eb9afc3897
Merge pull request #3095 from frack113/web_jav_uri
...
add web_java_in_access_log
2022-06-06 20:41:06 +02:00
3b4ad16c5f
refactor: new expr from honeypot, increased level
2022-06-06 17:32:08 +02:00
6b34764215
Merge pull request #3097 from frack113/user32
...
Add proc_creation_win_susp_rundll32_user32_dll
2022-06-04 18:35:56 +02:00
fe34a5fd68
Merge pull request #3096 from frack113/redcanary_20220604
...
Add posh_ps_get_gpo
2022-06-04 18:35:14 +02:00
b3d9706014
Update web_java_in_access_log.yml
2022-06-04 15:21:04 +02:00
f4c61c58f6
Update web_java_in_access_log.yml
2022-06-04 13:39:36 +02:00
1e64a05fde
Update proc_creation_win_susp_rundll32_user32_dll.yml
2022-06-04 13:29:37 +02:00
c0c9bdb8f7
fix: missing selection in condition
2022-06-04 12:52:30 +02:00
7bd4d68580
Merge branch 'master' into aurora-false-positive-fixing
2022-06-04 12:52:14 +02:00
6d9587dab2
fix: Aurora FPs / NVidia driver update
2022-06-04 12:44:51 +02:00
e4499caa4e
Add proc_creation_win_susp_rundll32_user32_dll
2022-06-04 11:48:44 +02:00
79d284ab51
Add posh_ps_get_gpo
2022-06-04 11:08:22 +02:00
6af060a91f
Add new string
2022-06-04 10:08:49 +02:00
e886b08755
add web_java_in_access_log
2022-06-04 08:46:14 +02:00
5c30acd2c9
Merge pull request #3093 from securepeacock/patch-24
...
Create proc_creation_lnx_susp_chmod_directories.yml
2022-06-04 06:38:53 +02:00
1641eddaeb
Create proc_creation_lnx_susp_chmod_directories.yml
2022-06-03 19:24:02 -04:00
16585591fd
Update registry_set_disable_fonction_user.yml
2022-06-03 21:58:28 +01:00
36e5400b39
Rules Update
...
- Updated "proc_creation_win_susp_wmic_security_product_uninstall" with more AV and CLI variants.
- Updated "egistry_set_disable_fonction_user" with more interesting registry locations
2022-06-03 20:29:59 +01:00
cdc06238cd
Merge pull request #3088 from pH-T/master
...
new rules for msdt cloaking
2022-06-03 17:09:44 +02:00
07628f6795
Update proc_creation_win_renamed_msdt.yml
2022-06-03 17:03:33 +02:00
c2c1a2dcb7
Merge pull request #3090 from frack113/refractor_condition
...
Refactor condition
2022-06-03 17:02:31 +02:00
1ba6dab453
Update proc_creation_win_renamed_msdt.yml
2022-06-03 15:42:43 +02:00
c79fd95f66
refactor condition
2022-06-03 15:39:41 +02:00
8de0027ca3
refactor condition
2022-06-03 15:35:24 +02:00
3ad0d1bc50
fix: FP and typo
2022-06-03 15:20:07 +02:00
8bdd2562fb
fix: avoid regex, not actually needed
2022-06-03 14:55:09 +02:00
1cb985487c
windows and linux python pty spawning
2022-06-03 12:17:33 +02:00
984b0e553c
chore: reduce rule level
2022-06-03 12:17:33 +02:00
30cc5f4623
new rule for office directory traversal
2022-06-03 12:17:33 +02:00
79cc5f73ea
add more suspicious child processes / relevant parent processes
2022-06-03 12:17:33 +02:00
f9b895759b
new rules for msdt cloaking
2022-06-03 12:14:14 +02:00
2c1fd87a27
Merge pull request #3087 from nasbench/master
...
Atlassian Confluence CVE 2022 26134
2022-06-03 10:55:01 +02:00
777b123ad0
Update proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
2022-06-03 08:38:24 +01:00
b2b070b516
Quick Update
2022-06-03 08:31:53 +01:00
66e0c405c8
Update proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
2022-06-03 08:09:14 +01:00
bb41bb6905
Update proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
2022-06-03 01:25:59 +01:00
8f947693ec
Update proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
2022-06-03 01:24:09 +01:00
0a0418615c
Create proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
2022-06-03 01:13:40 +01:00
e8c70a05d1
Create azure_app_owner_added.yml
...
Added checking for new application owner.
2022-06-02 13:37:00 -07:00
fd5eb53e1d
Create azure_app_appid_uri_changes.yml
...
Adding AppID URI changes check
2022-06-02 09:46:23 -07:00
0db42c0ca6
Merge pull request #3080 from securepeacock/patch-20
...
Create proc_creation_win_lolbin_fsianycpu.yml
2022-06-02 17:22:00 +02:00
c9be1b917e
Merge pull request #3083 from MarkMorow/markmorow
...
Create azure_app_uri_modifications.yml
2022-06-02 17:21:36 +02:00
50d1093677
Merge pull request #3082 from secDre4mer/master
...
feat: Add rule for renamed browser core execution
2022-06-02 17:17:42 +02:00
294c71ebde
Update proc_creation_win_lolbin_fsharp_interpreters.yml
2022-06-02 17:15:15 +02:00
419fb2e8b9
Merge pull request #3079 from securepeacock/patch-19
...
Create proc_creation_win_lolbin_remote.yml
2022-06-02 17:14:02 +02:00
55666836e6
Create azure_app_uri_modifications.yml
...
Adding Application URI changes
2022-06-02 06:44:35 -07:00
d849ece51e
feat: Add rule for renamed browser core execution
2022-06-02 14:17:02 +01:00
7811a79833
Update proc_creation_win_lolbin_fsharp_interpreters.yml
2022-06-02 09:01:07 -04:00
26838d9b0d
Update proc_creation_win_lolbin_remote.yml
2022-06-02 09:00:22 -04:00
fd28f0b04e
Merge branch 'SigmaHQ:master' into master
2022-06-02 13:39:23 +01:00
Florian Roth