 Florian Roth
|
cfe60d180b
|
Merge pull request #1301 from d4rk-d4nph3/master
Added rule for Fortinet CVE-2018-13379 preauth file read exploitation.
|
2020-12-08 11:09:51 +01:00 |
|
|
Florian Roth
|
b6d62b7a21
|
Merge pull request #1302 from Neo23x0/rule-devel
TA505 Dropper, minor fix in PowerShell Rule
|
2020-12-08 10:40:07 +01:00 |
|
|
Florian Roth
|
2c642c64d2
|
Removed a value
|
2020-12-08 10:38:32 +01:00 |
|
|
Florian Roth
|
a87a81d8cc
|
Update web_fortinet_cve_2018_13379_preauth_read_exploit.yml
|
2020-12-08 10:33:52 +01:00 |
|
|
Florian Roth
|
640470cefd
|
TA505 Loader Rule
|
2020-12-08 10:15:30 +01:00 |
|
|
Bhabesh Rai
|
3ddf940812
|
Added rule for Fortinet CVE-2018-13379 preauth file read exploitation.
|
2020-12-08 14:46:47 +05:45 |
|
|
Simon
|
97fcae56fd
|
Update sigmac.py
|
2020-12-06 20:08:00 +01:00 |
|
|
Florian Roth
|
540039cbc3
|
fix: Malicious Nishang PowerShell Commandlets FP with MDATP
|
2020-12-05 09:33:42 +01:00 |
|
|
Simon
|
4a4d3e1d35
|
Update sigmac.py
|
2020-12-04 18:22:24 +01:00 |
|
|
Simon Hilchenbach
|
a40ef7360d
|
Add sigmac flag to delimit results by NUL instead of \n
|
2020-12-04 18:05:23 +01:00 |
|
|
tjgeorgen
|
1c6c3a36fe
|
include updated RDP att&ck tag
|
2020-12-04 11:59:23 -05:00 |
|
|
tjgeorgen
|
0eda1ab462
|
also update tag for folder variant
|
2020-12-04 11:42:05 -05:00 |
|
|
tjgeorgen
|
5208bdd65a
|
add new version of ATT&CK T1500 tag
|
2020-12-04 11:19:16 -05:00 |
|
|
yugoslavskiy
|
378f663502
|
Update lnx_clear_logs.yml
|
2020-12-02 01:28:29 +01:00 |
|
|
yugoslavskiy
|
6ce08935bb
|
Update lnx_file_deletion.yml
|
2020-12-02 01:27:35 +01:00 |
|
|
yugoslavskiy
|
1c4c5af99f
|
Update lnx_clear_logs.yml
|
2020-12-02 01:24:59 +01:00 |
|
|
Ömer Günal
|
4ab522815b
|
Update lnx_clear_logs.yml
|
2020-12-01 21:28:12 +03:00 |
|
|
Ömer Günal
|
d0bb6e9e81
|
Update lnx_file_deletion.yml
|
2020-12-01 21:24:57 +03:00 |
|
|
yugoslavskiy
|
a028cdf1ee
|
Update powershell_shellcode_b64.yml
|
2020-12-01 02:24:35 +01:00 |
|
|
yugoslavskiy
|
7309fb7d0e
|
Update powershell_winlogon_helper_dll.yml
|
2020-12-01 02:23:02 +01:00 |
|
|
yugoslavskiy
|
36754ae3d5
|
Update win_vul_cve_2020_0688.yml
|
2020-12-01 02:16:22 +01:00 |
|
|
yugoslavskiy
|
0188e45925
|
Update win_malware_script_dropper.yml
|
2020-12-01 02:12:53 +01:00 |
|
|
yugoslavskiy
|
30ecc8bd26
|
Update win_malware_script_dropper.yml
|
2020-12-01 02:08:52 +01:00 |
|
|
yugoslavskiy
|
6494103839
|
Update win_susp_powershell_enc_cmd.yml
