79de1631de
Merge pull request #2601 from secDre4mer/master
...
fix: Add filter for empty image to rule
2022-01-27 16:16:06 +01:00
c1c5ed0db7
Update lnx_auditd_cve_2021_4034.yml
2022-01-27 12:55:22 +01:00
bd9b5172cd
Update lnx_auditd_cve_2021_4034.yml
2022-01-27 12:44:53 +01:00
c924977576
Adding auditd rule for CVE-2021-4034
2022-01-27 12:36:19 +01:00
82d5f4a511
fix: too many false positives with certain access masks
2022-01-27 09:08:40 +01:00
d52602dd5e
Update posh_ps_clear_powershell_history.yml
2022-01-26 18:09:09 +01:00
feedcee6bf
Update posh_ps_clear_powershell_history.yml
2022-01-26 17:57:26 +01:00
e08e8dd3d4
Update sysmon_process_hollowing.yml
2022-01-26 17:53:46 +01:00
04b5df7b85
Merge pull request #2608 from MHaggis/master
...
Update sysmon_lsass_memdump.yml
2022-01-26 17:47:51 +01:00
b3b37719e7
Update sysmon_lsass_memdump.yml
...
Updated Sysmon Lsass Memdump to detect other memory dumping techniques from mimikatz, nanodump, invoke-mimikatz, and so forth. This adds additional GrantedAccess permissions and adds ntdll.dll to CallTrace. Tested with Atomic Red Team T1003.001, MimiKatz, Invoke-Mimikatz and Cobalt Strike.
2022-01-26 08:12:49 -07:00
364b5c9620
Create sysmon_process_hollowing.yml
...
Closed old request, and put rule into its appropriate file directory.
2022-01-25 15:57:03 -05:00
1cfa06e6e6
Update process_creation_rundll32_not_from_c_drive.yml
2022-01-25 14:43:30 -05:00
076b0c9246
Create process_creation_rundll32_not_from_c_drive.yml
...
Sample Log:
Process Create: RuleName: - UtcTime: 2022-01-25 17:12:12.156 ProcessGuid: {A931971D-2F6C-61F0-D700-000000005200} ProcessId: 724 Image: C:\Windows\notepad.exe FileVersion: 10.0.14393.0 (rs1_release.160715-1616) Description: Notepad Product: Microsoft® Windows® Operating System Company: Microsoft Corporation OriginalFileName: NOTEPAD.EXE CommandLine: "c:\windows\notepad.exe" CurrentDirectory: E:\ User: WINDOMAIN\vagrant LogonGuid: {A931971D-283E-61F0-3DF7-080000000000} LogonId: 0x8F73D TerminalSessionId: 1 IntegrityLevel: Medium Hashes: SHA1=40F2E778CF1EFFA957C719D2398E641EFF20E613,MD5=3B508CAE5DEBCBA928B5BC355517E2E6,SHA256=DA0ACEE8F60A460CFB5249E262D3D53211EBC4C777579E99C8202B761541110A,IMPHASH=968239BE2020F1C0DAFFDCDBD49E9C82 ParentProcessGuid: {A931971D-2F57-61F0-D600-000000005200} ParentProcessId: 936 ParentImage: C:\Windows\System32\rundll32.exe ParentCommandLine: "C:\Windows\System32\rundll32.exe" SharedFiles.dll,BasicScore ParentUser: WINDOMAIN\vagrant
2022-01-25 14:42:13 -05:00
a68cf58264
Merge pull request #2596 from frack113/blackbyte
...
Add win_re_blackbyte_ransomware
2022-01-25 20:39:05 +01:00
818b20b949
add posh_ps_clear_powershell_history
2022-01-25 19:58:18 +01:00
51d9aca239
chore: update modified date
2022-01-25 11:46:16 +01:00
0cad38be34
fix: Add filter for empty image to rule
2022-01-25 11:43:35 +01:00
8a47c56397
Merge pull request #2595 from frack113/red_20220123b
...
Windows Redcannary
2022-01-25 06:21:17 +01:00
f634962420
Merge pull request #2594 from frack113/red_20220123
...
