 WojciechLesicki
|
6c86500414
|
Description changes acording to https://github.com/SwiftOnSecurity/sysmon-config/pull/151
|
2021-10-18 21:34:05 +02:00 |
|
|
frack113
|
a8a0d546f3
|
Merge pull request #2113 from austinsonger/process_creation_lolbins_suspicious_driver_install_by_pnputil.yml
process_creation_lolbins_suspicious_driver_installed_by_pnputil.yml
|
2021-10-17 08:10:18 +01:00 |
|
|
frack113
|
5756888b1b
|
adds the alternative options
|
2021-10-17 08:33:32 +02:00 |
|
|
frack113
|
e5b3a1cc14
|
Merge pull request #2151 from frack113/ps_category
Powershell category
|
2021-10-17 07:15:31 +01:00 |
|
|
frack113
|
94fe989f11
|
Merge pull request #2139 from phantinuss/providername
Introducing the field 'Provider Name' for Windows Eventlog Log Sources
|
2021-10-16 18:05:10 +01:00 |
|
|
frack113
|
4149fa8632
|
change to category: ps_classic_*
|
2021-10-16 08:26:51 +02:00 |
|
|
frack113
|
f6b0a89161
|
change to category: ps_script
|
2021-10-16 08:18:49 +02:00 |
|
|
frack113
|
0ca16b18f4
|
Change to category: ps_module
|
2021-10-16 08:05:15 +02:00 |
|
|
frack113
|
cb98a63453
|
Merge pull request #2150 from austinsonger/gcp-cloudsql
gcp_sql_database_modified_or_deleted.yml
|
2021-10-16 06:24:46 +01:00 |
|
|
austinsonger
|
7fc1c50901
|
gcp_sql_database_modified_or_deleted.yml
|
2021-10-15 18:53:45 -05:00 |
|
|
frack113
|
2930c1624c
|
Merge pull request #2142 from austinsonger/aws
Aws
|
2021-10-15 08:17:24 +01:00 |
|
|
Austin Songer
|
7ad0887704
|
Update passed_role_to_glue_development_endpoint.yml
|
2021-10-14 12:10:48 -05:00 |
|
|
Austin Songer
|
70b55f2c2d
|
Update aws_lambda_function_created_or_invoked.yml
|
2021-10-14 12:10:29 -05:00 |
|
|
frack113
|
87f2326402
|
Merge pull request #2133 from hieuttmmo/master
Sigma Rules for Privileged Accounts Activities Monitoring in Azure
|
2021-10-14 16:53:53 +01:00 |
|
|
Florian Roth
|
7e02555e22
|
refactor: credential dumper level increased
|
2021-10-14 14:24:56 +02:00 |
|
|
frack113
|
c202d39acd
|
Merge pull request #2138 from frack113/conti_ransomware
Conti ransomware commandline
|
2021-10-14 06:31:36 +01:00 |
|
|
Austin Songer
|
40879252a8
|
Update aws_lambda_function_created_or_invoked.yml
|
2021-10-13 16:25:28 -05:00 |
|
|
Austin Songer
|
f7dba3fbff
|
Update passed_role_to_glue_development_endpoint.yml
|
2021-10-13 12:34:16 -05:00 |
|
|
Austin Songer
|
503a4bc72b
|
Update and rename aws_pass_role_to_lambda_function.yml to aws_lambda_function_created_or_invoked.yml
|
2021-10-13 12:27:24 -05:00 |
|
|
frack113
|
1e0fde6975
|
Merge pull request #2135 from austinsonger/onelogin
Onelogin Rules
|
2021-10-13 16:35:27 +01:00 |
|
|
phantinuss
|
7c8a735882
|
fix: change modifed date
|
2021-10-13 14:22:48 +02:00 |
|
|
phantinuss
|
5c3cdbe845
|
fix: replace space with _
|
2021-10-13 14:20:26 +02:00 |
|
|
Austin Songer
|
756d5b5aa6
|
Update onelogin_user_account_locked.yml
|
2021-10-13 07:02:01 -05:00 |
|
|
Austin Songer
|
4e43fce629
|
Update powershell_windows_firewall_profile_disabled.yml
|
2021-10-13 07:01:04 -05:00 |
|
|
Austin Songer
|
e08f6333b8
|
Update aws_pass_role_to_lambda_function.yml
