 Florian Roth
|
7acfecbe66
|
Merge pull request #530 from bartblaze/master
Add scriptlets
|
2019-12-14 11:24:51 +01:00 |
|
|
Thomas Patzke
|
1369b3a2dc
|
Merge pull request #537 from webhead404/webhead404-contrib-sigma
Added sigma rule to detect external devices or USB drive
|
2019-12-13 21:50:01 +01:00 |
|
|
Thomas Patzke
|
7a280ae092
|
Merge pull request #557 from robrankin/fix_dupe_rule_name
Elastalert error, duplicate rule titles
|
2019-12-13 21:46:58 +01:00 |
|
|
Florian Roth
|
1b42f2a0e2
|
Merge pull request #561 from Neo23x0/devel
Devel
|
2019-12-12 13:34:58 +01:00 |
|
|
Florian Roth
|
67dfd729fd
|
rule: extended Proxy UA suspicious rule
|
2019-12-12 10:42:23 +01:00 |
|
|
Florian Roth
|
9c59e3cf13
|
Merge branch 'master' into devel
|
2019-12-12 09:40:02 +01:00 |
|
|
Florian Roth
|
065df363dc
|
rule: added Empire UA
|
2019-12-12 09:39:28 +01:00 |
|
|
Florian Roth
|
c25b902add
|
Merge pull request #558 from vburov/patch-7
Added svchost.exe as a parent image
|
2019-12-10 20:17:22 +01:00 |
|
|
Vasiliy Burov
|
977551c69d
|
Added some suspicious locations
Added 'C:\Windows\Tasks' and 'C:\Windows\System32\Tasks' as suspicious locations accordingly article: https://github.com/ThreatHuntingProject/ThreatHunting/blob/master/hunts/suspicious_process_creation_via_windows_event_logs.md
|
2019-12-10 20:17:40 +03:00 |
|
|
Vasiliy Burov
|
0dd4324aba
|
Added svchost.exe as a parent image
Added svchost.exe as a parent image accordingly this article (https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/) and my investigations.
|
2019-12-10 19:31:12 +03:00 |
|
|
Rob Rankin
|
e251568760
|
Data Compressed duplciate titles
|
2019-12-09 16:24:10 +00:00 |
|
|
Rob Rankin
|
b771dd3d3b
|
Rule name conflicts in Elastalert output
|
2019-12-09 16:14:28 +00:00 |
|
|
Thomas Patzke
|
a9d6158dde
|
Merge branch 'rules'
|
2019-12-09 16:17:39 +01:00 |
|
|
Thomas Patzke
|
2ea87f187c
|
Added Ursnif proxy detections
|
2019-12-09 16:02:10 +01:00 |
|
|
Yugoslavskiy Daniil
|
185a634bd9
|
update authors for 2 rules
|
2019-12-07 02:10:06 +01:00 |
|
|
Yugoslavskiy Daniil
|
4789b15fd5
|
add rules by Sergey Soldatov, Kaspersky Lab
|
2019-12-07 01:45:55 +01:00 |
|
|
Thomas Patzke
|
991108e64d
|
Further proxy field name fixes (config + rules)
|
2019-12-07 00:23:30 +01:00 |
|
|
Thomas Patzke
|
dd8442590f
|
Fixed proxy rule field names
|
2019-12-07 00:11:33 +01:00 |
|
|
Florian Roth
|
e1244acf49
|
rule: fixed and extended bitsadmin rule
|
2019-12-06 13:39:04 +01:00 |
|
|
Florian Roth
|
c1647ca4b7
|
Merge branch 'master' into devel
|
2019-12-06 13:38:29 +01:00 |
|
|
Kevin Dienst
|
865251238f
|
Add hastebin raw URI to contains selection
|
2019-12-05 14:16:20 -06:00 |
|
|
Florian Roth
|
ab2dd094a5
|
fix: fixed broken link in elise rule
