 Sittikorn S
|
c446c519cf
|
Update web_cve_2021_22893_pulse_secure_rce_exploit.yml
|
2021-06-29 13:59:08 +07:00 |
|
|
Sittikorn S
|
f3c1d78615
|
Create web_cve_2021_22893_pulse_secure_rce_exploit.yml
|
2021-06-29 13:56:30 +07:00 |
|
|
Sittikorn S
|
56004fc49b
|
Update sysmon_rclone_execution.yml
Add RClone Command that used by DarkSide malware
|
2021-06-29 13:44:03 +07:00 |
|
|
Sittikorn S
|
c2e701958e
|
Create aws_ec2_disable_encryption.yml
|
2021-06-29 11:06:00 +07:00 |
|
|
Florian Roth
|
9e3caf4ceb
|
refactor: non-interactive Powershell to "low"
|
2021-06-28 16:38:34 +02:00 |
|
|
Andreas Hunkeler
|
756b8eed26
|
Add Synergy as possible FP for PortProxy key
|
2021-06-28 12:10:16 +02:00 |
|
|
Florian Roth
|
f4ac416ef4
|
Merge pull request #1582 from SigmaHQ/rule-devel
Rule devel
|
2021-06-28 11:36:21 +02:00 |
|
|
Sittikorn S
|
bfe110a2c5
|
Update aws_securityhub_finding_evasion.yml
|
2021-06-28 16:07:54 +07:00 |
|
|
Sittikorn S
|
5a61e402bf
|
Update aws_securityhub_finding_evasion.yml
|
2021-06-28 15:57:21 +07:00 |
|
|
Sittikorn S
|
071699da5e
|
Update aws_securityhub_finding_evasion.yml
|
2021-06-28 15:52:42 +07:00 |
|
|
Sittikorn S
|
ff83414871
|
Update and rename aws_securityhub_disable_finding.yml to aws_securityhub_finding_evasion.yml
|
2021-06-28 15:45:31 +07:00 |
|
|
Sittikorn S
|
4c323d40dd
|
Create aws_securityhub_disable_finding.yml
|
2021-06-28 15:42:34 +07:00 |
|
|
Florian Roth
|
d1f1e8e7c4
|
rule: reg add run key
|
2021-06-28 09:39:12 +02:00 |
|
|
Florian Roth
|
ab0502f893
|
refactor: add wscript.exe to mshta rule
|
2021-06-28 09:39:04 +02:00 |
|
|
Florian Roth
|
d48009748f
|
rule: mshta shell spawn
|
2021-06-28 09:32:28 +02:00 |
|
|
Florian Roth
|
e7d9f1b427
|
Merge pull request #1577 from austinsonger/master
Update win_susp_disable_eventlog.yml
|
2021-06-28 08:46:17 +02:00 |
|
|
Florian Roth
|
faf5e4a514
|
Update win_run_virtualbox.yml
|
2021-06-28 08:42:09 +02:00 |
|
|
Austin Songer
|
8e6ab7fd79
|
Update win_susp_disable_eventlog.yml
|
2021-06-28 00:59:53 -05:00 |
|
|
Austin Songer
|
bfe969f071
|
Update win_susp_disable_eventlog.yml
|
2021-06-28 00:53:52 -05:00 |
|
|
Austin Songer
|
d1fba0e1a5
|
Update win_susp_disable_eventlog.yml
|
2021-06-27 20:26:44 -05:00 |
|
|
frack113
|
e096b853cf
|
Fix file from PR 1022
|
2021-06-27 18:24:56 +02:00 |
|
|
wagga40
|
d6afa46e68
|
Added missing "modified" fields. Removed trailing wildcard.
