 ncrqnt
|
adc3c9e608
|
fixed date: switched day/month
|
2021-09-03 12:03:38 +02:00 |
|
|
frack113
|
1fc2a39720
|
Merge pull request #1975 from frack113/red_T1564.004_2
Redcanary t1564.004 test 2
|
2021-09-03 08:12:08 +02:00 |
|
|
frack113
|
11e4b900e4
|
Update global id
|
2021-09-03 06:59:40 +02:00 |
|
|
frack113
|
135d0a2c61
|
Update global id
|
2021-09-03 06:50:00 +02:00 |
|
|
frack113
|
a6bb5574fb
|
Update global id
|
2021-09-03 06:35:35 +02:00 |
|
|
mvelazco
|
ba41e922d2
|
adding Petitpotam host detections
|
2021-09-03 00:12:49 -04:00 |
|
|
frack113
|
d02ee1eddd
|
Update global ID
|
2021-09-02 21:16:55 +02:00 |
|
|
frack113
|
f90c7558a7
|
update global id
|
2021-09-02 21:03:25 +02:00 |
|
|
frack113
|
ac90ee0002
|
Update global ID
|
2021-09-02 20:23:23 +02:00 |
|
|
frack113
|
086a15fc45
|
Update global ID
|
2021-09-02 20:07:03 +02:00 |
|
|
frack113
|
9bcefc6a93
|
move uuid from global
|
2021-09-02 16:05:05 +02:00 |
|
|
frack113
|
b731c20594
|
Merge pull request #1971 from phantinuss/master
fix: prevent possible FPs
|
2021-09-02 15:34:46 +02:00 |
|
|
frack113
|
a048403089
|
Merge pull request #1973 from klingerko/cs_namedpipe_updates
Remove duplicate and regex improvements
|
2021-09-02 15:25:01 +02:00 |
|
|
phantinuss
|
ab721c736c
|
chore: move level/falsepositives to bottom
|
2021-09-02 14:55:17 +02:00 |
|
|
klingerko
|
15e25f9635
|
update modifed date
|
2021-09-02 14:50:14 +02:00 |
|
|
phantinuss
|
0b373ff1e9
|
fix: remove 2nd selection due to FPs
|
2021-09-02 14:47:47 +02:00 |
|
|
frack113
|
6a1b95d947
|
Findstr covert by win_susp_findstr.yml
|
2021-09-02 14:22:59 +02:00 |
|
|
frack113
|
aaa568ff2d
|
print covert by win_susp_print.yml
|
2021-09-02 14:18:38 +02:00 |
|
|
phantinuss
|
5cb6eed52e
|
fix: remove single value lists
|
2021-09-02 14:09:03 +02:00 |
|
|
phantinuss
|
f4a5df67ae
|
further narrowing down of the selection, therefore removing the filter
|
2021-09-02 10:28:01 +02:00 |
|
|
frack113
|
90e673e5ac
|
fix invalid tags
|
2021-09-02 10:17:50 +02:00 |
|
|
Florian Roth
|
0603581111
|
Merge pull request #1969 from SigmaHQ/rule-devel
More Named Pipe Rules and WMI rule refactoring
|
2021-09-02 10:15:00 +02:00 |
|
|
frack113
|
6f1f70ca5e
|
Add missing tags
|
2021-09-02 09:59:19 +02:00 |
|
|
frack113
|
25c6f69ea3
|
update references
|
2021-09-02 09:51:44 +02:00 |
|
|
frack113
|
5e87970c77
|
add powershell_store_file_in_alternate_data_stream.yml
|
2021-09-02 09:47:54 +02:00 |
|
|
frack113
|
5212b388c6
|
Merge pull request #1967 from d4rk-d4nph3/master
Added rule for detection of Atera RMM Agent installation
|
2021-09-02 09:19:49 +02:00 |
|
|
frack113
|
e0cd35261c
|
add missing tags
|
2021-09-01 20:01:03 +02:00 |
|
|
frack113
|
1ba0a7c7a3
|
add missing tags
|
2021-09-01 19:38:35 +02:00 |
|
|
Konstantin Klinger
|
457da818a4
|
regex optimisations
|
2021-09-01 17:06:55 +02:00 |
|
|
Konstantin Klinger
|
e83ee55573
|
remove duplicate
|
2021-09-01 17:05:36 +02:00 |
|
|
Florian Roth
|
b0c2d7b75a
|
fix: tags for WMI / execution / persistence
|
2021-09-01 16:34:50 +02:00 |
|
|
Florian Roth
|
2f7f050ad8
|
fix: removed tags
|
2021-09-01 16:32:27 +02:00 |
|
|
phantinuss
|
0b38237dbf
|
fix: add relation to now obsolete rule
|
2021-09-01 15:38:29 +02:00 |
|
|
phantinuss
|
ae9966bdcc
|
fix: unifying two overlapping rules
|
2021-09-01 14:48:32 +02:00 |
|
|
phantinuss
|
deefcaa8ac
|
fix: prevent possible FPs with the respective command only used as the last parameter
|
2021-09-01 14:33:46 +02:00 |
|
|
frack113
|
434c3891ff
|
Merge pull request #1965 from frack113/add_tags
Add tags when missing
|
2021-09-01 14:07:31 +02:00 |
|
|
Florian Roth
|
1aac21ba79
|
fix: single list item issue
|
2021-09-01 14:03:42 +02:00 |
|
|
Florian Roth
|
1c4f642227
|
Merge pull request #1699 from matsto/patch-1
Fixed transformation modifier for keywords
|
2021-09-01 14:02:10 +02:00 |
|
|
frack113
|
2dbbaf0180
|
fix missing char in date
|
2021-09-01 14:00:55 +02:00 |
|
|
Florian Roth
|
505140d273
|
rule: extended WMI suspicious scripts rule
|
2021-09-01 13:57:48 +02:00 |
|
|
Florian Roth
|
e787420be1
|
rule: WMI filter content encoded executable
|
2021-09-01 13:57:36 +02:00 |
|
|
Florian Roth
|
8761927e8c
|
rule: susp scrcons.exe creating named pipe
|
2021-09-01 13:57:17 +02:00 |
|
|
frack113
|
e71fce6f11
|
fix errors
|
2021-09-01 13:55:14 +02:00 |
|
|
Florian Roth
|
affc929c3b
|
LiquidSnake named pipe
|
2021-09-01 13:54:47 +02:00 |
|
|
frack113
|
80dbfa7af5
|
add process_creation_alternate_data_streams.yml
|
2021-09-01 13:52:09 +02:00 |
|
|
Florian Roth
|
c8b3036949
|
Merge pull request #1968 from SigmaHQ/rule-devel
docs: note to improved sysmon config
|
2021-09-01 13:21:28 +02:00 |
|
|
Florian Roth
|
f102b2d9a1
|
docs: note to improved sysmon config
|
2021-09-01 13:07:18 +02:00 |
|
|
Florian Roth
|
8bba246205
|
refactor: better way to write it
|
2021-09-01 12:57:34 +02:00 |
|
|
frack113
|
2cb5f5e4c6
|
add missing tags
|
2021-09-01 12:54:21 +02:00 |
|
|
Florian Roth
|
c146bc44c7
|
Merge branch 'master' into patch-1
|
2021-09-01 12:48:51 +02:00 |
|