0b883a90b6
fix: null value in separate expression
2019-07-02 20:14:45 +02:00
ce43d600e3
fix: added null value / application to 4688 problem
2019-07-02 10:51:48 +02:00
2f123f64a7
Added command that stops services.
2019-06-28 19:46:34 +03:00
ad386474bf
fix: removed unusable extensions in proc exec context
2019-06-26 17:03:01 +02:00
708f3ef002
fix: fixed duplicate element in new double extension rule
2019-06-26 16:00:58 +02:00
41dc076959
Rule: suspicious double extension
2019-06-26 15:57:25 +02:00
39b5eddfc7
Rule: Suspicious userinit.exe child process
2019-06-23 13:27:06 +02:00
26036e0d35
fix: fixed image in taskmgr rule
2019-06-21 17:15:53 +02:00
ff7128209e
Adjusted level
2019-06-20 00:03:48 +02:00
0f8849a652
Rule fixes
...
* tagging
* removed spaces
* converted to generic log source
* typos/case
2019-06-20 00:01:56 +02:00
429c29ed5a
Merge pull request #363 from yugoslavskiy/win_kernel_and_3rd_party_drivers_exploits_token_stealing
...
rule added: Windows Kernel and 3rd-party drivers exploits. Token stea…
2019-06-19 23:43:10 +02:00
dbbc1751ef
Converted rule to generic log source
2019-06-19 23:25:25 +02:00
f70549ec54
First Pass
2019-06-13 23:15:38 -05:00
a23f15d42b
Converted rule to generic log source
2019-06-11 13:20:15 +02:00
5715413da9
Usage of Channel field name in ELK Windows config
2019-06-11 13:15:43 +02:00
5827165c2d
event id deleted
2019-06-03 15:51:54 +02:00
cf947e3720
changed to process_creation category
2019-06-03 15:47:24 +02:00
a0c9f1594e
Rule: renamed file - name was too generic
2019-06-02 10:57:44 +02:00
491c519d1f
Rule: added wmic SHADOWCOPY DELETE
2019-06-02 10:56:13 +02:00
5e7ae0590c
Rule: Split up WanaCry rule into two separate rules
2019-06-02 09:52:18 +02:00
2163208e9c
update correct process name
...
incorrect process name. accidentally had fsutil, should be bcdedit.
thanks to https://twitter.com/INIT_3 for pointing this out
2019-06-01 09:50:50 -04:00
241d814221
Merged WannaCry rules
2019-05-24 22:17:36 +02:00
1ca57719b0
fix: fixed reference list, otherwise it's not valid string list
2019-05-10 10:37:12 +02:00
6585c83077
fix: fixed reference list, otherwise it's not valid string list
2019-05-10 10:13:35 +02:00
25c0330dca
Added filter
2019-05-10 00:20:56 +02:00
995c03eef9
Merge branch 'patch-1' of https://github.com/Karneades/sigma into Karneades-patch-1
2019-05-10 00:15:51 +02:00
15a4c7e477
Fixed rule
2019-05-10 00:02:20 +02:00
666e859d14
Merge branch 'patch-3' of https://github.com/neu5ron/sigma into neu5ron-patch-3
2019-05-10 00:00:14 +02:00
f01fbd6b79
Merge branch
2019-05-09 23:51:15 +02:00
e60fe1f46d
Changed rule
...
* Adapted false positive notice to observation
* Decreased level
2019-05-09 23:49:39 +02:00
121e21960e
Rule changes
...
* Replaced variables with usual path names
* Removed Temp directories due to many false positives
* Matching on Image field, CommandLines often contain these paths
2019-05-09 23:09:22 +02:00
9b67705799
Merge branch 'patch-2' of https://github.com/vburov/sigma into vburov-patch-2
2019-05-09 22:55:07 +02:00
b47900fbee
Add default path to filter for explorer in exe anomaly rule
2019-04-21 17:42:47 +02:00
49beb5d1a8
Integrated PR from @P4T12ICK in existing rule
...
PR #321
2019-04-21 00:28:40 +02:00
aab3dbee4f
Rule: Detect Empire PowerShell Default Cmdline Params
2019-04-20 09:38:41 +02:00
03d8184990
Rule: Extended PowerShell Susp Cmdline Enc Commands
2019-04-20 09:38:41 +02:00
d5fa51eab9
Merge pull request #305 from Karneades/patch-3
...
Remove too loose filter in notepad++ updater rule
2019-04-19 12:40:24 +02:00
e32708154f
Merge pull request #304 from Karneades/patch-2
...
Remove too loose filter in mshta rule
2019-04-19 09:51:45 +02:00
74dd008b10
FP note for HP software
2019-04-19 09:51:32 +02:00
d75ea35295
Restrict whitelist filter in system exe anomaly rule
2019-04-18 22:06:12 +02:00
f78413deab
Merge pull request #309 from jmlynch/master
...
added rules for renamed wscript, cscript and paexec. Added two direct…
2019-04-17 23:59:27 +02:00
4808f49e0d
More exact path
2019-04-17 23:45:15 +02:00
1a4a74b64b
fix: dot mustn't be escaped
2019-04-17 23:44:36 +02:00
76780ccce2
Too many different trusted cscript imphashes
2019-04-17 23:33:56 +02:00
7c5f985f6f
Modifications
2019-04-17 23:30:49 +02:00
4298abffb7
Modifications
2019-04-17 23:29:29 +02:00
615a802a8e
Modifications
2019-04-17 23:26:20 +02:00
0e8a46aaf7
Update win_subp_svchost rule
...
Adding rpcnet.exe as ParentImage
2019-04-16 15:00:06 +02:00
17470d1545
Rule: extended parent list for legitimate svchost starts
...
https://twitter.com/Sam0x90/status/1117768799816753153
2019-04-15 14:54:35 +02:00
612a7642d2
Added Local directory
2019-04-15 08:47:53 +02:00
Florian Roth