 Florian Roth
|
a5955730bd
|
docs: title changed
|
2022-02-22 19:10:20 +01:00 |
|
|
Florian Roth
|
41d5b87839
|
Merge pull request #2722 from SigmaHQ/rule-devel
New rules and FP fixes
|
2022-02-22 17:33:05 +01:00 |
|
|
Florian Roth
|
738e77e239
|
fix: issues with installer
|
2022-02-22 16:52:53 +01:00 |
|
|
Florian Roth
|
24ece0c60a
|
Merge branch 'master' into rule-devel
|
2022-02-22 16:33:51 +01:00 |
|
|
Florian Roth
|
c54897e88f
|
Merge pull request #2721 from SigmaHQ/aurora-false-positive-fixing
Aurora false positive fixing
|
2022-02-22 16:33:35 +01:00 |
|
|
Florian Roth
|
b1ec01c289
|
fix: TiWorker.exe FW change
|
2022-02-22 13:58:21 +01:00 |
|
|
Florian Roth
|
70220eaced
|
fix: last FPs
|
2022-02-22 13:53:28 +01:00 |
|
|
frack113
|
464686e0c5
|
add posh_pm_suspicious_reset_computermachinepassword
|
2022-02-22 13:44:51 +01:00 |
|
|
Florian Roth
|
679461082c
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-02-22 13:43:59 +01:00 |
|
|
Florian Roth
|
b983330310
|
fix: more fixes
|
2022-02-22 13:42:39 +01:00 |
|
|
Florian Roth
|
7a2216c7be
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-02-22 13:37:58 +01:00 |
|
|
Florian Roth
|
93a1e37dab
|
fix: FP with new schtasks rule
|
2022-02-22 13:34:48 +01:00 |
|
|
Florian Roth
|
cc9a5b4b07
|
fix: FPs with new rules
|
2022-02-22 13:32:34 +01:00 |
|
|
frack113
|
8bb3379b68
|
Normalization of rule names
|
2022-02-22 11:16:31 +01:00 |
|
|
frack113
|
af987fb1a0
|
Set to low as too many FP
|
2022-02-22 09:38:10 +01:00 |
|
|
Florian Roth
|
ace8e705d9
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-02-22 09:21:36 +01:00 |
|
|
Florian Roth
|
8d9e16355b
|
fix: FP in Office Shell rule with Outlook PhotoViewer
|
2022-02-22 09:17:33 +01:00 |
|
|
Florian Roth
|
06f6f6e7f0
|
Merge pull request #2720 from redsand/fp_backward_powershell
Filter fp when commands are base64 encoded
|
2022-02-22 08:59:49 +01:00 |
|
|
Florian Roth
|
118e28dbb6
|
Merge pull request #2708 from frack113/firewall_as
Add firewall-as basic rules
|
2022-02-22 08:54:00 +01:00 |
|
|
Florian Roth
|
11ebbb2503
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-02-22 08:52:53 +01:00 |
|
|
Florian Roth
|
3a40ea79d3
|
fix: FPs noticed with Aurora
|
2022-02-22 08:52:51 +01:00 |
|
|
Tim Shelton
|
9461309687
|
Filter fp when commands are base64 encoded
|
2022-02-21 21:15:47 +00:00 |
|
|
Florian Roth
|
cbe7abc16e
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-02-21 18:49:45 +01:00 |
|
|
Florian Roth
|
921d46ca79
|
fix: FPs noticed with Aurora
|
2022-02-21 18:43:18 +01:00 |
|
|
Florian Roth
|
f1d962d140
|
Merge pull request #2717 from phantinuss/checkbaseline
New workflow action: Check sigma rules against baseline evtx files
|
2022-02-21 15:14:35 +01:00 |
|
|
Florian Roth
|
29dacbe6b6
|
Merge pull request #2716 from SigmaHQ/aurora-false-positive-fixing
Aurora and THOR false positive fixing
|
2022-02-21 14:46:31 +01:00 |
|
|
phantinuss
|
df21201783
|
fix: FP
|
2022-02-21 11:09:20 +01:00 |
|
|
Florian Roth
|
cfd5847063
|
Schtasks creation rule
|
2022-02-21 11:01:27 +01:00 |
|
|
Florian Roth
|
6ce58d7201
|
refactor: removed unnecessary regex
|
2022-02-21 11:01:18 +01:00 |
|
|
Florian Roth
|
d4327d2629
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-02-21 10:15:31 +01:00 |
|
|
Florian Roth
|
35d4c8bc69
|
fix: FPs noticed in THOR testing
|
2022-02-21 10:15:27 +01:00 |
|
|
frack113
|
fa083b5008
|
Merge pull request #2713 from frack113/tor
Simple TOR rules
|
2022-02-21 06:27:38 +01:00 |
|
|
frack113
|
2a0aa9a24b
|
Merge pull request #2711 from frack113/file_rename
add file_rename_win_not_dll_to_dll
|
2022-02-21 06:27:24 +01:00 |
|
|
frack113
|
15e659fed8
|
Rename win_etw_rename_to_dll.yml to file_rename_win_not_dll_to_dll.yml
|
2022-02-20 18:59:08 +01:00 |
|
|
frack113
|
dcf936bb6c
|
Rename win_pc_tor_browser.yml to proc_creation_win_tor_browser.yml
|
2022-02-20 17:59:53 +01:00 |
|
|
Florian Roth
|
dff806c5bc
|
changed description, fix: onion TLD position of '.'
|
2022-02-20 12:17:12 +01:00 |
|
|
Florian Roth
|
e7bf14c6dc
|
description and title
|
2022-02-20 12:14:57 +01:00 |
|
|
Florian Roth
|
505734730d
|
increased level
|
2022-02-20 12:14:14 +01:00 |
|
|
Florian Roth
|
d3c0d90ba7
|
increased level
|
2022-02-20 12:14:05 +01:00 |
|
|
frack113
|
470ca979b4
|
Fix FP binary
|
2022-02-20 11:31:08 +01:00 |
|
|
frack113
|
82660bbaf2
|
Simple TOR rules
|
2022-02-20 11:26:13 +01:00 |
|
|
frack113
|
604600ac2f
|
Merge pull request #2709 from frack113/fix_aurora_fp
Fix FP for win_pc_susp_run_folder
|
2022-02-20 09:05:17 +01:00 |
|
|
frack113
|
ec7af1fcaa
|
add win_etw_rename_to_dll
|
2022-02-19 18:30:14 +01:00 |
|
|
frack113
|
631a300236
|
Fix some FP
|
2022-02-19 10:25:26 +01:00 |
|
|
frack113
|
8cfab22acb
|
Add firewall-as basic rules
|
2022-02-19 10:18:49 +01:00 |
|
|
phantinuss
|
f2be1ed1b8
|
fix: FPs
|
2022-02-18 13:04:25 +01:00 |
|
|
Florian Roth
|
1196387e90
|
fix: FPs noticed with Aurora
|
2022-02-18 12:53:17 +01:00 |
|
|
frack113
|
cabe5c5043
|
Merge pull request #2703 from frack113/lolbin
add win_pc_lolbin_wlrmdr
|
2022-02-17 19:26:19 +01:00 |
|
|
Florian Roth
|
e0d8f59f42
|
Update win_pc_lolbin_wlrmdr.yml
|
2022-02-17 16:24:52 +01:00 |
|
|
Florian Roth
|
cf1d3aad08
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-02-17 13:02:22 +01:00 |
|