 cyb3rward0g
|
21f41eaad9
|
16 rules from DH APT29 day 1 - contributing soon
|
2020-10-12 18:13:13 -04:00 |
|
|
cyb3rward0g
|
104b40ce8f
|
10 rules from THP - contributing soon
|
2020-10-12 15:42:34 -04:00 |
|
|
nsaddler
|
28c8b56473
|
Update sysmon_in_memory_powershell.yml
|
2020-10-12 19:05:08 +03:00 |
|
|
Наталья Шорникова
|
e70368f1f0
|
[OSCD] Updating existing rule sysmon_in_memory_powershell.yml
|
2020-10-12 19:00:47 +03:00 |
|
|
S.kiran kumar
|
bd5e7fda14
|
Update silenttrinity_stager_msbuild_activity.yml
|
2020-10-12 21:26:44 +05:30 |
|
|
Nikita P. Nazarov
|
9b17634aa4
|
Detects Obfuscated Powershell via Stdin in Scripts
|
2020-10-12 18:56:12 +03:00 |
|
|
Nikita P. Nazarov
|
ec383d9784
|
Detects Obfuscated Powershell via Stdin in Scripts
|
2020-10-12 18:52:28 +03:00 |
|
|
Nikita P. Nazarov
|
c5efbc8345
|
Detects Obfuscated Powershell via Stdin in Scripts
|
2020-10-12 18:47:51 +03:00 |
|
|
nsaddler
|
e94a47b9d3
|
Update sysmon_accessing_winapi_in_powershell_credentials_dumping.yml
|
2020-10-12 18:33:43 +03:00 |
|
|
nsaddler
|
df8cd24a5d
|
Update sysmon_long_powershell_commandline.yml
|
2020-10-12 18:28:28 +03:00 |
|
|
nsaddler
|
07a4d11af7
|
Update win_powershell_script_installed_as_service.yml
|
2020-10-12 18:23:06 +03:00 |
|
|
Vasiliy Burov
|
95cd271686
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-12 18:10:46 +03:00 |
|
|
Vasiliy Burov
|
643d700d53
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-12 17:51:19 +03:00 |
|
|
S.kiran kumar
|
27823763cb
|
Update silenttrinity_stager_msbuild_activity.yml
|
2020-10-12 20:14:43 +05:30 |
|
|
S.kiran kumar
|
a640c1e151
|
Update silenttrinity_stager_msbuild_activity.yml
|
2020-10-12 20:11:24 +05:30 |
|
|
S.kiran kumar
|
f1c9286a25
|
Updated minor changes
Change tags.
Change author (add "oscd.community").
Change date format.
Change logsource.
Change detection (use endswith as a modifier).
Change fields.
|
2020-10-12 20:06:36 +05:30 |
|
|
omkargudhate22
|
8f618c9a1f
|
changed condition
|
2020-10-12 18:59:53 +05:30 |
|
|
omkargudhate22
|
f162bc1aff
|
remove space
|
2020-10-12 18:53:47 +05:30 |
|
|
omkargudhate22
|
ecb42fb5dd
|
Update sysmon_susp_clr_logs.yml
|
2020-10-12 18:50:07 +05:30 |
|
|
omkar72
|
cf60438c93
|
clr logs creation
|
2020-10-12 18:42:09 +05:30 |
|
|
Ryan Plas
|
a67c19c08b
|
Split up powershell detection
|
2020-10-12 09:00:08 -04:00 |
|
|
omkargudhate22
|
7d69a08c30
|
Update win_netsh_port_fwd.yml
|
2020-10-12 18:29:02 +05:30 |
|
|
omkar72
|
a5575f3079
|
adding shortened commands
|
2020-10-12 17:47:26 +05:30 |
|
|
omkar72
|
b32b6f0e09
|
script loading .net
|
2020-10-12 17:20:22 +05:30 |
|
|
Vasiliy Burov
|
d31f8d6977
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-12 14:43:53 +03:00 |
|
|
omkargudhate22
|
e2911a025e
|
added tags and corrected image condition format
|
2020-10-12 17:00:57 +05:30 |
|
|
Vasiliy Burov
|
2e6f184370
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-12 14:11:10 +03:00 |
|
|
Vasiliy Burov
|
436dd4d90c
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-12 14:04:24 +03:00 |
|
|
Alexander Sungurov
|
175834fe90
|
Pcwrun.exe detection added
|
2020-10-12 13:52:49 +03:00 |
|
|
Florian Roth
|
b8dc8d3f7e
|
reduced to avoid FPs
|
2020-10-12 10:46:34 +02:00 |
|
|
Sander
|
8c1bd4e466
|
Remove redundant space
|
2020-10-12 10:01:44 +02:00 |
|
|
omkar72
|
0fab2c0930
|
finger executable suspicious execution
|
2020-10-12 13:28:52 +05:30 |
|
|
Sander
|
3ab244c70f
|
regini.exe ADS rule
|
2020-10-12 09:55:34 +02:00 |
|
|
Florian Roth
|
3affdd12e0
|
fix: rule title casing
|
2020-10-12 09:51:35 +02:00 |
|
|
omkar72
|
99d87d60ec
|
updated adfind command line
|
2020-10-12 12:52:54 +05:30 |
|
|
Florian Roth
|
0d0cda0f86
|
docs: improved false positive notes
|
2020-10-12 09:18:42 +02:00 |
|
|
Florian Roth
|
e7c6794ecd
|
rule: suspicious wmic process call create + rundll32
|
2020-10-12 09:18:30 +02:00 |
|
|
Florian Roth
|
2e732eb01f
|
Merge branch 'master' into rule-devel
|
2020-10-12 09:13:24 +02:00 |
|
|
omkar72
|
cf5ad9197c
|
updated adfind command line
|
2020-10-12 12:42:05 +05:30 |
|
|
omkar72
|
d29a28a4a8
|
updated adfind command line
|
2020-10-12 12:40:50 +05:30 |
|
|
uncleP@sk
|
13e829219c
|
reference's list changed
|
2020-10-12 08:35:11 +03:00 |
|
|
uncleP@sk
|
8ff91088ee
|
tag's issue solved
|
2020-10-12 08:31:10 +03:00 |
|
|
remotephone@gmail.com
|
476a3c04d9
|
Adding t1070_002
|
2020-10-12 00:01:10 -05:00 |
|
|
remotephone@gmail.com
|
781c7ce6dc
|
Cleaning up falsepositives section of both rules
|
2020-10-11 23:52:47 -05:00 |
|
|
remotephone@gmail.com
|
48edc674bd
|
updating keywords to CommandLine|contains and splitting rule into two
|
2020-10-11 22:43:28 -05:00 |
|
|
Bartlomiej Czyz
|
e90f91b89e
|
append authors of the update
|
2020-10-11 23:42:33 +02:00 |
|
|
Vasiliy Burov
|
a0ac753e32
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-12 00:39:36 +03:00 |
|
|
Bartlomiej Czyz
|
ae41190291
|
remove redundant reference
|
2020-10-11 23:39:08 +02:00 |
|
|
Vasiliy Burov
|
48f6fad6c3
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-12 00:35:59 +03:00 |
|
|
Bartlomiej Czyz
|
b6876e5123
|
remove redundant reference
|
2020-10-11 23:35:17 +02:00 |
|