 Florian Roth
|
7470a1b8d4
|
Merge pull request #2671 from frack113/SpoolFool
Add CVE-2022–22718
|
2022-02-09 13:13:15 +01:00 |
|
|
frack113
|
54c2dcdafb
|
Add CVE-2022–22718
|
2022-02-09 08:40:04 +01:00 |
|
|
Florian Roth
|
98249b6916
|
Merge pull request #2670 from SigmaHQ/aurora-false-positive-fixing
refactor: reduced level of TeamViewer rule
|
2022-02-08 22:05:34 +01:00 |
|
|
Florian Roth
|
9c7679e319
|
fix: duplicate date field
|
2022-02-08 20:41:26 +01:00 |
|
|
Florian Roth
|
d388ce945c
|
refactor: reduced level of TeamViewer rule
|
2022-02-08 20:40:31 +01:00 |
|
|
Florian Roth
|
ef23efa60f
|
Merge pull request #2668 from SigmaHQ/rule-devel
rule: suspicious execution from suspicious folders
|
2022-02-08 19:14:23 +01:00 |
|
|
Florian Roth
|
3e0f45d11e
|
rule: suspicious execution from temp folders
|
2022-02-08 16:15:46 +01:00 |
|
|
Florian Roth
|
93767430fa
|
Merge pull request #2666 from SigmaHQ/rule-devel
Network Recon Activity : nslookup _ldap._tcp.dc._msdcs
|
2022-02-08 13:30:32 +01:00 |
|
|
Florian Roth
|
fa81384917
|
Merge pull request #2667 from SigmaHQ/aurora-false-positive-fixing
Aurora false positive fixing
|
2022-02-08 13:30:21 +01:00 |
|
|
Florian Roth
|
ed06403d04
|
fix: unneeded list
|
2022-02-08 12:21:43 +01:00 |
|
|
Florian Roth
|
9bc8bb5c20
|
fix: remove old link to removed part of rule
|
2022-02-08 09:36:31 +01:00 |
|
|
Florian Roth
|
88ce0ed97d
|
rule: Network Reconnaissance Activity
|
2022-02-08 09:36:03 +01:00 |
|
|
Florian Roth
|
047b928ab0
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-02-08 09:35:12 +01:00 |
|
|
Florian Roth
|
69fcbc138e
|
fix: FPs noticed with Aurora
|
2022-02-08 09:34:53 +01:00 |
|
|
Florian Roth
|
121b28c419
|
Merge pull request #2660 from redsand/fp_sysmon_creation_system_file_allow_wbengine
FP from wbengine when writing a system filename
|
2022-02-08 09:01:10 +01:00 |
|
|
Florian Roth
|
07e0d0412e
|
Merge pull request #2662 from nasbench/master
Update sysmon_raw_disk_access_using_illegitimate_tools.yml
|
2022-02-08 09:00:46 +01:00 |
|
|
Florian Roth
|
7606ab96c8
|
Merge pull request #2657 from phantinuss/master
fix: FPs
|
2022-02-08 09:00:31 +01:00 |
|
|
Florian Roth
|
c69613696f
|
fix: FP noticed with Aurora
|
2022-02-07 21:24:21 +01:00 |
|
|
Florian Roth
|
7e17c2bbd2
|
Merge pull request #2658 from Karneades/patch-1
rule: ACTINIUM Scheduled Task Persistence
|
2022-02-07 21:20:22 +01:00 |
|
|
Florian Roth
|
3ca0382671
|
Merge pull request #2661 from redsand/fp_mimikatz_command_line
FP mimikatz when loading powershell function Convert-GuidToCompressedGuid
|
2022-02-07 21:20:04 +01:00 |
|
|
Nasreddine Bencherchali
|
7d1e149844
|
Update sysmon_raw_disk_access_using_illegitimate_tools.yml
|
2022-02-07 20:51:19 +01:00 |
|
|
Tim Shelton
|
f3ce179f76
|
fixing false positive when loading the powershell function Convert-GuidToCompressedGuid
|
2022-02-07 17:10:57 +00:00 |
|
|
Tim Shelton
|
913aac6695
|
allow fp from wbengine
|
