f47604b735
chore: update pySigma validators
2025-04-30 11:31:22 +02:00
b062d8ad65
Merge PR #5380 from @david-syk - Update MITRE ATT&CK tags 2nd batch
2025-04-25 21:01:12 +02:00
95b6dd8573
Merge PR #5381 from @david-syk - Update MITRE ATT&CK tags
...
chore: update multiple mitre att&ck tags
2025-04-25 20:55:51 +02:00
6ded165b42
Merge pull request #5382 from SigmaHQ/detection-studio-readme
2025-04-25 11:52:03 +01:00
6fad19ba7b
Adds Detection Studio to README.md page
2025-04-23 14:57:37 +01:00
85fd5958bc
Merge PR #5261 from @swachchhanda000 - Add Suspicious CrushFTP Child Process
...
new: Suspicious CrushFTP Child Process
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-04-17 21:43:35 +02:00
3d17247df5
Merge PR #5263 from @RG9n - Add Suspicious Process Spawned by CentreStack Portal AppPool
...
new: Suspicious Process Spawned by CentreStack Portal AppPool
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-04-17 21:42:56 +02:00
07c285ca29
Merge PR #5265 form @tsale - Update Obfuscated PowerShell OneLiner Execution and author of multiple rules
...
update: Obfuscated PowerShell OneLiner Execution - Enhance logic to increase coverage.
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-04-17 21:42:17 +02:00
5d050fb8a5
Merge PR #5228 from @swachchhanda000 - Update Eventlog clearing related rules
...
update: Suspicious Eventlog Clear - Added coverage for eventlog clearing using dotnet class
update: Suspicious Eventlog Clearing or Configuration Change Activity- Added coverage for eventlog clearing using dotnet class
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-04-17 00:45:10 +02:00
ff4076fea1
Merge PR #5234 from @swachchhanda000 - Update Potential Product Class Reconnaissance Via Wmic.EXE
...
update: Potential Product Class Reconnaissance Via Wmic.EXE - Add `AntiSpywareProduct` class
2025-04-17 00:44:13 +02:00
75a1ff3915
Merge PR #5239 from @swachchhanda000 - Update Potential Browser Data Stealing
...
update: Potential Browser Data Stealing - add esentutl.exe
---------
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2025-04-17 00:43:26 +02:00
6143a22389
Merge PR #5240 from @swachchhanda000 - Add Suspicious LNK Command-Line Padding with Whitespace Characters
...
new: Suspicious LNK Command-Line Padding with Whitespace Characters
2025-04-17 00:42:11 +02:00
29ad6f9617
Merge PR #5249 from @nasbench - Promote older rules status from experimental to test
...
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-04-17 00:41:35 +02:00
36394d43a0
Merge PR #5250 from @nasbench - Archive new rule references and update cache file
...
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-04-17 00:41:06 +02:00
1f1cac10eb
Merge PR #5258 from @david-syk - Update Potential Adplus.EXE Abuse tags
...
chore: update mitre attack tag
---------
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2025-04-17 00:40:41 +02:00
ced93a8d17
Merge PR #5264 from @swachchhanda000 - Update Potential Binary Impersonating Sysinternals Tools
...
update: Potential Binary Impersonating Sysinternals Tools - Add list of binaries compiled for Arm64 arch added
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2025-04-17 00:39:23 +02:00
3946f672f0
Merge PR #5256 from @nasbench - Update Potential CVE-2023-23397 Exploitation Attempt - SMB
...
fix: Potential CVE-2023-23397 Exploitation Attempt - SMB - Add filters for IP format when ingesting XML raw event
2025-04-10 15:07:45 +02:00
c72928b430
Merge PR #5241 from @Neo23x0 - Update Potential CVE-2023-23397 Exploitation Attempt - SMB
...
fix: Potential CVE-2023-23397 Exploitation Attempt - SMB - Fix the IP block covering EventID 30804 as it does not contain an IP as a field but as a string
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-04-07 11:10:52 +02:00
357838c404
Merge PR #5237 from @Neo23x0 - Update Buffer Overflow Attempts
...
update: Buffer Overflow Attempts - Enhance and reworked logic with new keywords
2025-04-07 11:08:55 +02:00
e874eaf58e
Merge PR #5236 from @nickatrecon - Update AWS New Lambda Layer Attached
...
