d34b4080d5
Update proc_creation_win_lolbin_wfc.yml
2022-06-02 13:47:11 +02:00
169b85f9ef
Update proc_creation_win_lolbin_visualuiaverifynative.yml
2022-06-02 13:43:01 +02:00
a4255091b9
Merge pull request #3066 from phantinuss/master
...
refining some rules for Follina
2022-06-02 13:40:27 +02:00
18482601f3
Update and rename proc_creation_win_lolbin_fsianycpu.yml to proc_creation_win_lolbin_fsharp_interpreters.yml
2022-06-02 01:35:41 -04:00
2a62b35fd6
Create proc_creation_win_lolbin_fsianycpu.yml
2022-06-02 01:30:48 -04:00
f1925b8b42
Create proc_creation_win_lolbin_remote.yml
...
Let me know if anything needs to be changed.
2022-06-02 01:02:22 -04:00
ac89d4c00a
Update proc_creation_win_lolbin_visualuiaverifynative.yml
2022-06-02 00:44:38 -04:00
f9cee726cb
Rename proc_creation_win_lolbin_VisualUiaVerifyNative.yml to proc_creation_win_lolbin_visualuiaverifynative.yml
2022-06-02 06:25:00 +02:00
2b599c07c6
Update and rename azure_app_device_code_authentication to azure_app_device_code_authentication.yml
2022-06-02 06:20:26 +02:00
2b3007f1d0
Create proc_creation_win_lolbin_VisualUiaVerifyNative.yml
2022-06-02 00:09:13 -04:00
17ad4a33da
Rename proc_creation_win_lolbin_wfc.exe.yml to proc_creation_win_lolbin_wfc.yml
2022-06-02 00:06:16 -04:00
60a10806e2
Create proc_creation_win_lolbin_wfc.exe.yml
2022-06-01 23:59:00 -04:00
e148de65bb
Merge branch 'SigmaHQ:master' into markmorow
2022-06-01 10:59:56 -07:00
e09221d9f7
Create azure_app_device_code_authentication
...
Adding Device Code flow authentication check
2022-06-01 10:59:03 -07:00
dec8b93296
Merge pull request #3075 from MarkMorow/markmorow
...
Markmorow
2022-06-01 19:06:27 +02:00
f79263fc3a
Merge pull request #3072 from pH-T/master
...
new rules
2022-06-01 18:56:53 +02:00
4114ceef65
Update azure_app_ropc_authentication.yml
...
Update Properities.message since it's one element.
2022-06-01 09:35:45 -07:00
e10fa684bd
Merge pull request #3074 from nasbench/master
...
Fix typo and quick update to "msdt" rule
2022-06-01 18:34:38 +02:00
90f22771a0
Merge pull request #3073 from Yochana-H/Yochana-H
...
Create azure_conditional_access_failure
2022-06-01 18:28:39 +02:00
375eeab4fa
Update azure_app_ropc_authentication.yml
2022-06-01 08:42:44 -07:00
fe64f81674
Create azure_app_ropc_authentication.yml
...
Adding ROPC Auth check
2022-06-01 08:41:43 -07:00
5fd61875dc
fix title case
2022-06-01 17:37:17 +02:00
6b0584ddd2
Update azure_conditional_access_failure.yml
2022-06-01 17:27:00 +02:00
c900315145
new rules accompanying Follina exploits
2022-06-01 17:22:11 +02:00
30225cab11
Update proc_creation_win_msdt.yml
...
- Add MITRE tag
2022-06-01 16:00:43 +01:00
7c9210a119
Update proc_creation_win_msdt.yml
2022-06-01 15:55:12 +01:00
6aad923023
Fix typo and Update Rule
...
- Fixed typo in PowerShell definition to "enabled"
- Removed leading space from "/af" flag in "msdt" rule as it can be used without leading space.
2022-06-01 15:54:40 +01:00
fb63c3292a
refining some rules for Follina
2022-06-01 14:44:40 +02:00
21da958f98
Delete azure_conditional_access_failure.txt
2022-06-01 12:58:34 +01:00
7f7bf54ba6
Merge branch 'master' of github.com:pH-T/sigma
2022-06-01 13:32:06 +02:00
322468b35b
fix: added detection
2022-06-01 13:31:57 +02:00
a0aff0f680
Update proc_creation_win_susp_base64_load.yml
2022-06-01 13:06:17 +02:00
b912a8a7c2
Merge branch 'Yochana-H' of https://github.com/Yochana-H/sigma into Yochana-H
2022-06-01 12:04:28 +01:00
8d8e74d44d
Create azure_conditional_access_failure.txt
...
Sign-In failures due to Conditional Access requirements not being met.
2022-06-01 12:04:24 +01:00
017813d3fa
new rules
2022-06-01 11:50:34 +02:00
eec0dfe821
Create azure_conditional_access_failure.txt
...
Sign-In failures due to Conditional Access requirements not being met.
2022-06-01 10:22:43 +01:00
587b5aa6a7
Merge pull request #3070 from leegengyu/patch-1
...
Update proc_creation_win_susp_conhost_option.yml - Remove Empty Reference Line
2022-06-01 06:34:51 +02:00
5ac620b555
Merge pull request #3069 from redsand/fp_UserInitMprLogonScript_citrix_icast
...
FP: citrix icast default userinit logon script.
2022-06-01 06:29:16 +02:00
8fa6f8f3e7
Merge pull request #3068 from nasbench/master
...
Update proc_creation_win_msdt.yml
2022-06-01 06:27:47 +02:00
da044e5cb8
Update proc_creation_win_susp_conhost_option.yml
...
Remove empty line reference.
2022-06-01 09:39:03 +08:00
6d68d5bfb0
FP: citrix icast default userinit logon script.
2022-05-31 21:53:13 +00:00
40f4ab328a
Update proc_creation_win_msdt.yml
...
- Added possible answer flag "/af" for possible execution with answer files.
- Removed the parent selection as it's already covered by the rule: 23daeb52-e6eb-493c-8607-c4f0246cb7d8
2022-05-31 21:48:01 +01:00
945f44ac45
Merge pull request #3062 from Corissalea/corissalea
...
Create azure_aad_secops _signin_failure_bad_password_threshold.yml
2022-05-31 20:50:12 +02:00
95a0263799
Rename azure_aad_secops _signin_failure_bad_password_threshold.yml to azure_aad_secops_signin_failure_bad_password_threshold.yml
2022-05-31 20:43:32 +02:00
cafc12e334
Update azure_aad_secops _signin_failure_bad_password_threshold.yml
2022-05-31 20:36:37 +02:00
9f115af449
Update azure_aad_secops _signin_failure_bad_password_threshold.yml
...
updated title to remove capital letters and replaced a tag with the proper MITRE tactic check.
2022-05-31 11:25:03 -05:00
6d868a1964
Merge pull request #3065 from nasbench/master
...
Update proc_creation_win_msdt.yml
2022-05-31 11:19:54 +02:00
9586863433
Update proc_creation_win_msdt.yml
2022-05-31 10:11:09 +01:00
14d81bae06
Update proc_creation_win_msdt.yml
2022-05-31 09:46:40 +01:00
1e16ed0090
Merge pull request #3055 from phantinuss/master
...
Rule Harmonization
2022-05-31 08:27:35 +02:00
phantinuss