2022-02-07 16:58:58 +00:00 |
|
|
Florian Roth
|
aef0bd2a2d
|
Update process_creation_apt_actinium_persistence.yml
|
2022-02-07 16:15:48 +01:00 |
|
|
Andreas Hunkeler
|
40411f0596
|
Fix list issue in new wscript persistence rule
|
2022-02-07 15:54:42 +01:00 |
|
|
Andreas Hunkeler
|
0a78c3966b
|
rule: ACTINIUM Scheduled Task Persistence
|
2022-02-07 15:43:30 +01:00 |
|
|
Florian Roth
|
a60426e4a2
|
Update win_alert_lsass_access.yml
|
2022-02-07 15:43:04 +01:00 |
|
|
phantinuss
|
ed2025e626
|
fix: FPs
|
2022-02-07 15:32:15 +01:00 |
|
|
Florian Roth
|
e69a816f7d
|
fix: extended filters for raw disk access rule
|
2022-02-07 13:58:16 +01:00 |
|
|
Florian Roth
|
5c73f913f2
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-02-07 13:17:00 +01:00 |
|
|
Florian Roth
|
9842118c53
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-02-07 13:15:05 +01:00 |
|
|
Florian Roth
|
5862cdc192
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-02-07 13:14:53 +01:00 |
|
|
Florian Roth
|
b0e73af9ff
|
fix: FPs noticed with Aurora
|
2022-02-07 13:14:51 +01:00 |
|
|
Florian Roth
|
90f551a194
|
Merge branch 'master' into rule-devel
|
2022-02-06 23:34:54 +01:00 |
|
|
Florian Roth
|
d083efa095
|
fix: FPs noticed with Aurora
|
2022-02-06 23:33:52 +01:00 |
|
|
frack113
|
6dbbccc84e
|
Merge pull request #2648 from frack113/x86matthew_lnk
add win_pc_embed_exe_lnk
|
2022-02-06 21:15:51 +01:00 |
|
|
frack113
|
968dbeeaca
|
Merge pull request #2647 from frack113/red_20220206
add posh_ps_get_adreplaccount
|
2022-02-06 21:15:31 +01:00 |
|
|
Florian Roth
|
80a552d28d
|
refactor: lsass dump filename IOC pattern
|
2022-02-06 14:26:55 +01:00 |
|
|
Florian Roth
|
094215a7e0
|
Update win_pc_embed_exe_lnk.yml
|
2022-02-06 14:20:30 +01:00 |
|
|
Florian Roth
|
97dacc4ffc
|
refactor: increased level to medium
|
2022-02-06 14:17:38 +01:00 |
|
|
frack113
|
f1f38a2df4
|
add win_pc_embed_exe_lnk
|
2022-02-06 14:01:48 +01:00 |
|
|
frack113
|
62611e0e39
|
add posh_ps_get_adreplaccount
|
2022-02-06 11:15:00 +01:00 |
|
|
Florian Roth
|
49d35717ad
|
Merge pull request #2645 from SigmaHQ/aurora-false-positive-fixing
Aurora false positive fixing
|
2022-02-05 22:26:52 +01:00 |
|
|
Florian Roth
|
fada8df7d4
|
fix: FP notices with Aurora
|
2022-02-05 21:40:03 +01:00 |
|
|
Florian Roth
|
44221ed95e
|
fix: Aurora Sigma rule matches in application log
|
2022-02-05 21:38:10 +01:00 |
|
|
frack113
|
ebd09793d7
|
Merge pull request #2643 from elhoim/patch-1
Avoiding being too narrow for paths
|
2022-02-05 12:03:46 +01:00 |
|
|
frack113
|
ef629c1502
|
Merge pull request #2641 from frack113/red_20220204
Windows redcanaryco
|
2022-02-05 12:03:28 +01:00 |
|
|
Florian Roth
|
c23a82d2e7
|
Update win_re_set_servicedll.yml
|
2022-02-04 23:19:36 +01:00 |
|
|
Florian Roth
|
8dc0835b2a
|
Update win_pc_redirect_to_stream.yml
|
2022-02-04 23:18:08 +01:00 |
|
|
Florian Roth
|
affd73506d
|
Update win_pc_susp_instalutil.yml
|
2022-02-04 23:16:05 +01:00 |
|