 Nasreddine Bencherchali
|
f3171177d8
|
fix: apply suggestions from code review
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
|
2023-01-18 10:24:04 +01:00 |
|
|
Nasreddine Bencherchali
|
459ba25cce
|
Merge branch 'nasbench-rule-devel' of https://github.com/nasbench/sigma into nasbench-rule-devel
|
2023-01-17 01:01:38 +01:00 |
|
|
Nasreddine Bencherchali
|
b6e4c45ef0
|
Merge branch 'SigmaHQ:master' into nasbench-rule-devel
|
2023-01-17 01:01:23 +01:00 |
|
|
Nasreddine Bencherchali
|
85fb255bc9
|
feat: new rules and updates
|
2023-01-17 01:00:44 +01:00 |
|
|
Nasreddine Bencherchali
|
09731e8547
|
fix: update modified date
|
2023-01-16 10:50:23 +01:00 |
|
|
jkb
|
391173c153
|
Correcting filepath parameter
According to Microsoft documentation, the parameter is -Filepath not -File-path. See: https://learn.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps
|
2023-01-16 10:46:02 +01:00 |
|
|
Nasreddine Bencherchali
|
fd823045a9
|
fix: fp in msiexec rule
|
2023-01-16 10:28:15 +01:00 |
|
|
Nasreddine Bencherchali
|
9783297262
|
Merge pull request #3922 from frack113/redcannary_20230113
New rules based on Redcannary AtomicRedTeam 2023-01-13
|
2023-01-13 18:18:32 +01:00 |
|
|
Nasreddine Bencherchali
|
8707345be7
|
fix: add related metadata
|
2023-01-13 17:21:21 +01:00 |
|
|
frack113
|
23620bc8aa
|
Update proc_creation_win_lsa_disablerestrictedadmin.yml
|
2023-01-13 12:31:28 +01:00 |
|
|
frack113
|
1b11e29fef
|
Move rules
|
2023-01-13 12:15:08 +01:00 |
|
|
Florian Roth
|
29a61b8c70
|
Merge branch 'master' into rule-devel
|
2023-01-12 23:57:41 +01:00 |
|
|
Florian Roth
|
df1870df1e
|
add IOC for LocalPotato
|
2023-01-12 23:57:33 +01:00 |
|
|
Nasreddine Bencherchali
|
90c1e45d83
|
feat: add new reg variant of dev mode
|
2023-01-12 15:05:53 +01:00 |
|
|
Nasreddine Bencherchali
|
67ea98a6db
|
feat: more updates and fixes
|
2023-01-12 01:05:48 +01:00 |
|
|
Nasreddine Bencherchali
|
b6b1eba014
|
fix: fp and add related fields
|
2023-01-11 23:39:15 +01:00 |
|
|
Nasreddine Bencherchali
|
debd658aac
|
feat: new rules related to appx packages
|
2023-01-11 23:04:37 +01:00 |
|
|
Nasreddine Bencherchali
|
f4d4526d0f
|
fix: fp found in testing
|
2023-01-11 20:05:55 +01:00 |
|
|
Nasreddine Bencherchali
|
8dc2418ea9
|
fix: some issues
|
2023-01-11 11:18:54 +01:00 |
|
|
Nasreddine Bencherchali
|
28a3413aa7
|
feat: updates and enhancements
|
2023-01-11 01:03:52 +01:00 |
|
|
Nasreddine Bencherchali
|
5bd38f8ff0
|
Merge branch 'SigmaHQ:master' into nasbench-rule-devel
|
2023-01-11 01:03:08 +01:00 |
|
|
frack113
|
49d7eb244f
|
Remove mitre url
|
2023-01-10 18:24:22 +01:00 |
|
|
frack113
|
4023bf2c83
|
Remove mitre url
|
2023-01-10 18:09:04 +01:00 |
|
|
Nasreddine Bencherchali
|
9d6a41edc6
|
fix: fp found in testing
|
2023-01-10 15:11:40 +01:00 |
|
|
Nasreddine Bencherchali
|
b80b358427
|
fix: fp with defender
|
2023-01-10 00:44:52 +01:00 |
