13:00:21 +02:00
043e3f7ca6
fix
2019-10-23 13:48:44 +03:00
e38540a37f
fix
2019-10-23 13:28:04 +03:00
c1cfbacd24
fix
2019-10-23 13:18:57 +03:00
ad9b98541c
fix
2019-10-23 13:05:38 +03:00
fa4a8c974d
fix
2019-10-23 12:45:06 +03:00
f4ea01217e
fix
2019-10-23 02:47:04 +03:00
ebe4fe0377
fix
2019-10-23 02:42:37 +03:00
29cd7fed3e
fix
2019-10-23 02:39:40 +03:00
5a260db459
fix
2019-10-23 02:27:14 +03:00
zinint