 Karneades
|
eb690d8902
|
Remove too loose filter in mshta rule
|
2019-04-04 22:16:24 +02:00 |
|
|
Florian Roth
|
81693d81b6
|
Merge pull request #295 from sbousseaden/master
Create win_atsvc_task.yml
|
2019-04-04 18:32:13 +02:00 |
|
|
sbousseaden
|
c4b8f75940
|
Update win_lm_namedpipe.yml
|
2019-04-04 18:22:50 +02:00 |
|
|
sbousseaden
|
22958c45a3
|
Update win_GPO_scheduledtasks.yml
|
2019-04-03 21:50:55 +02:00 |
|
|
sbousseaden
|
b4ac9a432f
|
Update win_susp_psexec.yml
|
2019-04-03 21:50:25 +02:00 |
|
|
sbousseaden
|
353e457104
|
Update win_lm_namedpipe.yml
|
2019-04-03 21:49:58 +02:00 |
|
|
sbousseaden
|
d5818a417b
|
Update win_impacket_secretdump.yml
|
2019-04-03 21:49:30 +02:00 |
|
|
sbousseaden
|
9c5575d003
|
Update win_atsvc_task.yml
|
2019-04-03 21:48:38 +02:00 |
|
|
sbousseaden
|
edb98f2781
|
Update win_account_discovery.yml
|
2019-04-03 21:40:59 +02:00 |
|
|
Florian Roth
|
13f86e9333
|
Merge pull request #296 from Karneades/patch-1
Remove backslashes in CommandLine for sticky key rule
|
2019-04-03 19:44:02 +02:00 |
|
|
yt0ng
|
e0459cec1c
|
renamed file
|
2019-04-03 17:39:17 +02:00 |
|
|
t0x1c-1
|
7e058e611c
|
WMI spawning PowerShell seen in various attacks
|
2019-04-03 16:56:45 +02:00 |
|
|
Unknown
|
9ada22b8e0
|
adjusted link
|
2019-04-03 16:40:18 +02:00 |
|
|
Unknown
|
d2e605fc5c
|
Auto stash before rebase of "Neo23x0/master"
|
2019-04-03 16:25:18 +02:00 |
|
|
Karneades
|
865d971704
|
Remove backslashes in CommandLine for sticky key rule
Example command line is exactly "cmd.exe sethc.exe 211".
=> the detection with *\cmd.exe... would not match.
|
2019-04-03 16:16:18 +02:00 |
|
|
sbousseaden
|
eda5298457
|
Create win_account_backdoor_dcsync_rights.yml
|
2019-04-03 16:16:05 +02:00 |
|
|
sbousseaden
|
0756b00cdf
|
Create win_susp_psexec.yml
|
2019-04-03 15:59:46 +02:00 |
|
|
sbousseaden
|
9c1a5a5264
|
Create win_lm_namedpipe.yml
|
2019-04-03 15:48:42 +02:00 |
|
|
sbousseaden
|
56b68a0266
|
Create win_GPO_scheduledtasks.yml
|
2019-04-03 15:36:24 +02:00 |
|
|
sbousseaden
|
b941f6411f
|
Create win_impacket_secretdump.yml
|
2019-04-03 15:18:42 +02:00 |
|
|
sbousseaden
|
516c8f3ea1
|
Create win_account_discovery.yml
|
2019-04-03 14:41:11 +02:00 |
|
|
sbousseaden
|
3d69727332
|
Create sysmon_rdp_settings_hijack.yml
|
2019-04-03 14:16:25 +02:00 |
|
|
sbousseaden
|
016261cacf
|
Update sysmon_lsass_memdump.yml
|
2019-04-03 14:06:49 +02:00 |
|
|
sbousseaden
|
a85c668f6f
|
Update sysmon_lsass_memdump.yml
|
2019-04-03 14:00:51 +02:00 |
|
|
sbousseaden
|
d62bc41bfb
|
Create win_svcctl_remote_service.yml
|
2019-04-03 13:58:20 +02:00 |
|
|
sbousseaden
|
32c6b34746
|
Create sysmon_lsass_memdump.yml
|
2019-04-03 13:51:59 +02:00 |
|
|
sbousseaden
|
548145ce10
|