|
2021-10-13 06:59:13 -05:00 |
|
|
Austin Songer
|
010b0e2868
|
Update passed_role_to_glue_development_endpoint.yml
|
2021-10-13 06:58:57 -05:00 |
|
|
Tran Trung Hieu
|
15c472ee19
|
Merge branch 'master' of https://github.com/hieuttmmo/sigma
|
2021-10-13 15:12:45 +04:00 |
|
|
Tran Trung Hieu
|
7c01710d9d
|
Change the service to the form service: azure._a_name_ and add falsepositives field
|
2021-10-13 15:12:36 +04:00 |
|
|
phantinuss
|
1099d40473
|
rename the field 'Provider Name' to 'Provider_Name'
|
2021-10-13 13:04:11 +02:00 |
|
|
phantinuss
|
3d8002a237
|
fix: Use 'Provider Name' for windows eventlog log sources
|
2021-10-13 11:40:24 +02:00 |
|
|
frack113
|
5aa62bd342
|
fix yml
|
2021-10-12 21:02:15 +02:00 |
|
|
frack113
|
37c637066b
|
add process_creation_conti_cmd_ransomware.yml
|
2021-10-12 20:57:12 +02:00 |
|
|
Austin Songer
|
40eed2ec59
|
Rename powershell_windows_firewall_disabled.yml to powershell_windows_firewall_profile_disabled.yml
|
2021-10-12 11:57:37 -05:00 |
|
|
Austin Songer
|
d273bc25ea
|
Create powershell_windows_firewall_disabled.yml
|
2021-10-12 11:56:37 -05:00 |
|
|
Austin Songer
|
9faca2f3dc
|
Update onelogin_assumed_another_user.yml
|
2021-10-11 22:54:05 -05:00 |
|
|
Austin Songer
|
0978ca92d8
|
Update onelogin_assumed_another_user.yml
|
2021-10-11 21:18:31 -05:00 |
|
|
austinsonger
|
0bf9f1cfd6
|
Onelogin Rules
|
2021-10-11 21:03:48 -05:00 |
|
|
frack113
|
b9fc29bc05
|
Merge pull request #2131 from frack113/Powershell
Powershell order
|
2021-10-11 15:43:32 +01:00 |
|
|
hieuttmmo
|
be314ae8bb
|
Merge branch 'SigmaHQ:master' into master
|
2021-10-10 16:06:54 +04:00 |
|
|
Tran Trung Hieu
|
5fdaefc77d
|
Azure Security Operations for Priveleged Accounts
|
2021-10-10 16:06:28 +04:00 |
|
|
frack113
|
d081d20a13
|
Merge pull request #2119 from austinsonger/privilege_escalation_pass_role_to_lambda_function.yml
passed_role_to_glue_development_endpoint.yml and passed_role_to_lambda_function.yml
|
2021-10-10 11:01:36 +02:00 |
|
|
frack113
|
7497fdb484
|
Merge pull request #2129 from d4rk-d4nph3/master
Added rule for possible persistence via VMTools
|
2021-10-10 10:55:06 +02:00 |
|
|
frack113
|
1337116d84
|
Cleanup selection name
|
2021-10-10 10:17:24 +02:00 |
|
|
Bhabesh Rai
|
a241f526ef
|
Added more strict path
|
2021-10-10 07:54:40 +05:45 |
|
|
Austin Songer
|
1987897a76
|
Update aws_pass_role_to_lambda_function.yml
|
2021-10-09 15:26:38 -05:00 |
|
|
Austin Songer
|
de52890a62
|
Update passed_role_to_glue_development_endpoint.yml
|
2021-10-09 15:24:49 -05:00 |
|
|
Florian Roth
|
30213dba87
|
Merge pull request #2132 from SigmaHQ/rule-devel
New Rules
|
2021-10-09 19:19:45 +02:00 |
|
|
Florian Roth
|
195db4cffc
|
refactor: made Apache RCE rule more robust
|
2021-10-09 18:48:02 +02:00 |
|
|
Florian Roth
|
4ab3ebf6b2
|
Merge pull request #2128 from OTRF/feature/Susp-ADFS-NamedPipe
Detect suspicious named pipe connections to an AD FS WID
|
2021-10-09 16:47:25 +02:00 |
|
|
Florian Roth
|
2379907f26
|
docs: extended the description by a word
|
2021-10-09 16:42:42 +02:00 |
|