 Florian Roth
|
f00aaf8461
|
refactor: exclude case in which upper ticks are used
|
2021-09-09 12:55:10 +02:00 |
|
|
Florian Roth
|
6d86c7df6c
|
Revert "refactor: 2nd condition in CVE-2021-40444 rule"
This reverts commit 015573c450.
|
2021-09-09 09:41:03 +02:00 |
|
|
Florian Roth
|
015573c450
|
refactor: 2nd condition in CVE-2021-40444 rule
|
2021-09-09 09:33:45 +02:00 |
|
|
Florian Roth
|
2777187fd9
|
docs: changed level and reference in CVE-2021-40444 rule
|
2021-09-09 08:46:34 +02:00 |
|
|
Florian Roth
|
36a5d7ec04
|
CVE-2021-40444 false positives
|
2021-09-09 08:12:36 +02:00 |
|
|
Florian Roth
|
b1540d65b9
|
refactor: simplified rule
|
2021-09-08 17:35:50 +02:00 |
|
|
Florian Roth
|
e388bc6bfa
|
remove unsupported tag
|
2021-09-08 16:56:04 +02:00 |
|
|
Florian Roth
|
c9b4f5d326
|
CVE-2021-40444
|
2021-09-08 16:49:49 +02:00 |
|
|
Florian Roth
|
1a55f4a294
|
filter: empty thumbprint, PetitPotam rule
|
2021-09-07 14:37:03 +02:00 |
|
|
Florian Roth
|
cfbde22d2d
|
rule: PRIVATELOG image load
|
2021-09-07 10:10:14 +02:00 |
|
|
Florian Roth
|
3a305e82b9
|
fix: remove renamed files
|
2021-09-07 09:28:20 +02:00 |
|
|
Florian Roth
|
a8d8d878a0
|
remove uppercase files
|
2021-09-07 09:27:11 +02:00 |
|
|
Florian Roth
|
8b4fce3473
|
removed unneeded upper ticks
|
2021-09-07 09:21:44 +02:00 |
|
|
Florian Roth
|
c082ce0fe0
|
Merge branch 'master' into rule-devel
|
2021-09-07 09:20:47 +02:00 |
|
|
Florian Roth
|
57bfdc7a02
|
fix: more upper case chars
|
2021-09-07 09:19:23 +02:00 |
|
|
Florian Roth
|
0cce1c0245
|
fix: missing lowercase chars
|
2021-09-07 09:17:25 +02:00 |
|
|
Florian Roth
|
33be089ea2
|
fix: filename to lowercase
|
2021-09-07 09:16:35 +02:00 |
|
|
Florian Roth
|
6b2bacd2cc
|
Merge pull request #1979 from frack113/test_global
Change ID in global action rule
|
2021-09-06 08:44:14 +02:00 |
|
|
frack113
|
44a5792be3
|
Revert win_apt_apt29_tor.yml
|
2021-09-05 12:34:24 +02:00 |
|
|
frack113
|
ca4c156fa4
|
Update win_apt_apt29_tor.yml
|
2021-09-05 11:20:57 +02:00 |
|
|
frack113
|
acf2bfbd27
|
Update sigma_uuid verify
Make a better verify code
|
2021-09-05 10:43:42 +02:00 |
|
|
Austin Songer
|
fa5554660c
|
Update sysmon_mal_cobaltstrike_re.yml
|
2021-09-04 17:33:05 -05:00 |
|
|
frack113
|
6780182c37
|
Merge pull request #1974 from frack113/tags_pack2
Add missing Tags
|
2021-09-03 19:13:32 +02:00 |
|
|
frack113
|
688df3405a
|
Merge pull request #1970 from frack113/red_T1564.004_1
Redcanary t1564.004 ADS test 1
|
2021-09-03 19:06:51 +02:00 |
|
|
frack113
|
77c6b74c72
|
Merge pull request #1985 from mvelazc0/master
Adding Petitpotam/ADCS attack vector detections
|
2021-09-03 19:06:03 +02:00 |
|
|
mvelazco
|
a7a002cb7f
|
updating fields as per frack113 feedback
|
2021-09-03 10:01:54 -04:00 |
|
|
phantinuss
|
aa2e86963c
|
fix: rename filter
|
2021-09-03 13:26:34 +02:00 |
|
|
phantinuss
|
f3bdb0e43d
|
fix: remove unneeded selection
|
2021-09-03 13:26:23 +02:00 |
|
|
phantinuss
|
2de2de8433
|
Addition to UAC Bypasses
|
2021-09-03 13:26:11 +02:00 |
|
|
ncrqnt
|
adc3c9e608
|
fixed date: switched day/month
|
2021-09-03 12:03:38 +02:00 |
|
|
frack113
|
1fc2a39720
|
Merge pull request #1975 from frack113/red_T1564.004_2
Redcanary t1564.004 test 2
|
2021-09-03 08:12:08 +02:00 |
|
|
frack113
|
11e4b900e4
|
Update global id
|
2021-09-03 06:59:40 +02:00 |
|
|
frack113
|
135d0a2c61
|
Update global id
|
2021-09-03 06:50:00 +02:00 |
|
|
frack113
|
a6bb5574fb
|
Update global id
|
2021-09-03 06:35:35 +02:00 |
|
|
mvelazco
|
ba41e922d2
|
adding Petitpotam host detections
|
2021-09-03 00:12:49 -04:00 |
|
|
frack113
|
d02ee1eddd
|
Update global ID
|
2021-09-02 21:16:55 +02:00 |
|
|
frack113
|
f90c7558a7
|
update global id
|
2021-09-02 21:03:25 +02:00 |
|
|
frack113
|
ac90ee0002
|
Update global ID
|
2021-09-02 20:23:23 +02:00 |
|
|
frack113
|
086a15fc45
|
Update global ID
|
2021-09-02 20:07:03 +02:00 |
|
|
frack113
|
9bcefc6a93
|
move uuid from global
|
2021-09-02 16:05:05 +02:00 |
|
|
frack113
|
b731c20594
|
Merge pull request #1971 from phantinuss/master
fix: prevent possible FPs
|
2021-09-02 15:34:46 +02:00 |
|
|
frack113
|
a048403089
|
Merge pull request #1973 from klingerko/cs_namedpipe_updates
Remove duplicate and regex improvements
|
2021-09-02 15:25:01 +02:00 |
|
|
phantinuss
|
ab721c736c
|
chore: move level/falsepositives to bottom
|
2021-09-02 14:55:17 +02:00 |
|
|
klingerko
|
15e25f9635
|
update modifed date
|
2021-09-02 14:50:14 +02:00 |
|
|
phantinuss
|
0b373ff1e9
|
fix: remove 2nd selection due to FPs
|
2021-09-02 14:47:47 +02:00 |
|
|
frack113
|
6a1b95d947
|
Findstr covert by win_susp_findstr.yml
|
2021-09-02 14:22:59 +02:00 |
|
|
frack113
|
aaa568ff2d
|
print covert by win_susp_print.yml
|
2021-09-02 14:18:38 +02:00 |
|
|
phantinuss
|
5cb6eed52e
|
fix: remove single value lists
|
2021-09-02 14:09:03 +02:00 |
|
|
phantinuss
|
f4a5df67ae
|
further narrowing down of the selection, therefore removing the filter
|
2021-09-02 10:28:01 +02:00 |
|
|
frack113
|
90e673e5ac
|
fix invalid tags
|
2021-09-02 10:17:50 +02:00 |
|