|
2021-06-27 17:36:32 +02:00 |
|
|
wagga40
|
d6c430408f
|
Removed duplicate field
|
2021-06-27 15:54:26 +02:00 |
|
|
wagga40
|
3f0dd2417b
|
Removed Drive letter before "Users" directory
|
2021-06-27 15:32:46 +02:00 |
|
|
wagga40
|
11df697cdc
|
Updated rules with modifiers instead of '*' and remove trailing '\\'
|
2021-06-27 14:51:29 +02:00 |
|
|
Austin Songer
|
f1d937cbd6
|
Update win_susp_disable_eventlog.yml
|
2021-06-26 12:22:54 -05:00 |
|
|
Austin Songer
|
de6fac1d18
|
Update win_susp_disable_eventlog.yml
|
2021-06-26 03:15:05 -05:00 |
|
|
mlp1515
|
60d352a21a
|
Merge branch 'SigmaHQ:master' into master
|
2021-06-25 13:17:24 +02:00 |
|
|
Florian Roth
|
014c3ec400
|
more generic approach to the Admin* group
|
2021-06-25 12:38:47 +02:00 |
|
|
Florian Roth
|
6c3f94fb72
|
Merge pull request #1572 from adeemm/ldap-recon
Add rule to detect AD enumeration
|
2021-06-25 12:18:26 +02:00 |
|
|
Florian Roth
|
685bd490f5
|
Merge pull request #1573 from d4rk-d4nph3/master
Added rule for default cobalt strike certificate
|
2021-06-25 12:16:31 +02:00 |
|
|
Florian Roth
|
c90e31275d
|
Merge pull request #1576 from CriimBow/patch-1
Typo on Find-DomainObjectPropertyOutlier
|
2021-06-25 12:15:59 +02:00 |
|
|
Florian Roth
|
537d89d185
|
Merge pull request #1575 from SigmaHQ/rule-devel
rules: PurpleSharp, WMIC ActiveScriptEventConsumer
|
2021-06-25 12:15:35 +02:00 |
|
|
CriimBow
|
188b847670
|
Typo on Find-DomainObjectPropertyOutlier
|
2021-06-25 10:35:33 +02:00 |
|
|
Florian Roth
|
7b6208c05c
|
rules: PurpleSharp, WMIC ActiveScriptEventConsumer
|
2021-06-25 09:56:42 +02:00 |
|
|
Bhabesh Rai
|
91cc97d099
|
Fixed the taxonomy
|
2021-06-24 21:07:52 +05:45 |
|
|
Andreas Hunkeler
|
3de0679d5a
|
Add fp note to PortProxy rules
|
2021-06-24 11:22:41 +02:00 |
|
|
Andreas Hunkeler
|
366d83ab44
|
Add fp note to PortProxy rules
|
2021-06-24 11:21:29 +02:00 |
|
|
Florian Roth
|
1dd557e543
|
fix: global action unneeded
|
2021-06-23 09:23:08 +02:00 |
|
|
Bhabesh Rai
|
1ebbc6c1a3
|
Added rule for default cobalt strike certificate
|
2021-06-23 10:17:27 +05:45 |
|
|
Sittikorn S
|
c0724e533f
|
Update and rename win_renamed_meg.yml to win_renamed_megasync.yml
|
2021-06-23 09:24:42 +07:00 |
|
|
Sittikorn S
|
a310806dbf
|
Update win_renamed_meg.yml
|
2021-06-23 08:35:12 +07:00 |
|
|
Adeem Mawani
|
8077dedbc5
|
Add rule to detect AD enumeration
|
2021-06-22 15:57:49 -04:00 |
|
|
Sittikorn S
|
10488512ae
|
Update win_renamed_meg.yml
|
2021-06-22 22:27:34 +07:00 |
|
|
Sittikorn S
|
177442d6df
|
Update win_renamed_meg.yml
|
2021-06-22 22:20:49 +07:00 |
|
|
Sittikorn S
|
6328ce8ef6
|
Update win_renamed_meg.yml
|
2021-06-22 22:17:51 +07:00 |
|
|
Sittikorn S
|
f55cd9ed1b
|
Update win_renamed_meg.yml
|
2021-06-22 22:03:56 +07:00 |
|
|
Sittikorn S
|
268a4c31e3
|
Update win_renamed_meg.yml
Change mitre tags T1218.001 to T1218
|
2021-06-22 22:00:35 +07:00 |
|
|
Sittikorn S
|
e6d08d0ad6
|
Update win_renamed_meg.yml
|
2021-06-22 21:55:09 +07:00 |
|
|
Sittikorn S
|
a08b6c4e0a
|
Create win_renamed_meg.yml
|
2021-06-22 21:50:07 +07:00 |
|