Create win_susp_raccess_sensitive_fext.yml
|
2019-04-03 13:22:42 +02:00 |
|
|
sbousseaden
|
ddb2d92a98
|
Create sysmon_tsclient_filewrite_startup.yml
|
2019-04-03 13:19:59 +02:00 |
|
|
sbousseaden
|
e3f99c323b
|
Create win_atsvc_task.yml
|
2019-04-03 13:08:12 +02:00 |
|
|
Thomas Patzke
|
8e854b06f6
|
Specified source to prevent EventID collisions
Issue #263
|
2019-04-01 23:45:55 +02:00 |
|
|
Florian Roth
|
e473efb7c3
|
Trying to fix ATT&CK framework tag
|
2019-04-01 10:36:35 +02:00 |
|
|
Florian Roth
|
3f2ce4b71f
|
Lowered level to medium
|
2019-04-01 09:47:14 +02:00 |
|
|
t0x1c-1
|
51c42a15a7
|
Allow Incoming Connections by Port or Application on Windows Firewall
|
2019-04-01 08:16:56 +02:00 |
|
|
Florian Roth
|
ffac77fb37
|
Rule: extended LockerGoga description
|
2019-03-22 11:03:48 +01:00 |
|
|
Florian Roth
|
1adb040e0b
|
Rule: LockerGoga
|
2019-03-22 10:59:31 +01:00 |
|
|
Florian Roth
|
2ad2ba9589
|
fix: rule field fix in proc_creation rule
|
2019-03-22 10:59:18 +01:00 |
|
|
Thomas Patzke
|
be25aa2c37
|
Added CAR tags
|
2019-03-16 00:37:09 +01:00 |
|
|
Thomas Patzke
|
8512417de0
|
Incorporated MITRE CAR mapping from #55
|
2019-03-16 00:03:27 +01:00 |
|
|
yugoslavskiy
|
33db032a16
|
added missed service
|
2019-03-14 00:44:26 +01:00 |
|
|
Florian Roth
|
95b47972f0
|
fix: transformed rule to new proc_creation format
|
2019-03-12 09:03:30 +01:00 |
|
|
Florian Roth
|
c4003ff410
|
Merge pull request #264 from darkquasar/master
adding rule win-susp-mshta-execution.yml
|
2019-03-11 23:50:56 +01:00 |
|
|
Yugoslavskiy Daniil
|
5d54e9c8a1
|
nbstat.exe -> nbtstat.exe
|
2019-03-11 19:28:29 +01:00 |
|
|
Yugoslavskiy Daniil
|
c22265c655
|
updated detection logic
|
2019-03-11 16:58:57 +01:00 |
|
|
Tareq AlKhatib
|
783d8c4268
|
Reverting back to regular Sysmon 1 to fix CI test
|
2019-03-09 21:31:56 +03:00 |
|
|
Tareq AlKhatib
|
075df83118
|
Converted to use the new process_creation data source
|
2019-03-09 20:57:59 +03:00 |
|
|
Thomas Patzke
|
3c1948f089
|
Merge pull request #277 from megan201296/patch-18
Remove invalid link
|
2019-03-07 23:49:13 +01:00 |
|
|
Yugoslavskiy Daniil
|
475113b1c1
|
fixed incorrect date format
|
2019-03-07 22:52:11 +01:00 |
|
|
megan201296
|
c2a16591af
|
Remove invalid link
Cybereason link was broken. Couldn't find anything with a super similar file path. The below link might be a valid replacement but went better safe than sorry and just removed it completely. https://www.cybereason.com/hubfs/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty-Part1.pdf
|
2019-03-07 14:22:29 -06:00 |
|
|
Florian Roth
|
83c0c71bc7
|
Reworked for process_creation rules
|
2019-03-06 17:09:43 +01:00 |
|
|
Yugoslavskiy Daniil
|
cb7243de5d
|
fixed wrong tags
|
2019-03-06 06:18:38 +01:00 |
|