 Thomas Patzke
|
a10db2df89
|
Fixes&improvements
|
2021-04-08 01:06:40 +02:00 |
|
|
Vasiliy Burov
|
e73e27e44f
|
Update win_hack_rubeus.yml
Added commandline parameters for constrained delegation abuse and for hashes calculation
|
2021-04-06 20:18:54 +03:00 |
|
|
Thomas Patzke
|
d1de168295
|
Merge branch 'oscd'
|
2021-04-06 00:05:35 +02:00 |
|
|
Thomas Patzke
|
b1b0240692
|
Fixes
|
2021-04-03 23:21:13 +02:00 |
|
|
Thomas Patzke
|
90efe974b8
|
Fixes and improvements
|
2021-04-03 00:08:55 +02:00 |
|
|
phantinuss
|
4934f80601
|
fix: FP tuning for IIS Express and making use of value modifiers
|
2021-04-01 14:37:20 +02:00 |
|
|
phantinuss
|
8b4234de3b
|
refactor: make use of value modifiers
|
2021-04-01 14:37:17 +02:00 |
|
|
phantinuss
|
794865c79d
|
fix: adding filter to condition and reintroducing the users folder constraint
|
2021-04-01 14:37:17 +02:00 |
|
|
phantinuss
|
43be8c8cba
|
refactor: make use of value modifiers
|
2021-04-01 14:37:16 +02:00 |
|
|
phantinuss
|
bd5ba2ae01
|
fix: adding only as a known false positive as it cannot be filtered out in a generic and public way
|
2021-04-01 14:37:15 +02:00 |
|
|
phantinuss
|
65bc62d401
|
fix: adding filter out for CamMute.exe
|
2021-04-01 14:37:14 +02:00 |
|
|
phantinuss
|
2cab121c71
|
refactor: merging rule process_creation/win_susp_exec_folder.yml and process_creation/win_susp_prog_location_process_starts.yml because of significant overlap
|
2021-04-01 14:37:13 +02:00 |
|
|
phantinuss
|
109b7890db
|
fix: taking windows security 4688 events into account for filter out
|
2021-04-01 14:36:57 +02:00 |
|
|
Florian Roth
|
b296c643de
|
Merge pull request #1346 from blueteam0ps/patch-3
Added win_ad_find_discovery.yml
|
2021-03-29 11:20:49 +02:00 |
|
|
BlueTeamOps
|
6ef5f0a0a2
|
Added detection for Dumpert
-Dumpert based LSASS dump using DLL
-Dumpert.exe detection
|
2021-03-27 07:34:05 +11:00 |
|
|
BlueTeamOps
|
8916459bab
|
Added additional CS signatures
|
2021-03-25 22:44:24 +11:00 |
|
|
Florian Roth
|
48265ad71a
|
Merge pull request #1398 from SigmaHQ/rule-devel
MSExchange Management log mapping, some fixes
|
2021-03-20 17:21:31 +01:00 |
|
|
Florian Roth
|
525f4b6a6b
|
Merge pull request #1388 from Cyb3rPandaH/master
CVE-2021-27065 - Set OabVirtualDirectory ExternalUrl Property
|
2021-03-20 08:53:04 +01:00 |
|
|
Florian Roth
|
e47ee24889
|
Merge branch 'master' into rule-devel
|
2021-03-20 08:52:55 +01:00 |
|
|
Florian Roth
|
334dd9a058
|
Update win_set_oabvirtualdirectory_externalurl.yml
|
2021-03-20 08:34:02 +01:00 |
|
|
Florian Roth
|
33af006479
|
Merge pull request #1389 from ZikyHD/patch_win_susp_wuauclt
Fix ProcessCommandLine field
|
2021-03-20 08:29:23 +01:00 |
|
|
Florian Roth
|
01fcfd4f76
|
Merge pull request #1390 from ZikyHD/patch_win_proc_wrong_parent
Add "Microsoft Security Client" directory for MsMpEng.exe (Win<8)
|
2021-03-20 08:29:09 +01:00 |
|
|
Florian Roth
|
2472926c48
|
Merge pull request #1391 from ZikyHD/patch_win_etw_trace_evasion
Fix win_etw_trace_evasion rule
|
2021-03-20 08:28:51 +01:00 |
|
|
Florian Roth