update: AWS New Lambda Layer Attached - Enhance metadata and logic
---------
Thanks: imall4n
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-04-07 11:07:50 +02:00
fa27f1bc54
Merge PR #5224 from @swachchhanda000 - Fix Multiple FPs
...
update: Elevated System Shell Spawned - Add `powershell_ise`
fix: Potential Binary Or Script Dropper Via PowerShell - Add filter for `C:\Windows\SystemTemp\`
fix: Python Initiated Connection - Enhance python filter
fix: Conhost Spawned By Uncommon Parent Process - Add filter for `'-k wusvcs -p -s WaaSMedicSvc`
update: Elevated System Shell Spawned From Uncommon Parent Location - Add `powershell_ise`
fix: Potential WinAPI Calls Via CommandLine - Add new filter for `CompatTelRunner`
fix: Windows Processes Suspicious Parent Directory - Add new filter for empty parent
fix: Whoami.EXE Execution Anomaly - Add new filter for empty parent
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-04-07 11:05:53 +02:00
166af991c0
Merge PR #4886 from @frack113 - Add Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock
...
new: Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-04-07 11:02:17 +02:00
78a78c79ff
Merge PR #5229 from @dsplice - Update Potential APT FIN7 Exploitation Activity
...
update: Potential APT FIN7 Exploitation Activity - Add false positive description
2025-03-16 03:19:44 +01:00
eda06d1a3b
Merge PR #5227 from @Gude5 - Fix small typos in deprecated rules
...
fix: Indirect Command Exectuion via Forfiles - wrong keyword
fix: PowerShell Execution - wrong date format
2025-03-16 03:09:53 +01:00
4a3cb8b774
Merge PR #5230 from @nasbench - Archive new rule references and update cache file
...
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-03-16 03:08:28 +01:00
3ce034bb20
Merge PR #4858 from @frack113 - Add summary csv file, workflow and generation script for deprecated rules
...
chore: add summary csv file, workflow and generation script for deprecated rules
---------
Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com >
2025-03-05 00:59:36 +01:00
a719612ab8
Merge PR #5098 from @CheraghiMilad - Update Service Reload or Start - Linux
...
update: Service Reload or Start - Linux - Add additional flags and binaries used to changes services status
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-03-05 00:50:23 +01:00
13b9a509d4
Merge PR #5198 from @DFIR-Detection - Add Notepad Password Files Discovery
...
new: Notepad Password Files Discovery
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-03-05 00:24:11 +01:00
64852d95a9
Merge PR #5216 from @nasbench - Promote older rules status from experimental to test
...
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-03-05 00:23:27 +01:00
2b421e3fd7
Merge PR #5217 from @nasbench - Archive new rule references and update cache file
...
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-03-05 00:23:03 +01:00
f4d86e8f37
Merge PR #5204 from @swachchhanda000 - Update Malicious PowerShell Scripts and Cmdlets Rules
...
update: Malicious PowerShell Scripts - FileCreation - Add `Veeam-Get-Creds.ps1`
update: Malicious PowerShell Scripts - PoshModule - Add `Veeam-Get-Creds.ps1`
update: Malicious PowerShell Commandlets - PoshModule - Add `Veeam-Get-Creds`
update: Malicious PowerShell Commandlets - ProcessCreation - Add `Veeam-Get-Creds`
2025-03-05 00:21:08 +01:00
f784916130
Merge PR #5207 from @swachchhanda000 - Updated Anydesk related rules
...
update: Anydesk Remote Access Software Service Installation - Enhance coverage by accounting for the `AnyDesk MSI` Service
update: Suspicious Binary Writes Via AnyDesk - Add `AnyDeskMSI.exe`
update: Remote Access Tool - AnyDesk Incoming Connection - Add `AnyDeskMSI.exe`
update: Remote Access Tool - Anydesk Execution From Suspicious Folder - Add `AnyDeskMSI.exe`
update: Remote Access Tool - AnyDesk Execution - Add `AnyDeskMSI.exe`
2025-03-05 00:19:19 +01:00
54496e2e0d
Merge PR #5211 from @HannesWid - Update Nslookup PowerShell Download Cradle
...
update: Nslookup PowerShell Download Cradle - Add additional coverage with `-type=txt http`
2025-03-05 00:17:38 +01:00
a61484efb6
Merge PR #5214 from @signalblur - Add HTTP Request to Low Reputation TLD or Suspicious File Extension
...
new: HTTP Request to Low Reputation TLD or Suspicious File Extension
---------
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-03-05 00:13:45 +01:00
5711c8a2f4
Merge PR #5215 from @Neo23x0 - Fix typo in falsepositives section
...
chore: fix typo in falsepositive section
2025-02-28 15:49:36 +01:00
f3de589d08
Merge PR #5202 from @swachchhanda000 - Added coverage rundll32 ordinal obfuscation attempts.
