eac5ac9fc1
removed duplicate filter
2020-10-08 00:18:38 +03:00
e6588c08f4
Create lnx_system_info_discovery.yml
2020-10-08 00:15:46 +03:00
2cea3800de
Create lnx_password_policy_discovery.yml
2020-10-08 00:14:40 +03:00
357d4bd895
Update sysmon_abusing_debug_privilege.yml
2020-10-07 23:34:03 +03:00
deb8db8599
Adding extension
...
Woops
2020-10-07 16:05:58 -04:00
a0dfde8478
Added UUID
2020-10-07 16:01:53 -04:00
127bc075b0
[OSCD] win_class_exec_xwizard.yml added
2020-10-07 22:49:12 +03:00
aea3c13d01
Initial commit
...
Other parameters besides \query may also be useful for credential dumping. This should be researched.
2020-10-07 15:33:26 -04:00
f00e79d123
Create lnx_file_deletion.yml
2020-10-07 22:28:37 +03:00
a73dbd0a5d
Fix titles
2020-10-07 22:27:48 +03:00
18821d2255
Create lnx_clear_logs.yml
2020-10-07 22:27:06 +03:00
d44ef84b55
Update lnx_process_discovery.yml
2020-10-07 22:26:02 +03:00
d328f92503
Update at_command.yml
2020-10-07 22:23:48 +03:00
bdabb14483
Update at_command.yml
2020-10-07 22:22:31 +03:00
7b29e3a35f
Update lnx_install_root_certificate.yml
2020-10-07 22:20:17 +03:00
1324bc1ad1
Changed the rule to download only and not the copy
2020-10-07 16:18:21 -03:00
b568e14b03
Add 3 rules
2020-10-07 22:06:16 +03:00
1c413bcf6d
Fixed status
2020-10-07 20:45:34 +03:00
ece635b987
[OSCD] Powershell without powershell.exe Rule Added
2020-10-07 19:52:08 +03:00
8696b3ba18
Update sysmon_abusing_debug_privilege.yml
2020-10-07 19:32:05 +03:00
7b64ab552f
Capitalize Title
2020-10-07 10:51:55 -04:00
2d30379ab2
Move to process_creation category
2020-10-07 10:47:40 -04:00
df51044c90
Rule collection implemented
2020-10-07 17:35:14 +03:00
173df7ff3b
Update sysmon_abusing_debug_privilege.yml
2020-10-07 17:31:28 +03:00
8d09b55699
Added category field
2020-10-07 17:25:32 +03:00
6e8d9b9be2
Migrated to the process_creation category.
2020-10-07 17:11:38 +03:00
f66eedbb74
Create sysmon_abusing_debug_privilege.yml
2020-10-07 16:52:19 +03:00
e6a6549676
Create win_susp_replace_lolbin.yml
...
Item 77 of #1014
2020-10-07 10:37:15 -03:00
4bddfaac86
[OSCD] Powershell Script Installed as a Service Rule added
2020-10-07 16:18:38 +03:00
f0f419df78
Create win_susp_pester.yml
2020-10-07 15:19:45 +03:00
18da272de4
[OSCD] win_visual_basic_compiler.yml added
2020-10-07 15:04:12 +03:00
9df6608239
Remove asterisk from condition
...
Change
ParentCommandLine:
- 'setupapi.dll*InstallHinfSection'
to
ParentCommandLine|contains|all:
- 'setupapi.dll'
- 'InstallHinfSection'
because some LM/SIEM systems don't process '*' as Splunk or Elasticsearch
2020-10-07 14:54:13 +03:00
d3f0ddd2b1
Update powershell_code_injection.yml
2020-10-07 14:50:00 +03:00
bfa3635cd2
Update powershell_accessing_win_api.yml
2020-10-07 14:47:29 +03:00
7c9c21cda0
Update sysmon_psexec_pipes_artifacts.yml
2020-10-07 14:43:25 +03:00
dc856f24e0
Move rule to sysmon folder and update selection names
2020-10-07 07:18:12 -04:00
59610517a0
Update sysmon_long_powershell_commandline.yml
2020-10-07 14:10:26 +03:00
df21dab585
Update sysmon_long_powershell_commandline.yml
2020-10-07 14:00:41 +03:00
e01e26be1c
Update sysmon_long_powershell_commandline.yml
2020-10-07 13:55:17 +03:00
7d8445fe12
[OSCD] Too Long Powershell CommandLine Rule added
2020-10-07 13:42:05 +03:00
da578a8bb0
Update win_susp_winrm_execution.yml
2020-10-07 12:30:57 +03:00
911bc514af
Rename sysmon_accessing_winapi_in_powershell_credentials_dumping.yaml to sysmon_accessing_winapi_in_powershell_credentials_dumping.yml
2020-10-07 12:26:30 +03:00
729e1f6f7f
Сreate win_susp_winrm_execution
2020-10-07 12:20:37 +03:00
b6451fcc38
[OSCD] Accessing WinAPI in PowerShell. Credentials dumping Rule added
2020-10-07 12:17:29 +03:00
ab8e9ed8e7
Create win_susp_winrm_AWL_bypass
2020-10-07 12:07:20 +03:00
4045c68ae4
[OSCD] sysmon_tttracer_mod_load.yml added
2020-10-07 11:17:21 +03:00
391af43708
Update description & references
2020-10-07 10:32:51 +03:00
bf43344858
Refactor for multiple log sources
2020-10-07 17:25:34 +10:30
0fe1850bf4
Update powershell_suspicious_mounted_share_deletion.yml
2020-10-07 17:54:48 +11:00
c879378e35
Update win_susp_mounted_share_deletion.yml
2020-10-07 17:46:13 +11:00
Ömer Günal