 Florian Roth
|
3a30d19cfd
|
Merge pull request #2447 from SigmaHQ/rule-devel
fix: FP with proc creation Image non .exe suffix
|
2021-12-13 14:03:41 +01:00 |
|
|
Florian Roth
|
cd63ce23ff
|
fix: FP with proc creation Image non .exe suffix
|
2021-12-13 11:44:29 +01:00 |
|
|
frack113
|
c358747cb2
|
Merge pull request #2439 from frack113/T1069_001
Windows Redcannary T1069 001
|
2021-12-13 09:24:08 +01:00 |
|
|
Florian Roth
|
2f43e6815b
|
Merge pull request #2440 from SigmaHQ/aurora-false-positive-fixing
fix: FPs noticed with Aurora
|
2021-12-12 14:20:09 +01:00 |
|
|
Florian Roth
|
c6819861c9
|
fix: FPs noticed with Aurora
|
2021-12-12 13:09:27 +01:00 |
|
|
frack113
|
97580d4fa1
|
fix space
|
2021-12-12 12:25:05 +01:00 |
|
|
frack113
|
221f479825
|
Windows Redcannay T1069.001
|
2021-12-12 12:15:27 +01:00 |
|
|
frack113
|
f956cd0c14
|
Merge pull request #2435 from redsand/fp_cylance_adsi_cache
Adding allow for cylance when detecting adsi cache abuse
|
2021-12-12 12:08:25 +01:00 |
|
|
frack113
|
12e7174a04
|
Update sysmon_susp_adsi_cache_usage.yml
|
2021-12-12 11:29:44 +01:00 |
|
|
frack113
|
d45dc2eaf3
|
Merge pull request #2434 from frack113/T1049
Windows T1049 RedCannary
|
2021-12-12 11:28:23 +01:00 |
|
|
Tim Shelton
|
e7e456d1a5
|
Adding allow for cylance
|
2021-12-11 19:23:12 +00:00 |
|
|
Florian Roth
|
074c6b1714
|
Merge pull request #2423 from redsand/detect_net_use_password_plaintext
Detect net use password plaintext
|
2021-12-11 15:25:06 +01:00 |
|
|
frack113
|
2b6c8ff02c
|
Merge pull request #2431 from frack113/ft_aurora
FP perfmon.exe to sysmon_cred_dump_lsass_access.yml
|
2021-12-11 12:29:12 +01:00 |
|
|
frack113
|
c91a4a1a75
|
Merge pull request #2430 from frack113/windows_t1046
Add windows t1046 rules
|
2021-12-11 12:28:47 +01:00 |
|
|
frack113
|
c53740296c
|
Fix title
|
2021-12-11 10:26:47 +01:00 |
|
|
frack113
|
dc1af19336
|
Add win_pc_susp_tasklist_command
|
2021-12-11 10:20:21 +01:00 |
|
|
frack113
|
ee67779811
|
Windows T1049 RedCannary
|
2021-12-11 09:38:20 +01:00 |
|
|
frack113
|
58063d1113
|
FP add perfmon.exe
|
2021-12-10 19:19:55 +01:00 |
|
|
Tim Shelton
|
b41471ed6b
|
adds space to detect between : (drive argument) and \\ (network share path)
|
2021-12-10 18:10:37 +00:00 |
|
|
frack113
|
904fb9181e
|
Add windows t1046 rules
|
2021-12-10 16:31:16 +01:00 |
|
|
David ANDRE
|
1f7764097e
|
Added registry key to shadow RDP sessions
|
2021-12-10 16:03:35 +01:00 |
|
|
Florian Roth
|
a9c9c9ae3a
|
Merge pull request #2425 from SigmaHQ/aurora-false-positive-fixing
fix: FP with new SYSTEM rule
|
2021-12-10 13:50:04 +01:00 |
|
|
Florian Roth
|
8c85f4ffa4
|
fix: FP with new SYSTEM rule
|
2021-12-10 12:17:25 +01:00 |
|
|
Tim Shelton
|
b503a11366
|
oof, wrong field, sorry!