|
|
Nasreddine Bencherchali
|
81f75c1d2e
|
feat: updates and enhancements
|
2023-01-10 00:13:37 +01:00 |
|
|
Nasreddine Bencherchali
|
17aaf7fdcd
|
Merge pull request #3888 from SigmaHQ/aurora-false-positive-fixing
fix: FPs noticed with Aurora
|
2023-01-09 10:39:54 +01:00 |
|
|
Florian Roth
|
7f45405867
|
fix: FPs noticed with Aurora
|
2023-01-09 09:46:16 +01:00 |
|
|
frack113
|
f015c940f8
|
Merge pull request #3880 from frack113/from_VT_screen
Add proc_creation_win_double_ext_parent
|
2023-01-06 18:31:47 +01:00 |
|
|
frack113
|
97ec1c4d54
|
Add related
|
2023-01-06 18:22:36 +01:00 |
|
|
frack113
|
3346a6d3e4
|
Apply suggestions from code review
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2023-01-06 18:21:06 +01:00 |
|
|
frack113
|
679d1ee0ed
|
Add more ext
|
2023-01-06 18:17:01 +01:00 |
|
|
Nasreddine Bencherchali
|
18a77e79e3
|
fix: multiple issues
|
2023-01-06 18:04:04 +01:00 |
|
|
frack113
|
4adbb3fbd2
|
Add proc_creation_win_double_ext_parent
|
2023-01-06 17:18:50 +01:00 |
|
|
Nasreddine Bencherchali
|
e56d3763b5
|
fix: unused selection
|
2023-01-06 17:16:20 +01:00 |
|
|
Nasreddine Bencherchali
|
7e73028c5e
|
feat: updates and enhancements
|
2023-01-06 16:35:34 +01:00 |
|
|
frack113
|
65eb06e231
|
Merge pull request #3876 from frack113/fix_fp_gfx
Update proc_creation_win_susp_file_download_via_gfxdownloadwrapper.yml
|
2023-01-06 13:48:31 +01:00 |
|
|
frack113
|
31530e50b7
|
Update FP
|
2023-01-06 13:28:57 +01:00 |
|
|
Nasreddine Bencherchali
|
fb1f72a634
|
fix: add missing modified field
|
2023-01-05 23:08:36 +01:00 |
|
|
Veramine
|
325d532239
|
Update proc_creation_win_susp_3proxy_usage.yml
Fix condition
|
2023-01-05 13:30:45 -08:00 |
|
|
Nasreddine Bencherchali
|
be4d99d6dd
|
Merge pull request #3868 from nasbench/nasbench-rule-devel
feat: updates and enhancements
|
2023-01-04 19:29:12 +01:00 |
|
|
Nasreddine Bencherchali
|
679f3d015b
|
fix: remove unnecessary space
|
2023-01-04 19:11:33 +01:00 |
|
|
Nasreddine Bencherchali
|
46f01f2f88
|
fix: typo in unknown
|
2023-01-04 18:46:34 +01:00 |
|
|
Tim Shelton
|
903ebb1176
|
FP: tenable nessus client calls cmd during scanning.
|
2023-01-04 17:42:16 +00:00 |
|
|
Nasreddine Bencherchali
|
219b24be0b
|
fix: broken selection
|
2023-01-04 18:04:14 +01:00 |
|
|
Nasreddine Bencherchali
|
711ba956e3
|
feat: updates and enhancements
|
2023-01-04 17:49:32 +01:00 |
|
|
Nasreddine Bencherchali
|
0fe4f16dfb
|
fix: update filter based on ##3865 and #3866
|
2023-01-04 10:28:50 +01:00 |
|
|
Nasreddine Bencherchali
|
a737737d92
|
fix: enhance filter
|
2023-01-04 00:46:54 +01:00 |
|
|
Tim Shelton
|
0c520dc930
|
FP: manage engine admanager postgres calling archive.bat
|
2023-01-03 22:04:52 +00:00 |
|
|
Nasreddine Bencherchali
|
343e3f0934
|
Merge pull request #3859 from D3F7A5105/master
Change Evtx Location Used Wevtutil
|
2023-01-03 13:23:57 +01:00 |
|