 frack113
|
12f0d6dfab
|
Windows Redcannary
|
2022-01-16 14:47:56 +01:00 |
|
|
frack113
|
262cb31143
|
Fix CommandLine
Forget to copy the correct from Test VM
|
2022-01-16 11:15:50 +01:00 |
|
|
frack113
|
cb938c14df
|
Windows Redcannary
|
2022-01-15 17:04:03 +01:00 |
|
|
Florian Roth
|
8608ce6396
|
Merge pull request #2559 from redsand/executable_invalid_extension
Detects executable running with non executable extension
|
2022-01-14 12:33:33 +01:00 |
|
|
Florian Roth
|
d525203083
|
rule: suspicious rundll32 JS pattern
|
2022-01-14 12:30:16 +01:00 |
|
|
Florian Roth
|
4d5e87258d
|
Update win_run_executable_invalid_extension.yml
|
2022-01-14 11:47:46 +01:00 |
|
|
Florian Roth
|
cb73718684
|
Merge branch 'master' into rule-devel
|
2022-01-14 10:16:56 +01:00 |
|
|
Florian Roth
|
14ccd6ca8c
|
fix: FPs with rule that looks for executions of files other than .exe
https://github.com/SigmaHQ/sigma/issues/2560
|
2022-01-14 10:15:03 +01:00 |
|
|
frack113
|
f4c6871b50
|
Merge pull request #2554 from frack113/red_2022012
Windows Redcannary
|
2022-01-13 22:26:48 +01:00 |
|
|
Tim Shelton
|
4f6d433c2d
|
Detects executable running with non executable extension, used for av bypass
|
2022-01-13 21:09:26 +00:00 |
|
|
Florian Roth
|
21b3e5c6fd
|
Update win_pc_uninstall_sysmon.yml
|
2022-01-13 21:07:59 +01:00 |
|
|
Florian Roth
|
5e20552e4e
|
Merge pull request #2550 from phantinuss/master
feat: check for the existence of a description field
|
2022-01-13 21:05:16 +01:00 |
|
|
Florian Roth
|
f27a8c96d1
|
Merge pull request #2556 from SigmaHQ/aurora-false-positive-fixing
Aurora false positive fixing
|
2022-01-13 21:04:22 +01:00 |
|
|
Florian Roth
|
f9f5b1fe45
|
Merge pull request #2558 from SigmaHQ/rule-devel
A few more rules
|
2022-01-13 21:01:37 +01:00 |
|
|
Florian Roth
|
82f88f194f
|
fix: FPs noticed with Aurora
|
2022-01-13 18:20:24 +01:00 |
|
|
Florian Roth
|
7f357c963b
|
refactor: slightly improved rule
|
2022-01-13 13:09:08 +01:00 |
|
|
Florian Roth
|
41f0ccbca5
|
fix: filter in rule
|
2022-01-12 22:28:21 +01:00 |
|
|
frack113
|
592485fac5
|
Windows Redcannary
|
2022-01-12 20:27:56 +01:00 |
|
|
Florian Roth
|
22338b762a
|
fix: FPs with Java shell spawn rule
|
2022-01-12 16:35:24 +01:00 |
|
|
nwh2
|
460ed23249
|
Fix incorrectly formatted Winget LOLbin date
|
2022-01-12 14:44:55 +01:00 |
|
|
phantinuss
|
b6d4e39538
|
feat: check for the existence of a description field
it is not mandatory in the sigma standard but
mandatory for this repository
|
2022-01-12 12:55:49 +01:00 |
|
|
Florian Roth
|
09aaec8ed2
|
rules: ntds.dit write, minimized msedge
|
2022-01-12 11:32:12 +01:00 |
|
|
frack113
|
f7e670d55e
|
Simple Quote
|
2022-01-11 13:40:53 +01:00 |
|
|
Florian Roth
|
11164849b3
|
Merge pull request #2543 from SigmaHQ/rule-devel
