11 Commits

Author	SHA1	Message	Date
Steven	850a002840	Merge branch 'master' of https://github.com/SigmaHQ/sigma	2021-04-15 01:25:48 +02:00
Anton Kutepov	3f45269296	Merge branch 'oscd' ... B B B B A	2021-03-02 22:58:41 +03:00
jaegeral	e1f43f17c2	fixed various spelling errors all over rules and source code	2021-02-24 14:43:13 +00:00
Jonhnathan	98c7639db7	Update mal_azorult_reg.yml	2020-10-27 22:19:04 -03:00
Jonhnathan	8f4d6f802b	Update mal_azorult_reg.yml	2020-10-27 22:18:41 -03:00
Jonhnathan	9fd203e2a3	Update mal_azorult_reg.yml	2020-10-27 22:07:45 -03:00
Jonhnathan	ef646e74d8	Update mal_azorult_reg.yml	2020-10-15 16:15:25 -03:00
Steven	05d2de4c26	- Cleaned up some more rules where 'service: sysmon' was combined with category ... - Replaced 'service: sysmon' with category: ... for some more events to make the rules more product independent modified: rules/windows/builtin/win_invoke_obfuscation_obfuscated_iex_services.yml modified: rules/windows/malware/mal_azorult_reg.yml modified: rules/windows/powershell/powershell_suspicious_profile_create.yml modified: rules/windows/process_creation/sysmon_cmstp_execution.yml modified: rules/windows/process_creation/win_apt_chafer_mar18.yml modified: rules/windows/process_creation/win_apt_unidentified_nov_18.yml modified: rules/windows/process_creation/win_hktl_createminidump.yml modified: rules/windows/process_creation/win_mal_adwind.yml modified: rules/windows/process_creation/win_silenttrinity_stage_use.yml	2020-10-02 10:45:29 +02:00
Florian Roth	09d1b00459	Changed level to ciritcal	2020-05-11 10:40:23 +02:00
tliffick	c98be55d21	Update mal_azorult_reg.yml	2020-05-08 21:31:33 -04:00
tliffick	61f061333b	Registry entry for Azorult malware ... Detects registry keys used by Azorult malware	2020-05-08 21:26:24 -04:00