9647183716
Updating azure federation modified
...
* Set logsource service to auditlogs instead of signinlogs
* Add reference to Microsoft documentation
* Set field name in selection to ActivityDisplayName instead of properties.message
2022-06-08 17:17:26 +02:00
1abfc46f6f
fix: casing of OriginalFileName
2022-06-08 17:14:49 +02:00
c9a5747fc4
rule: archiver > iso/img phishing indicator
2022-06-08 16:30:17 +02:00
04bcbcdb44
Minor change, filter param should not be a list
2022-06-08 06:58:19 -07:00
61df0b9218
Update with suggested changes
2022-06-08 06:47:30 -07:00
879ea39b6d
Add file_event_win_susp_diagcab
2022-06-08 13:39:49 +02:00
09e31d2045
update with command field
2022-06-07 10:45:05 -07:00
8a59eb594e
Add rule for ECS backdoors
2022-06-07 10:36:31 -07:00
47ddf23b66
Merge pull request #3104 from rachelrice/ec2_startup_script
...
Update selection_source for AWS ec2 startup script rule
2022-06-07 18:30:17 +02:00
8026797113
Merge pull request #3106 from nasbench/master
...
Update proc_creation_win_tool_nsudo_as_system.yml
2022-06-07 18:24:53 +02:00
ba91bb42e5
Merge pull request #3105 from secDre4mer/master
...
feat: new rule for persistence using Office startup
2022-06-07 18:13:12 +02:00
7b8c4e2a78
Update proc_creation_win_tool_nsudo_execution.yml
2022-06-07 17:00:35 +01:00
61ad8ddb62
docs: reworked id, author, links
2022-06-07 17:09:06 +02:00
e4fb5d6fb9
Update proc_creation_win_tool_nsudo_execution.yml
2022-06-07 14:51:25 +01:00
452bf6424e
Renamed file to reflect broader meaning
2022-06-07 14:46:38 +01:00
093f738d41
Update proc_creation_win_tool_nsudo_as_system.yml
2022-06-07 14:39:29 +01:00
c32e0b27a5
feat: new rule for persistence using Office startup
2022-06-07 14:25:52 +01:00
db58345bc6
Update selection_source for AWS ec2 startup script rule
...
The JSON payload for `ModifyInstanceAttribute` event currently looks like:
```
"requestParameters": {
"attribute": "userData",
...
},
```
Updating the selection_source from `requestParameters.userData: "*"` to `requestParameters.attribute: "userData"` accordingly.
Signed-off-by: Rachel Rice <rachel.rice@lacework.net >
2022-06-07 13:20:08 +01:00
d57b32c99c
Merge pull request #3103 from SigmaHQ/rule-devel
...
Network rules refactoring, 1 new DNS rule
2022-06-07 12:48:34 +02:00
f16dc71e2a
Merge pull request #3101 from nasbench/master
...
New/Update Rules
2022-06-07 11:11:10 +02:00
21c363cec9
Merge pull request #3102 from securepeacock/patch-25
...
Create proc_creation_lnx_nohup.yml
2022-06-07 10:47:34 +02:00
69ff1837f4
Merge pull request #3064 from BlackB0lt/patch-28
...
Create registry_set_cve_2022_30190_msdt_follina.yml
2022-06-07 10:47:12 +02:00
394e29f504
Merge pull request #3092 from hazedav/lacework-subexp
...
fix(backend): use subexp when OR list items
2022-06-07 10:46:29 +02:00
cc67d69360
Merge pull request #3100 from hazedav/dd-endswith
...
fix(rule): lnx_dd_file_overwrite /bin symlinks
2022-06-07 10:45:56 +02:00
d3d5f4faea
Update web_susp_windows_path_uri.yml
2022-06-07 10:45:06 +02:00
c7b5eb65b0
Update proc_creation_win_renamed_plink.yml
2022-06-07 10:43:23 +02:00
5ab51d0b9a
Merge branch 'master' into rule-devel
2022-06-07 10:40:33 +02:00
3086226bf8
extended list of domains
2022-06-07 10:36:43 +02:00
9d4822b400
Update proc_creation_lnx_nohup.yml
2022-06-07 10:35:08 +02:00
de4cde1b97
rule: external service interaction domains
2022-06-07 10:30:38 +02:00
04f1480814
refactor: network "other" to "dns" and "firewall"
2022-06-07 10:30:21 +02:00
e7b47c9069
Create proc_creation_lnx_nohup.yml
2022-06-06 23:22:50 -04:00
17fff52ae2
Merge pull request #3099 from frack113/word_startup
...