|
2021-12-10 06:49:55 +00:00 |
|
|
redsand (Tim Shelton)
|
879a1325f9
|
Merge branch 'SigmaHQ:master' into fp_for_matching_msiexec_behavior
|
2021-12-10 00:47:49 -06:00 |
|
|
redsand (Tim Shelton)
|
6151094fdd
|
Merge branch 'SigmaHQ:master' into detect_net_use_password_plaintext
|
2021-12-10 00:46:38 -06:00 |
|
|
frack113
|
8c77e4757f
|
Merge pull request #2420 from redsand/fp_wsmprovhost_ps_pipe
adding allow for wsmprovhost.exe to call powershell pipes
|
2021-12-10 06:50:45 +01:00 |
|
|
Florian Roth
|
baa1dcd608
|
Merge pull request #2417 from stbe/imp_lsass_defender
Added Defender to win_susp_lsass_dump_generic.yml
|
2021-12-10 00:00:22 +01:00 |
|
|
Florian Roth
|
834681c3b4
|
Update win_susp_net_use_password_plaintext.yml
|
2021-12-09 23:51:32 +01:00 |
|
|
stbe
|
44db55c4fd
|
Refined definition of defender executable
|
2021-12-09 22:55:09 +01:00 |
|
|
Tim Shelton
|
f59c8c3360
|
changing case of title
|
2021-12-09 20:53:07 +00:00 |
|
|
Tim Shelton
|
791f419b9e
|
fixing column
|
2021-12-09 20:41:50 +00:00 |
|
|
Tim Shelton
|
19eff6952b
|
Fixing format errors
|
2021-12-09 20:39:43 +00:00 |
|
|
Tim Shelton
|
ae34e020c2
|
Adding new sig to detect password on commandline
|
2021-12-09 20:33:37 +00:00 |
|
|
Tim Shelton
|
06c7a7d445
|
adding allow for wsmprovhost.exe to call powershell pipes
|
2021-12-09 19:46:35 +00:00 |
|
|
Florian Roth
|
1574f13824
|
Merge pull request #2418 from secDre4mer/master
Add rules for uncommon process creation events
|
2021-12-09 16:51:45 +01:00 |
|
|
frack113
|
e049058d14
|
Merge pull request #2415 from frack113/condition
builtin/security simplified condition
|
2021-12-09 16:24:24 +01:00 |
|
|
frack113
|
cd87b2baa5
|
Merge pull request #2414 from frack113/fp
sysmon_abusing_azure_browser_sso.yml FP
|
2021-12-09 16:23:06 +01:00 |
|
|
Tim Shelton
|
88eaeca844
|
Adding filter for msiexec repair option
|
2021-12-09 15:16:52 +00:00 |
|
|
Florian Roth
|
0689e253b4
|
set level to "high"
|
2021-12-09 16:03:20 +01:00 |
|
|
Florian Roth
|
a5c53789d9
|
set level to high
|
2021-12-09 16:03:06 +01:00 |
|
|
Max Altgelt
|
3c699a2272
|
fix: inline list with one argument
|
2021-12-09 15:49:18 +01:00 |
|
|
Max Altgelt
|
ca2ead74b1
|
feat: Add rules to detect uncommon process creation events
|
2021-12-09 14:21:34 +01:00 |
|
|
Max Altgelt
|
538fb06f05
|
fix: mark string as regex
|
2021-12-09 14:09:19 +01:00 |
|
|
stbe
|
20f185f2b8
|
Added Defender to win_susp_lsass_dump_generic.yml
|
2021-12-09 13:57:09 +01:00 |
|
|
Florian Roth
|
af2c6a0ecb
|
Lower the level to "low"
In case that some backends/scripts/tools don't respect the "deprecated" status
|
2021-12-09 13:01:12 +01:00 |
|
|
frack113
|
62207b80ba
|
Change to deprecated as too many FP
|
2021-12-09 09:34:08 +01:00 |
|
|
frack113
|
3ce9336e79
|
simplified condition
|
2021-12-08 20:12:57 +01:00 |
|
|
frack113
|
61a0f1a706
|
Merge pull request #2405 from mlp1515/sysmon_volume_shadow_copy_service_keys-false-positif
False positives on sysmon_volume_shadow_copy_service_keys.yml
|
2021-12-08 18:28:49 +01:00 |
|
|
frack113
|
4baeddbf16
|
change to test
|
2021-12-08 18:06:03 +01:00 |
|