Several new rules and some fixes
|
2022-01-11 12:44:03 +01:00 |
|
|
Florian Roth
|
e055ec1d52
|
refactor: change all " of them" expressions
|
2022-01-11 10:59:57 +01:00 |
|
|
Florian Roth
|
fe754d1937
|
rule: regsvr32 pattern
|
2022-01-11 10:46:48 +01:00 |
|
|
Florian Roth
|
2d50f8d28a
|
rule: several lolbins
|
2022-01-11 10:46:39 +01:00 |
|
|
Florian Roth
|
de6a153e81
|
refactor: improved rule
|
2022-01-11 09:27:22 +01:00 |
|
|
Florian Roth
|
7eaa3f8d3f
|
refactor: rewrite re rule to contains
|
2022-01-11 09:19:55 +01:00 |
|
|
Florian Roth
|
1fad4edfcb
|
refactor: minor changes to procdump rule
|
2022-01-11 09:10:05 +01:00 |
|
|
Florian Roth
|
64deb38131
|
rule: procdump evasion
|
2022-01-11 09:07:56 +01:00 |
|
|
Tim Shelton
|
4d0f62aff7
|
adding back tick per https://docs.microsoft.com/en-us/powershell/scripting/lang-spec/chapter-02?view=powershell-7.2
|
2022-01-10 20:51:28 +00:00 |
|
|
Tim Shelton
|
4a110e369c
|
fixing yaml
|
2022-01-10 20:45:55 +00:00 |
|
|
Tim Shelton
|
eaf49e3697
|
adding double quote
|
2022-01-10 20:44:59 +00:00 |
|
|
Tim Shelton
|
fa19eeb0f8
|
checks for join with space or quote or double quote in order to reduce fps
|
2022-01-10 20:44:35 +00:00 |
|
|
Florian Roth
|
962051e4d7
|
Merge pull request #2534 from frack113/fix_win_susp_firewall_disable
Fix win susp firewall disable
|
2022-01-09 22:17:55 +01:00 |
|
|
frack113
|
7a164e61dd
|
fix 'off' error
|
2022-01-09 19:58:54 +01:00 |
|
|
frack113
|
ae0dc80226
|
Microsoft Defender Firewall
|
2022-01-09 19:48:22 +01:00 |
|
|
frack113
|
f96a5ce9ff
|
Fix detection
|
2022-01-09 19:24:38 +01:00 |
|
|
Florian Roth
|
ebb3f54d67
|
Update win_pc_iis_http_logging.yml
|
2022-01-09 16:13:00 +01:00 |
|
|
frack113
|
01c6e5f6e3
|
Windows Redcannary
|
2022-01-09 12:37:23 +01:00 |
|
|
frack113
|
ac240b1487
|
Merge pull request #2527 from frack113/promote_366d
Change status to test
|
2022-01-09 08:02:36 +01:00 |
|
|
frack113
|
af99c75785
|
Windows Redcannary
|
2022-01-08 09:17:56 +01:00 |
|
|
Florian Roth
|
7b08986f4b
|
Merge pull request #2528 from SigmaHQ/rule-devel
rule: DumpStack.log Defender evasion
|
2022-01-07 09:51:07 +01:00 |
|
|
Florian Roth
|
dfa7938f17
|
rule: DumpStack.log Defender evasion
|
2022-01-07 08:46:30 +01:00 |
|
|
frack113
|
c6014b1205
|
Change status to test
|
2022-01-07 07:04:24 +01:00 |
|
|
Florian Roth
|
70deac6240
|
Merge pull request #2525 from SigmaHQ/rule-devel
rule: changed some rules, LOLBIN AccCheckConsole
|
2022-01-06 21:10:03 +01:00 |
|
|
Florian Roth
|
985bc78d0d
|
rule: extend parent processes
|
2022-01-06 17:58:44 +01:00 |
|
|
Florian Roth
|
bfd16e2628
|
rule: AccCheckConsole LOLBIN
|
2022-01-06 17:23:41 +01:00 |
|
|
frack113
|
6075a590c0
|
fix references
|
2022-01-06 14:27:59 +01:00 |
|