6e8d9b9be2
Migrated to the process_creation category.
2020-10-07 17:11:38 +03:00
f66eedbb74
Create sysmon_abusing_debug_privilege.yml
2020-10-07 16:52:19 +03:00
e6a6549676
Create win_susp_replace_lolbin.yml
...
Item 77 of #1014
2020-10-07 10:37:15 -03:00
4bddfaac86
[OSCD] Powershell Script Installed as a Service Rule added
2020-10-07 16:18:38 +03:00
f0f419df78
Create win_susp_pester.yml
2020-10-07 15:19:45 +03:00
18da272de4
[OSCD] win_visual_basic_compiler.yml added
2020-10-07 15:04:12 +03:00
9df6608239
Remove asterisk from condition
...
Change
ParentCommandLine:
- 'setupapi.dll*InstallHinfSection'
to
ParentCommandLine|contains|all:
- 'setupapi.dll'
- 'InstallHinfSection'
because some LM/SIEM systems don't process '*' as Splunk or Elasticsearch
2020-10-07 14:54:13 +03:00
d3f0ddd2b1
Update powershell_code_injection.yml
2020-10-07 14:50:00 +03:00
bfa3635cd2
Update powershell_accessing_win_api.yml
2020-10-07 14:47:29 +03:00
7c9c21cda0
Update sysmon_psexec_pipes_artifacts.yml
2020-10-07 14:43:25 +03:00
dc856f24e0
Move rule to sysmon folder and update selection names
2020-10-07 07:18:12 -04:00
59610517a0
Update sysmon_long_powershell_commandline.yml
2020-10-07 14:10:26 +03:00
df21dab585
Update sysmon_long_powershell_commandline.yml
2020-10-07 14:00:41 +03:00
e01e26be1c
Update sysmon_long_powershell_commandline.yml
2020-10-07 13:55:17 +03:00
7d8445fe12
[OSCD] Too Long Powershell CommandLine Rule added
2020-10-07 13:42:05 +03:00
da578a8bb0
Update win_susp_winrm_execution.yml
2020-10-07 12:30:57 +03:00
911bc514af
Rename sysmon_accessing_winapi_in_powershell_credentials_dumping.yaml to sysmon_accessing_winapi_in_powershell_credentials_dumping.yml
2020-10-07 12:26:30 +03:00
729e1f6f7f
Сreate win_susp_winrm_execution
2020-10-07 12:20:37 +03:00
b6451fcc38
[OSCD] Accessing WinAPI in PowerShell. Credentials dumping Rule added
2020-10-07 12:17:29 +03:00
ab8e9ed8e7
Create win_susp_winrm_AWL_bypass
2020-10-07 12:07:20 +03:00
4045c68ae4
[OSCD] sysmon_tttracer_mod_load.yml added
2020-10-07 11:17:21 +03:00
391af43708
Update description & references
2020-10-07 10:32:51 +03:00
0fe1850bf4
Update powershell_suspicious_mounted_share_deletion.yml
2020-10-07 17:54:48 +11:00
c879378e35
Update win_susp_mounted_share_deletion.yml
2020-10-07 17:46:13 +11:00
a7442328eb
Create powershell_suspicious_mounted_share_deletion.yml
2020-10-07 17:44:05 +11:00
3dafef411f
Delete powershell_suspicious_mounted_share_deletion.yml
2020-10-07 17:42:25 +11:00
dabc092ab9
Create win_susp_mounted_share_deletion.yml
2020-10-07 17:34:48 +11:00
5c2ef0dd35
Update powershell_suspicious_mounted_share_deletion.yml
2020-10-07 17:33:12 +11:00
d7acbb369e
Created powershell_suspicious_mounted_share_deletion.yml
2020-10-07 17:22:09 +11:00
5d01f71f62
CommandLine|contains -> CommandLine|contains|all:
...
Replaced wildcard expression with list of values
2020-10-07 08:43:22 +03:00
dbb76b5856
Add Usage of reg or Powershell by Non-privileged Users rule
2020-10-06 22:01:18 -04:00
49119e162f
Delete win_susp_rundll32_setupapi_installhinfsection.yml
2020-10-07 01:04:59 +03:00
a5478950c7
Create win_susp_rundll32_setupapi_installhinfsection.yml
2020-10-07 00:34:00 +03:00
e68e212d23
Update win_susp_logon_explicit_credentials.yml
2020-10-07 08:26:43 +11:00
ca0f2146ab
Update win_net_use_admin_share.yml
2020-10-07 08:23:31 +11:00
9d9f0bc373
Create win_susp_rundll32_setupapi_installhinfsection.yml
2020-10-07 00:18:41 +03:00
3d048ceba0
Update win_susp_copy_lateral_movement.yml
2020-10-07 08:18:09 +11:00
ee2c79745f
Update win_susp_wsl_lolbin.yml
2020-10-07 08:12:51 +11:00
0ad9fc61de
Detecting Code injection with PowerShell in another process
2020-10-06 20:52:18 +03:00
944a110749
Delete sysmon_tttracer_mod_load.yml
2020-10-06 20:42:32 +03:00
4c5d692328
[OSCD] sysmon_tttracer_mod_load.yml added
2020-10-06 20:30:56 +03:00
c90d99c0f9
Accessing WinAPI in PowerShell
2020-10-06 19:57:57 +03:00
6e02e6ac19
Change title and update description
2020-10-06 19:52:31 +03:00
bbb9fed3e6
Fixed for FP issues
2020-10-06 19:51:55 +03:00
60b3450fa8
[OSCD] win_syncappvpublishingserver_exe.yml added
2020-10-06 19:22:16 +03:00
0023a22ead
Added FP conditions and fileshare part for cmdline
2020-10-06 19:20:19 +03:00
a5ceba93a9
Fixed conditions
2020-10-06 19:15:30 +03:00
52edc13d15
Fixed dates
2020-10-06 19:10:33 +03:00
79503c63dd
fixed typo in att&ck mapping tag
2020-10-06 12:22:19 +03:00
b93e64cd96
Update title according with the guideline
2020-10-06 11:59:20 +03:00
Semanur Guneysu