Windows Redcannary tests
2022-01-25 06:20:53 +01:00
0d5618f8ef
Merge pull request #2593 from frack113/moonbounce
...
add win_pc_susp_instalutil
2022-01-25 06:20:38 +01:00
a6d1ca6c84
Add reEscape config to ElasticsearchEQLBackend
2022-01-24 16:52:59 -05:00
43690233fb
Merge pull request #2572 from zeronetworks/master
...
feat(rules): Adding rules for the rpc_firewall
2022-01-24 18:18:22 +01:00
f80f0d3696
rules: nircmd, nsudo, runx
2022-01-24 13:37:28 +01:00
d9193efda3
Merge pull request #2597 from SigmaHQ/rule-devel
...
AdvancedRun and Bugfix
2022-01-24 12:39:51 +01:00
9505a761e1
fix: bug in rule - missing backspace
2022-01-24 11:54:58 +01:00
4be9a6c3ad
Add win_re_blackbyte_ransomware
2022-01-24 10:03:52 +01:00
db2946b174
Merge pull request #2592 from zakibro/master
...
Adding new linux auditd rule - Disable Dystem Firewall
2022-01-24 07:42:29 +01:00
2dc0c2a8a9
fix field name case
2022-01-23 19:12:12 +01:00
f1959f25d7
Windows Redcannary
2022-01-23 16:37:59 +01:00
097704d834
add win_pc_susp_instalutil
2022-01-23 14:47:25 +01:00
1b8fa21be1
Fix space
2022-01-23 11:40:35 +01:00
90334e7f7c
Redcannary windows test
2022-01-23 11:37:01 +01:00
31e38623de
Update win_susp_curl_fileupload
2022-01-23 11:35:36 +01:00
41baa3c4c5
fix(rules): misshap in "test_rules", and also updated the splunk-windows.yml configuration
2022-01-23 10:35:46 +02:00
2c6b779fa3
fix(rules): misshap in "test_rules", and also updated the splunk-windows.yml configuration
2022-01-23 10:18:17 +02:00
83afc12875
fix(rules): changed "product" and "service" to suggested values.
2022-01-23 09:44:24 +02:00
bbdfb79bc0
Adding new linux auditd rule - Disable Dystem Firewall
2022-01-22 15:12:24 +01:00
dfc477888b
Merge pull request #2583 from BlackB0lt/patch-22
...
Create lnx_doas_conf_creation.yml
2022-01-21 18:44:08 +01:00
2eeee78466
Merge pull request #2582 from BlackB0lt/patch-21
...
Create lnx_doas_execution.yml
2022-01-21 18:43:57 +01:00
5f71d21dc0
Merge pull request #2589 from frack113/discussions_2584
...
Move windows internal services to builtin
2022-01-21 18:39:32 +01:00
7dabe5e7a8
Merge pull request #2591 from frack113/colorcpl
...
add win_fe_susp_colorcpl
2022-01-21 17:47:52 +01:00
978381000f
Merge pull request #2588 from frack113/order_folder
...
Order rules
2022-01-21 17:47:09 +01:00
dbed9e603c
Merge pull request #2590 from frack113/aurora_fp
...
Fix FP win_susp_proc_access_lsass.yml
2022-01-21 17:46:31 +01:00
97f4bda4bc
add win_fe_susp_colorcpl
2022-01-21 14:16:35 +01:00
6eeb0723ed
Fix FP thanks aurora
2022-01-21 13:14:35 +01:00
7053d42e43
move to builtin
2022-01-21 11:59:13 +01:00
eb22807ddc
Order rules
2022-01-20 22:06:55 +01:00
137fc39c54
Merge pull request #2578 from frack113/red_20220119
...
Add Redcannary Windows Rules
2022-01-20 18:03:04 +01:00
f3e77a6555
Merge pull request #2587 from frack113/order_application
...
Order application folder
2022-01-20 18:02:16 +01:00
929711f5c1
fix(rules): missed stuff from previous fix
2022-01-20 17:27:47 +02:00
frack113