...
update: Potential Obfuscated Ordinal Call Via Rundll32 - Add additional obfuscation methods
update: Process Memory Dump Via Comsvcs.DLL - Add additional obfuscation methods
---------
Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com >
2025-02-25 22:32:55 +01:00
f3e5d51f7b
Merge PR #5210 from @clr2of8 - Update Attack Nav layer Version,Title and Color
...
chore: Update the ATT&CK Nav layer version to avoid warnings and upgrade prompts when loaded into the navigator. Give the layer a representative title and adjust the color scheme used to be more meaningful,
2025-02-24 18:44:38 +01:00
9bbd096e47
Merge PR #5201 from @frack113 - Update MITRE ATT&CK Heatmap
...
chore: update MITRE heatmap
Thanks: clr2of8
2025-02-24 13:01:36 +01:00
3fb1894a79
Merge PR #5136 from @Eyezuhk - Add Potential CVE-2024-35250 Exploitation Activity
...
new: Potential CVE-2024-35250 Exploitation Activity
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2025-02-24 12:58:40 +01:00
7f83008e9e
Merge PR #5173 from @X-Junior - New rule additions and some fixes
...
new: Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
fix: Python Initiated Connection - Add filter for `pip install`
fix: Python Inline Command Execution - Add filter for whl package installations
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-02-22 23:57:41 +01:00
c779fc5424
Merge PR #5200 from @frack113 - Fix typo in selection name
...
chore: fix selection name
2025-02-22 23:47:24 +01:00
de0c3f3a83
Merge PR #5182 from @Koifman - Update Windows Event Log Access Tampering Via Registry
...
update: Windows Event Log Access Tampering Via Registry - Increase coverage by removing log markers
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-02-17 12:49:00 +01:00
41bef8eed5
Merge PR #5189 from @X-Junior - Add Potentially Suspicious WDAC Policy File Creation
...
new: Potentially Suspicious WDAC Policy File Creation
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-02-17 12:46:16 +01:00
0a34bc4d50
Merge PR #5192 from @whichbuffer - Add Kalambur Backdoor Curl TOR SOCKS Proxy Execution
...
new: Kalambur Backdoor Curl TOR SOCKS Proxy Execution
---------
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-02-17 12:33:20 +01:00
1de2b1c30f
Merge PR #5186 from @swachchhanda000 - Increase coverage of AADinternals rules
...
update: AADInternals PowerShell Cmdlets Execution - PsScript - Add additional strings from the AADinternals framework
update: AADInternals PowerShell Cmdlets Execution - ProccessCreation - Add additional strings from the AADinternals framework
2025-02-17 12:11:55 +01:00
0d25ad1855
Merge PR #5184 from @swachchhanda000 - Add PUA - NimScan Execution
...
new: PUA - NimScan Execution
2025-02-17 12:07:45 +01:00
c0aa75845b
Merge PR #5194 from @nasbench - Archive new rule references and update cache file
...
chore: archive new rule references and update cache file
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-02-17 12:04:58 +01:00
75b51c76b5
Merge PR #5195 from @X-Junior - Fix Schtasks Creation Or Modification With SYSTEM Privileges
...
fix: Schtasks Creation Or Modification With SYSTEM Privileges - Add new filter of office scheduled task
2025-02-17 12:04:28 +01:00
2bfb0935a0
Merge PR #5177 from @nasbench - promote older rules status from experimental to test
...
Create Release / Create Release (push) Has been cancelled
chore: promote older rules status from `experimental` to `test`
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-02-03 18:23:12 +01:00
1d8c84387f
Merge PR #5178 from @nasbench - Archive new rule references and update cache file
...
chore: archive new rule references and update cache file
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-02-03 18:22:38 +01:00
phantinuss