 Florian Roth
|
d9193efda3
|
Merge pull request #2597 from SigmaHQ/rule-devel
AdvancedRun and Bugfix
|
2022-01-24 12:39:51 +01:00 |
|
|
Florian Roth
|
9505a761e1
|
fix: bug in rule - missing backspace
|
2022-01-24 11:54:58 +01:00 |
|
|
frack113
|
4be9a6c3ad
|
Add win_re_blackbyte_ransomware
|
2022-01-24 10:03:52 +01:00 |
|
|
frack113
|
2dc0c2a8a9
|
fix field name case
|
2022-01-23 19:12:12 +01:00 |
|
|
frack113
|
f1959f25d7
|
Windows Redcannary
|
2022-01-23 16:37:59 +01:00 |
|
|
frack113
|
097704d834
|
add win_pc_susp_instalutil
|
2022-01-23 14:47:25 +01:00 |
|
|
frack113
|
1b8fa21be1
|
Fix space
|
2022-01-23 11:40:35 +01:00 |
|
|
frack113
|
90334e7f7c
|
Redcannary windows test
|
2022-01-23 11:37:01 +01:00 |
|
|
frack113
|
31e38623de
|
Update win_susp_curl_fileupload
|
2022-01-23 11:35:36 +01:00 |
|
|
sagiezero
|
83afc12875
|
fix(rules): changed "product" and "service" to suggested values.
|
2022-01-23 09:44:24 +02:00 |
|
|
Pawel Mazur
|
bbdfb79bc0
|
Adding new linux auditd rule - Disable Dystem Firewall
|
2022-01-22 15:12:24 +01:00 |
|
|
frack113
|
dfc477888b
|
Merge pull request #2583 from BlackB0lt/patch-22
Create lnx_doas_conf_creation.yml
|
2022-01-21 18:44:08 +01:00 |
|
|
frack113
|
2eeee78466
|
Merge pull request #2582 from BlackB0lt/patch-21
Create lnx_doas_execution.yml
|
2022-01-21 18:43:57 +01:00 |
|
|
frack113
|
5f71d21dc0
|
Merge pull request #2589 from frack113/discussions_2584
Move windows internal services to builtin
|
2022-01-21 18:39:32 +01:00 |
|
|
Florian Roth
|
7dabe5e7a8
|
Merge pull request #2591 from frack113/colorcpl
add win_fe_susp_colorcpl
|
2022-01-21 17:47:52 +01:00 |
|
|
Florian Roth
|
978381000f
|
Merge pull request #2588 from frack113/order_folder
Order rules
|
2022-01-21 17:47:09 +01:00 |
|
|
frack113
|
97f4bda4bc
|
add win_fe_susp_colorcpl
|
2022-01-21 14:16:35 +01:00 |
|
|
frack113
|
6eeb0723ed
|
Fix FP thanks aurora
|
2022-01-21 13:14:35 +01:00 |
|
|
frack113
|
7053d42e43
|
move to builtin
|
2022-01-21 11:59:13 +01:00 |
|
|
frack113
|
eb22807ddc
|
Order rules
|
2022-01-20 22:06:55 +01:00 |
|
|
frack113
|
137fc39c54
|
Merge pull request #2578 from frack113/red_20220119
Add Redcannary Windows Rules
|
2022-01-20 18:03:04 +01:00 |
|
|
sagiezero
|
929711f5c1
|
fix(rules): missed stuff from previous fix
|
2022-01-20 17:27:47 +02:00 |
|
|
sagiezero
|
eb5578fa33
|
fix(rules): fixed capital in rule names, removed unknown mitre tags, removed unknown tag in logsource.
|
2022-01-20 16:53:01 +02:00 |
|
|
frack113
|
b7b95f9055
|
Order application folder
|
2022-01-20 14:57:57 +01:00 |
|
|
Florian Roth
|
885f70b0f3
|
Update lnx_doas_execution.yml
|
2022-01-20 13:08:39 +01:00 |
|
|
Florian Roth
|
375acb8ba4
|
Update lnx_doas_conf_creation.yml
|
2022-01-20 13:07:53 +01:00 |
|
|
frack113
|
0ae1e37ac9
|
Merge pull request #2586 from phantinuss/master
fix: typo unkown --> unknown
|
2022-01-20 11:36:33 +01:00 |
|
|
Florian Roth
|
8cf78fb4e6
|
rules: advancedrun executions
|
2022-01-20 11:08:08 +01:00 |
|
|
Florian Roth
|
e99d030754
|
Merge pull request #2585 from SigmaHQ/rule-devel
First code integrity rule - new log source
|
2022-01-20 11:06:20 +01:00 |
|
|
sagiezero
|
c76443051a
|
feat(rules): changing location to "application" folder
|
2022-01-20 11:57:10 +02:00 |
|
|
phantinuss
|
26c1c23305
|
fix: typo
|
2022-01-20 10:45:30 +01:00 |
|
|
Florian Roth
|
9b7b48c0e6
|
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
|
2022-01-20 09:45:03 +01:00 |
|
|
Florian Roth
|
4395a6dafa
|
rule: code integrity failed driver load
|
2022-01-20 09:45:00 +01:00 |
|
|
Sittikorn S
|
f21d10b69f
|
Update lnx_doas_conf_creation.yml
|
2022-01-20 11:00:18 +07:00 |
|
|
Sittikorn S
|
f195160baa
|
Update lnx_doas_execution.yml
|
2022-01-20 10:58:47 +07:00 |
|
|
Sittikorn S
|
8b94046efa
|
Update lnx_doas_execution.yml
|
2022-01-20 10:11:24 +07:00 |
|
|
Sittikorn S
|
41065bcc91
|
Update lnx_doas_conf_creation.yml
|
2022-01-20 10:11:14 +07:00 |
|
|
Sittikorn S
|
bb574151ba
|
Create lnx_doas_conf_creation.yml
|
2022-01-20 09:50:41 +07:00 |
|
|
Sittikorn S
|
4f56e0d92e
|
Update lnx_doas_execution.yml
|
2022-01-20 09:48:24 +07:00 |
|
|
Sittikorn S
|
eb4731b370
|
Create lnx_doas_execution.yml
|
2022-01-20 09:46:17 +07:00 |
|
|
frack113
|
caa4c7f977
|
Add Redcannary Windows Rules
|
2022-01-19 20:40:43 +01:00 |
|
|
Florian Roth
|
8a70729654
|
Merge pull request #2574 from SigmaHQ/rule-devel
rule: extended Defender exclusions rule
|
2022-01-19 20:32:14 +01:00 |
|
|
Florian Roth
|
86165466e5
|
Merge pull request #2577 from SigmaHQ/aurora-false-positive-fixing
fix: FPs noticed with Aurora
|
2022-01-19 20:32:05 +01:00 |
|
|
Florian Roth
|
d6af219bed
|
Merge branch 'master' into pr/2573
|
2022-01-19 19:42:49 +01:00 |
|
|
Florian Roth
|
6835381e6a
|
Merge branch 'master' into rule-devel
|
2022-01-19 19:42:14 +01:00 |
|
|
Florian Roth
|
27912f20d1
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-01-19 19:41:39 +01:00 |
|
|
Florian Roth
|
e10decf584
|
Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing
|
2022-01-19 19:41:09 +01:00 |
|
|
Florian Roth
|
51970e888e
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-01-19 19:40:51 +01:00 |
|
|
Florian Roth
|
ba3a71aa9a
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-01-19 18:35:20 +01:00 |
|
|
Florian Roth
|
94df11f53c
|
fix: FPs noticed with Aurora
|
2022-01-19 18:34:07 +01:00 |
|