2e9d7951a6
Merge pull request #1272 from bczyz1/patch-2
...
Fix typo in win_apt_lazarus_session_hijack.yml
2020-11-10 13:35:08 +01:00
f6c0fb2d33
fix: FPs with notepad++ GUP rule
2020-11-09 16:34:12 +01:00
ad031d97ee
Filter out listening mode on nc
2020-11-09 10:32:56 +01:00
577165b7f7
Update lnx_system_info_discovery.yml
2020-11-08 11:09:27 +03:00
0e4a5baf1a
Update lnx_install_root_certificate.yml
2020-11-08 11:08:30 +03:00
499a8f85b0
Update lnx_install_root_certificate.yml
2020-11-08 11:06:11 +03:00
5dc3472af0
Update lnx_system_info_discovery.yml
2020-11-07 11:51:53 +03:00
89a24d4bfa
Update lnx_install_root_certificate.yml
2020-11-07 11:50:30 +03:00
c17e8574d0
change the syntax a bit and removed .service suffix as it is
...
[redundant](https://www.freedesktop.org/software/systemd/man/systemctl.html ]:
```
Unit commands listed above take either a single unit name (designated as UNIT), or multiple unit specifications (designated as PATTERN…). In the first case, the unit name with or without a suffix must be given. If the suffix is not specified (unit name is "abbreviated"), systemctl will append a suitable suffix, ".service" by default, and a type-specific suffix in case of commands which operate only on specific unit types. For example,
# systemctl start sshd
and
# systemctl start sshd.service
are equivalent
```
2020-11-06 20:56:08 +01:00
7c5067ade4
Making it a global rule
2020-11-06 10:25:59 +01:00
a9a90e024c
make it global rule
2020-11-06 09:56:49 +01:00
c3785d6dc7
rule: FPs with WmiPrvSE rule
2020-11-05 16:44:33 +01:00
c554aaea8f
update win_apt_slingshot.yml
...
- optimized rule
- added detection of task modification (flag /change + /disable as described here https://stackoverflow.com/questions/26169582/does-anyone-know-of-a-way-to-turn-off-windows-defragmenters-default-schedule-us )
2020-11-05 15:51:22 +01:00
efc3f298b8
simplify syntax
2020-11-04 23:03:34 +01:00
2f789c45dc
change a syntax a bit to re-run the tests
2020-11-04 22:30:27 +01:00
908023fa66
rule: added second expression
2020-11-04 16:43:35 +01:00
4a5b2d642e
Fix typo in win_apt_lazarus_session_hijack.yml
2020-11-03 14:46:29 +01:00
f848bb912c
rule: reworked weblogic CVE-2020-14882 rule
2020-11-03 10:39:40 +01:00
8068487340
test trigger
2020-11-03 12:04:03 +03:00
544876951f
fixed duplication v2
2020-11-03 02:34:34 +03:00
48e46c279a
fixed duplication
2020-11-03 02:25:22 +03:00
cf8c721662
fixed optimization and references
2020-11-03 02:16:13 +03:00
e2c4af012b
Changed to Placeholders Usage
...
A query was too big to pass a test, so I changed logic to placeholders usage.
2020-11-03 00:56:42 +03:00
dd0d1d053c
rule: WebLogic exploit CVE-2020-14882
2020-11-02 11:11:37 +01:00
e93dd7fe61
fix
2020-11-01 15:25:12 +03:00
903ce08277
Update win_susp_multiple_files_renamed_or_deleted.yml
2020-11-01 14:21:27 +03:00
ea71828d34
change syntax a bit to re-run the test
2020-10-31 23:57:13 +01:00
8dc8fdc44b
Added antifalsepositive condition
...
4688 always has non empty cmd
2020-10-31 12:46:30 +04:00
f1bb9726ca
updated mitre tag
2020-10-30 13:35:40 +05:30
86a849728d
ryuk changes
2020-10-30 13:15:11 +05:30
972326f761
A few more - 7 Rules
2020-10-29 21:11:41 -04:00
25b92d4a2e
Merge branch 'master' of https://github.com/Neo23x0/sigma
2020-10-29 21:04:45 -04:00
ab60fdcef4
Update win_susp_multiple_files_renamed_or_deleted.yml
2020-10-29 23:38:22 +03:00
5918cc0a3d
remove cat
2020-10-29 09:58:58 +01:00
683824ee46
Update win_susp_multiple_files_renamed_or_deleted.yml
2020-10-29 11:44:45 +03:00
0c0c1725fa
refactor detections
2020-10-29 09:34:47 +01:00
d743cbbe4b
Update win_susp_multiple_files_renamed_or_deleted.yml
2020-10-29 11:14:43 +03:00
167e9745cd
Update macos_remote_system_discovery.yml
2020-10-29 02:06:45 +01:00
81f6f24155
Update lnx_remote_system_discovery.yml
2020-10-29 02:06:20 +01:00
46c52b4347
Update sysmon_abusing_debug_privilege.yml
2020-10-28 20:11:29 +03:00
07f777d1b5
Update powershell_CL_Mutexverifiers_LOLScript_v2.yml
2020-10-28 19:32:18 +03:00
7ee644eac0
Update powershell_CL_Invocation_LOLScript_v2.yml
2020-10-28 19:30:21 +03:00
d0a796439b
Update powershell_CL_Invocation_LOLScript.yml
2020-10-28 19:25:43 +03:00
a4a3e01f25
Splitting into two rules
2020-10-28 19:13:29 +03:00
55a7fe6b9d
Splitting into two rules
2020-10-28 19:08:23 +03:00
80b1a19246
Added the space at the beginning of the IP ranges.
2020-10-28 10:16:29 +01:00
3a58c00feb
Removing the echo detection
2020-10-28 10:07:59 +01:00
e31c8f96e9
added the category
2020-10-28 09:56:01 +01:00
d90ec67cce
Update win_susp_multiple_files_renamed_or_deleted.yml
2020-10-28 11:44:21 +03:00
744c637125
Delete win_rdp_session_hijacking.yml
2020-10-28 11:38:39 +03:00
Florian Roth