Add file_event_win_susp_winword_startup
2022-06-06 22:25:58 +02:00
7327dd53e5
New/Update Rules
...
- Renamed "sql_injection_keywords.yml" to "web_sql_injection_keywords.yml" to conform with the rest of the rule in the WEB directory
- Renamed "xss_keywords.yml" to "web_xss_keywords.yml" to conform with the rest of the rule in the WEB directory
- Renamed "proc_create_win_msdt_susp_parent.yml" to "proc_creation_win_msdt_susp_parent.yml" to conform with other process creation rules
- Renamed "proc_create_win_sdiagnhost_susp_child.yml" to "proc_creation_win_sdiagnhost_susp_child.yml" to conform with other process creation rules
- Moved the rule "win_powershell_snapins_hafnium.yml" to process_creation folder instead of the WEB folder
- Created "web_susp_windows_path_uri.yml" to detect URI that contains susp windows paths
- Updated the description "web_webshell_keyword.yml" and added 3 more cases
- Created "file_event_win_cve_2021_44077_poc_default_files.yml" to detect the default dropped file from the POC of CVE-2021-44077 (Showcased in the DFIR report)
- Created "proc_creation_win_renamed_plink.yml" to detect renamed usage of "Plink"
2022-06-06 21:16:52 +01:00
a98e88b722
Filter valid ext
2022-06-06 21:51:15 +02:00
eb9afc3897
Merge pull request #3095 from frack113/web_jav_uri
...
add web_java_in_access_log
2022-06-06 20:41:06 +02:00
3b4ad16c5f
refactor: new expr from honeypot, increased level
2022-06-06 17:32:08 +02:00
bc26970596
fix(rule): lnx_dd_file_overwrite /bin symlinks
...
This rule is subject to false negatives for *nix distros which
alias /bin to /usr/bin. By using endswith we can catch dd usage
for either /bin or /usr/bin.
2022-06-06 09:27:27 -05:00
ae93919e95
Add file_event_win_susp_winword_startup
2022-06-05 10:29:17 +02:00
6b34764215
Merge pull request #3097 from frack113/user32
...
Add proc_creation_win_susp_rundll32_user32_dll
2022-06-04 18:35:56 +02:00
fe34a5fd68
Merge pull request #3096 from frack113/redcanary_20220604
...
Add posh_ps_get_gpo
2022-06-04 18:35:14 +02:00
b3d9706014
Update web_java_in_access_log.yml
2022-06-04 15:21:04 +02:00
f4c61c58f6
Update web_java_in_access_log.yml
2022-06-04 13:39:36 +02:00
1e64a05fde
Update proc_creation_win_susp_rundll32_user32_dll.yml
2022-06-04 13:29:37 +02:00
527d90f2b4
Merge pull request #3098 from SigmaHQ/aurora-false-positive-fixing
...
Aurora false positive fixing
2022-06-04 13:26:19 +02:00
c0c9bdb8f7
fix: missing selection in condition
2022-06-04 12:52:30 +02:00
7bd4d68580
Merge branch 'master' into aurora-false-positive-fixing
2022-06-04 12:52:14 +02:00
6d9587dab2
fix: Aurora FPs / NVidia driver update
2022-06-04 12:44:51 +02:00
e4499caa4e
Add proc_creation_win_susp_rundll32_user32_dll
2022-06-04 11:48:44 +02:00
79d284ab51
Add posh_ps_get_gpo
2022-06-04 11:08:22 +02:00
FlorianBracq