|
2020-12-01 01:54:51 +01:00 |
|
|
yugoslavskiy
|
d1b625d080
|
Update win_susp_powershell_enc_cmd.yml
|
2020-12-01 01:51:47 +01:00 |
|
|
yugoslavskiy
|
3cbc2f0aec
|
Update win_susp_powershell_enc_cmd.yml
|
2020-12-01 01:47:23 +01:00 |
|
|
yugoslavskiy
|
816ce5937c
|
Update win_susp_crackmapexec_execution.yml
|
2020-12-01 01:29:35 +01:00 |
|
|
Vasiliy Burov
|
cf8d195c5c
|
Update win_susp_multiple_files_renamed_or_deleted.yml
|
2020-11-30 11:49:42 +03:00 |
|
|
Thomas Patzke
|
2e4c98115d
|
Removed ES query tests
|
2020-11-30 02:29:35 +01:00 |
|
|
Thomas Patzke
|
6e690ad313
|
Removed ES query tests
|
2020-11-30 02:27:50 +01:00 |
|
|
Thomas Patzke
|
3d47d17769
|
Removed ES query tests
|
2020-11-30 02:17:02 +01:00 |
|
|
Thomas Patzke
|
9649cccfbc
|
restore tests
|
2020-11-30 02:16:13 +01:00 |
|
|
Thomas Patzke
|
38a58ec3e7
|
Removed ES query tests
|
2020-11-30 02:12:47 +01:00 |
|
|
Thomas Patzke
|
68153b237f
|
Removed ES query tests
|
2020-11-30 02:11:23 +01:00 |
|
|
Thomas Patzke
|
68cf2a441a
|
Removed ES query tests
|
2020-11-30 02:10:16 +01:00 |
|
|
yugoslavskiy
|
56f94a19f7
|
Update win_regedit_export_keys.yml
|
2020-11-30 02:08:54 +01:00 |
|
|
Thomas Patzke
|
353546d970
|
Removed ES query tests
|
2020-11-30 02:06:20 +01:00 |
|
|
yugoslavskiy
|
0414d7a498
|
Merge branch 'oscd' into master
|
2020-11-30 02:04:03 +01:00 |
|
|
Thomas Patzke
|
13576a63d9
|
Removed ES query tests
|
2020-11-30 02:02:05 +01:00 |
|
|
Thomas Patzke
|
4179c21bbb
|
add sigma-test.yml
|
2020-11-30 02:01:50 +01:00 |
|
|
Thomas Patzke
|
38154c014e
|
Removed ES query tests
|
2020-11-30 01:55:53 +01:00 |
|
|
Thomas Patzke
|
73ce8b2e3b
|
Removed ES query tests
|
2020-11-30 01:54:51 +01:00 |
|
|
Thomas Patzke
|
1417d0332d
|
Removed ES query tests
|
2020-11-30 01:53:09 +01:00 |
|
|
Thomas Patzke
|
a62d0669e7
|
Removed ES query tests
|
2020-11-30 01:52:06 +01:00 |
|
|
Thomas Patzke
|
f4c9ff037d
|
Removed ES query tests
|
2020-11-30 01:48:57 +01:00 |
|
|
yugoslavskiy
|
424f1523d8
|
restore original rule
|
2020-11-30 01:32:06 +01:00 |
|
|
yugoslavskiy
|
e1cd98c97d
|
restore original rule
|
2020-11-30 01:31:00 +01:00 |
|
|
Yugoslavskiy Daniil
|
d812a3e08e
|
resolve conflict restoring rule win_susp_replace_lolbin.yml
|
2020-11-30 01:09:24 +01:00 |
|
|
Yugoslavskiy Daniil
|
98617609d6
|
Merge branch 'oscd' into HEAD
|
2020-11-30 01:07:26 +01:00 |
|
|
Thomas Patzke
|
c6e381bcd5
|
Removed ES query tests
|
2020-11-30 00:57:34 +01:00 |
|