|
dd4a1ac393
|
fix: prone to FPs - use is unclear
https://regex101.com/r/tss5TZ/1
|
2021-03-18 16:44:49 +01:00 |
|
|
Florian Roth
|
6b2bcd3d87
|
Merge pull request #1395 from SigmaHQ/rule-devel
Rule devel
|
2021-03-18 10:52:02 +01:00 |
|
|
Florian Roth
|
d30e87d543
|
fix: lsass access - FPs with AV / EDR software
|
2021-03-18 09:04:03 +01:00 |
|
|
Florian Roth
|
92510e2507
|
extended Exchange post-exploitation rule
|
2021-03-17 18:01:45 +01:00 |
|
|
Florian Roth
|
943f8513e2
|
Merge pull request #1393 from SigmaHQ/rule-devel
Rule devel
|
2021-03-16 16:35:55 +01:00 |
|
|
Florian Roth
|
bfc99996b5
|
fix: Bug in rule condition
|
2021-03-16 16:35:21 +01:00 |
|
|
Florian Roth
|
32adf0c3ce
|
fix: prone to FPs
|
2021-03-16 15:52:35 +01:00 |
|
|
zikyhd
|
e91822e070
|
Fix win_etw_trace_evasion rule
|
2021-03-15 15:02:18 +01:00 |
|
|
Cedric HIEN
|
864973888e
|
Add "Microsoft Security Client" directory for MsMpEng.exe (Win<8)
|
2021-03-15 12:07:05 +01:00 |
|
|
Cedric HIEN
|
e4f24f4e1f
|
Fix ProcessCommandLine field
|
2021-03-15 11:56:19 +01:00 |
|
|
Florian Roth
|
310888bae7
|
Merge pull request #1386 from SigmaHQ/rule-devel
Rule devel
|
2021-03-15 10:52:57 +01:00 |
|
|
Florian Roth
|
70f9480ec5
|
fix: wrong field name
|
2021-03-15 08:14:43 +01:00 |
|
|
Cyb3rPandaH
|
f138a27426
|
CVE-2021-27065 - Set OabVirtualDirectory ExternalUrl Property
Rule to detect an adversary setting OabVirtualDirectory External URL property to a script
|
2021-03-15 00:33:47 -04:00 |
|
|
Florian Roth
|
a0b034aa2b
|
fix: better exclusion
|
2021-03-13 09:09:43 +01:00 |
|
|
Florian Roth
|
145c3bc2ca
|
refactor: more hafnium indicators
|
2021-03-13 09:07:58 +01:00 |
|
|
Florian Roth
|
69ee1cece2
|
fix: FPs
|
2021-03-13 09:07:44 +01:00 |
|
|
Florian Roth
|
48da4e1314
|
Update win_apt_hafnium.yml
|
2021-03-11 13:55:31 +01:00 |
|
|
Florian Roth
|
9084fc4fa7
|
Update on HAFNIUM rule
https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3
|
2021-03-11 13:38:07 +01:00 |
|
|
Florian Roth
|
27fef60ace
|
Merge pull request #1383 from SigmaHQ/rule-devel
fix: FPs with LSASS Access from Non System Account
|
2021-03-10 18:59:29 +01:00 |
|
|
Florian Roth
|
78004cc29c
|
fix: condition contains - values without 0x
|
2021-03-10 18:56:05 +01:00 |
|
|
Florian Roth
|
29dec7dd8b
|
fix: FPs with LSASS Access from Non System Account
|
2021-03-10 18:51:27 +01:00 |
|
|
concorde18
|
87059fe80b
|
Merge branch 'oscd' into DLL-execution-via-register-cimprovider.exe
|
2021-03-10 11:35:55 +03:00 |
|
|
concorde18
|
f694de74aa
|
Create win_susp_diskshadow.yml
|
2021-03-10 11:33:12 +03:00 |
|
|
concorde18
|
b73815e883
|
Update win_susp_Register_cimprovider.yml
|
2021-03-10 11:25:13 +03:00 |
|
|
Florian Roth
|
f0051ffcf6
|
Merge pull request #1378 from SigmaHQ/rule-devel
HAFNIUM activity
|
2021-03-09 15:42:32 +01:00 |
|
|
Florian Roth
|
dca5c870d7
|
Merge pull request #1374 from hieuttmmo/master
Detect HAFNIUM operations
|
2021-03-09 09:16:52 +01:00 |
|
|
Florian Roth
|
ec490b40ec
|
fix: 1 of them condition
|
2021-03-09 09:15:12 +01:00 |
|