|
2019-12-05 09:56:20 +01:00 |
|
|
Florian Roth
|
8e107f43a2
|
rule: raw paste service access
|
2019-12-05 08:54:49 +01:00 |
|
|
Thomas Patzke
|
ad7d5d2a39
|
Added WMI login rule
|
2019-12-04 11:13:04 +01:00 |
|
|
Thomas Patzke
|
e8c1c97f3e
|
Added rule for failed code integrity checks
|
2019-12-03 15:08:26 +01:00 |
|
|
Thomas Patzke
|
c47af5169c
|
Increased SID history rule severity
|
2019-12-03 14:28:46 +01:00 |
|
|
Thomas Patzke
|
76578927e8
|
Added domain trust rule
|
2019-12-03 14:28:20 +01:00 |
|
|
Florian Roth
|
c8e29da7ec
|
fix: simplified rule with RE
|
2019-12-03 11:24:06 +01:00 |
|
|
Florian Roth
|
fc09533f56
|
style: fixed title
|
2019-12-03 11:24:06 +01:00 |
|
|
yugoslavskiy
|
edad1695f6
|
Merge branch 'oscd' of https://github.com/mrblacyk/sigma into mrblacyk-oscd
|
2019-12-02 02:56:53 +01:00 |
|
|
yugoslavskiy
|
48a94d1609
|
Update lnx_dd_delete_file.yml
|
2019-12-02 02:54:48 +01:00 |
|
|
yugoslavskiy
|
ca1c2f4436
|
Update lnx_chattr_immutable_removal.yml
|
2019-12-02 02:54:32 +01:00 |
|
|
yugoslavskiy
|
9e90335a5a
|
Update lnx_pers_systemd_reload.yml
|
2019-12-02 02:54:13 +01:00 |
|
|
yugoslavskiy
|
46ca68436e
|
Update lnx_file_or_folder_permissions.yml
|
2019-12-02 02:53:35 +01:00 |
|
|
yugoslavskiy
|
1273a10dcb
|
add win_new_service_creation.yml
|
2019-12-02 01:19:54 +01:00 |
|
|
yugoslavskiy
|
9fba097421
|
add sysmon_in_memory_powershell.yml by Tom Kern
|
2019-12-01 23:26:00 +01:00 |
|
|
booberry46
|
df162b232f
|
Update win_malware_emotet.yml
|
2019-11-30 13:17:44 +08:00 |
|
|
mrblacyk
|
9d0889def4
|
Adding auditd compatibility
|
2019-11-29 09:34:08 +01:00 |
|
|
mrblacyk
|
cafbb25d2e
|
Update lnx_file_or_folder_permissions.yml
|
2019-11-29 09:33:04 +01:00 |
|
|
mrblacyk
|
bf5e6cc56b
|
Adding auditd compatibility
|
2019-11-29 09:32:05 +01:00 |
|
|
mrblacyk
|
a15c84eb80
|
Adding auditd compatibility
|
2019-11-29 09:27:31 +01:00 |
|
|
Yugoslavskiy Daniil
|
71e588cae1
|
add apt silence rules by Group-IB
|
2019-11-28 21:15:55 +01:00 |
|
|
yugoslavskiy
|
d5722979ea
|
add rules by Daniel Bohannon
|
2019-11-27 00:02:45 +01:00 |
|
|
yugoslavskiy
|
41a09cde34
|
updated filenames
|
2019-11-26 23:31:18 +01:00 |
|
|
webhead404
|
21ef152e3a
|
Update win_external_device.yml
|
2019-11-20 16:19:45 -06:00 |
|
|
webhead404
|
2bfd4ea654
|
Added MITRE tags
|
2019-11-20 16:18:03 -06:00 |
|
|
webhead404
|
5c5d28acdc
|
Create win_external_device
|
2019-11-20 16:07:29 -06:00 |
|
|
Florian Roth
|
39293d5f2b
|
rule: another reference for CVE-2019-1388 rule
|
2019-11-20 15:09:30 +01:00 |
|
|
Florian Roth
|
f9e6a929ba
|
rule: made it more specific - command line must contain URL
|
2019-11-20 09:23:04 +01:00 |
|
|
Florian Roth
|
55e66b1843
|
rule: added status
|
2019-11-20 09:21:42 +01:00 |
|