ec17c2ab56
filter on createkey only when needed
2020-05-22 10:37:00 -04:00
0dd089db47
various rules cleaning
2020-05-18 20:29:53 -04:00
96fae4be68
Added CrachMapExec rules
2020-05-22 00:50:37 +02:00
64e0e7ca72
Merge pull request #784 from Neo23x0/rule-devel
...
refactor: slightly improved Greenbug rule
2020-05-21 14:19:09 +02:00
91c4c4ecc5
refactor: slightly improved Greenbug rule
2020-05-21 13:38:11 +02:00
bbf78374b6
Merge pull request #783 from Neo23x0/rule-devel
...
Greenbug Rule
2020-05-21 09:55:46 +02:00
9a3b6c1c77
docs: added MITRE ATT&CK group tag
2020-05-21 09:44:11 +02:00
344eb713c5
rule: Greenbug campaign
2020-05-21 09:39:57 +02:00
8d9b706d6a
Merge pull request #727 from 3CORESec/master
...
Override Features
2020-05-20 19:11:56 +02:00
e7980bb434
Merge pull request #782 from ZikyHD/patch-1
...
Remove duplicate 'CommandLine' in fields
2020-05-20 12:55:41 +02:00
af92a5bd2c
Merge pull request #780 from tatsu-i/master
...
Null field check to eliminate false positives
2020-05-20 12:55:29 +02:00
8963c0a65e
Remove duplicate 'CommandLine' in fields
2020-05-20 11:54:47 +02:00
9ab65cd1c7
Update win_alert_ad_user_backdoors.yml
2020-05-19 14:50:22 +02:00
7c3dea22b8
small T, big T
2020-05-19 05:13:48 -04:00
602c8917ef
domain user enumeration via zeek rpc (dce_rpc) log.
2020-05-19 05:08:26 -04:00
c815773b1a
enhancement rule
2020-05-19 18:05:51 +09:00
49f68a327a
enhancement rule
2020-05-19 18:00:50 +09:00
effb2a8337
add exe webdav download
2020-05-19 04:41:00 -04:00
858ebcd3d3
author typo update
2020-05-19 04:35:47 -04:00
2fc8d513d6
zeek, swap path and name
2020-05-19 04:35:30 -04:00
1aa97fe577
flake 8
2020-05-18 10:03:18 -04:00
088800cd18
fix rule due to sigmac bug?
2020-05-18 09:39:48 -04:00
e89613aee0
add some false positives checks
2020-05-18 07:19:06 -04:00
8154ca355a
Merge pull request #768 from maximelb/master
...
Remove "condition" from global rule in CVE-2020-1048.
2020-05-18 12:52:49 +02:00
25d3a5a893
Remove "condition" from global rule.
...
The condition field in this rule was in the global section which overwrote the condition in sub-rules and generated FPs. For example, once Sigma read the rule, the bottom sub-rule's "condition" was overwritten with "1 of them".
2020-05-17 12:44:57 -07:00
a46e357874
Merge branch 'master' into rule-devel
2020-05-16 08:59:34 +02:00
d5e7d4e302
fix: missing condition in CVE-2020-1048 rule
2020-05-16 08:59:05 +02:00
fd386fe8eb
standardize rules with Image and CommandLine instead of NewProcessName and ProcessCommandLine
2020-05-15 12:35:32 -04:00
7b713fbe7f
rule: OpenSSHd rule adjusted
2020-05-15 17:19:32 +02:00
0575fa8d81
fix CVE 2020-1048 rule
2020-05-15 07:25:05 -04:00
cc26b26377
Merge branch 'master' into rule-devel
...
# Conflicts:
# rules/windows/sysmon/sysmon_cve-2020-1048.yml
2020-05-15 12:09:47 +02:00
8e7caf0e4d
rule: CVE-2020-1048
2020-05-15 12:08:31 +02:00
8e082283f0
Merge pull request #754 from Neo23x0/rule-devel
...
Rule devel
2020-05-15 12:07:04 +02:00
5854cc4677
fix: small bug in new CVE-2020-1048 rule
2020-05-15 11:37:46 +02:00
2282432b6f
Merge pull request #753 from hieuttmmo/master
...
New Sigma rule to detect possible CVE-2020-1048 exploitation and Suspicious network connection from Notepad
2020-05-15 11:35:12 +02:00
54cf535dbc
remove false positives with cmd as child of services.exe (not specifically related to meterpreter/cobaltstrike)
2020-05-15 04:45:25 -04:00
ab950fb89d
fix: removed rules missing in master
2020-05-14 15:53:09 +02:00
2893becf8c
Merge remote-tracking branch 'upstream/master'
2020-05-14 14:02:20 +01:00
e53a97fa2f
Update condition to filter out printer port
2020-05-14 18:22:49 +07:00
443bf09d27
Add author
2020-05-14 18:10:16 +07:00
e74970cea0
Suspicious network connection from notepad.exe
2020-05-14 18:08:30 +07:00
97b690d340
Change level from Critical to High
2020-05-14 09:02:54 +07:00
7652813c2c
Merge pull request #752 from zaphodef/fix/win_susp_script_execution_false_negatives
...
Widen the search as it gives too many false negatives
2020-05-13 21:02:12 +02:00
d0b1c98d5a
Reformat rule
2020-05-14 00:39:41 +07:00
3e5b33388b
New rule to detect possible CVE-2020-1048 exploitation
2020-05-14 00:24:36 +07:00
78a5c743f2
Widen the search as it gives too many false negatives
2020-05-13 16:20:23 +02:00
78a8266a1b
Merge pull request #749 from teddy-ROxPin/patch-6
...
Create win_advanced_ip_scanner.yml
2020-05-13 14:09:12 +02:00
220a14f31c
fix: typo in contains
2020-05-13 12:38:54 +02:00
a1856c5743
Update win_advanced_ip_scanner.yml
2020-05-13 11:56:25 +02:00
a9ef7ef382
Fix a bad CommandLine search
2020-05-13 11:32:05 +02:00
ecco