bd1b4c0d70
Merge pull request #1978 from rachelrice/update_aws_login
...
Update AWS Update Login Profile rule
2021-09-03 08:12:28 +02:00
1fc2a39720
Merge pull request #1975 from frack113/red_T1564.004_2
...
Redcanary t1564.004 test 2
2021-09-03 08:12:08 +02:00
b0f8275f72
Merge pull request #1977 from rachelrice/update_aws_assumerole
...
Update AWS STS AssumeRole Misuse rule
2021-09-03 08:11:52 +02:00
11e4b900e4
Update global id
2021-09-03 06:59:40 +02:00
135d0a2c61
Update global id
2021-09-03 06:50:00 +02:00
a6bb5574fb
Update global id
2021-09-03 06:35:35 +02:00
ba41e922d2
adding Petitpotam host detections
2021-09-03 00:12:49 -04:00
775c0e8e7f
Update azure_app_credential_modification.yml
2021-09-02 21:00:21 -05:00
643ec0abe3
Update azure_service_principal_created.yml
2021-09-02 21:00:02 -05:00
10af7bbdb1
Create azure_app_credential_modification.yml
2021-09-02 20:53:32 -05:00
d25fd420d6
Create azure_service_principal_created.yml
2021-09-02 20:48:35 -05:00
1272c76ae7
Create azure_network_firewall_policy_modified_or_deleted.yml
2021-09-02 20:31:27 -05:00
d02ee1eddd
Update global ID
2021-09-02 21:16:55 +02:00
f90c7558a7
update global id
2021-09-02 21:03:25 +02:00
ac90ee0002
Update global ID
2021-09-02 20:23:23 +02:00
086a15fc45
Update global ID
2021-09-02 20:07:03 +02:00
78d3fa4795
Update AWS STS AssumeRole Misuse rule
...
Update selection criteria for AWS STS AssumeRole Misuse rule for any event by an AssumedRole userIdentity.
Closes SigmaHQ/sigma#1963 .
2021-09-02 17:40:35 +01:00
7ccb773b20
Update AWS Update Login Profile rule
...
Update selection criteria for AWS Update Login Profile rule to check for mismatch between userIdentity.arn and requestParameters.userName.
Closes SigmaHQ/sigma#1966 .
2021-09-02 17:37:41 +01:00
9bcefc6a93
move uuid from global
2021-09-02 16:05:05 +02:00
b731c20594
Merge pull request #1971 from phantinuss/master
...
fix: prevent possible FPs
2021-09-02 15:34:46 +02:00
a048403089
Merge pull request #1973 from klingerko/cs_namedpipe_updates
...
Remove duplicate and regex improvements
2021-09-02 15:25:01 +02:00
ab721c736c
chore: move level/falsepositives to bottom
2021-09-02 14:55:17 +02:00
15e25f9635
update modifed date
2021-09-02 14:50:14 +02:00
0b373ff1e9
fix: remove 2nd selection due to FPs
2021-09-02 14:47:47 +02:00
6a1b95d947
Findstr covert by win_susp_findstr.yml
2021-09-02 14:22:59 +02:00
aaa568ff2d
print covert by win_susp_print.yml
2021-09-02 14:18:38 +02:00
5cb6eed52e
fix: remove single value lists
2021-09-02 14:09:03 +02:00
f4a5df67ae
further narrowing down of the selection, therefore removing the filter
2021-09-02 10:28:01 +02:00
90e673e5ac
fix invalid tags
2021-09-02 10:17:50 +02:00
0603581111
Merge pull request #1969 from SigmaHQ/rule-devel
...
More Named Pipe Rules and WMI rule refactoring
2021-09-02 10:15:00 +02:00
6f1f70ca5e
Add missing tags
2021-09-02 09:59:19 +02:00
25c6f69ea3
update references
2021-09-02 09:51:44 +02:00
5e87970c77
add powershell_store_file_in_alternate_data_stream.yml
2021-09-02 09:47:54 +02:00
5212b388c6
Merge pull request #1967 from d4rk-d4nph3/master
...
Added rule for detection of Atera RMM Agent installation
2021-09-02 09:19:49 +02:00
51bc036dbf
Merge pull request #1921 from roysjosh/azure-sentinel-arm-output
...
Azure Sentinel support
2021-09-01 22:26:42 +02:00
3d6ad1bc0f
Merge pull request #1944 from ncrqnt/elastic-subtechniques
...
[Elastic] Add support for authors and subtechniques
2021-09-01 22:25:10 +02:00
6d3f7069e6
Merge pull request #1962 from neu5ron/qoutes_and_wildcards
...
Elasticsearch Backend fix small corner cases of quotes and wildcards
2021-09-01 22:08:40 +02:00
e0cd35261c
add missing tags
2021-09-01 20:01:03 +02:00
1ba0a7c7a3
add missing tags
2021-09-01 19:38:35 +02:00
457da818a4
regex optimisations
2021-09-01 17:06:55 +02:00
e83ee55573
remove duplicate
2021-09-01 17:05:36 +02:00
b0c2d7b75a
fix: tags for WMI / execution / persistence
2021-09-01 16:34:50 +02:00
2f7f050ad8
fix: removed tags
2021-09-01 16:32:27 +02:00
0b38237dbf
fix: add relation to now obsolete rule
2021-09-01 15:38:29 +02:00
ae9966bdcc
fix: unifying two overlapping rules
2021-09-01 14:48:32 +02:00
deefcaa8ac
fix: prevent possible FPs with the respective command only used as the last parameter
2021-09-01 14:33:46 +02:00
434c3891ff
Merge pull request #1965 from frack113/add_tags
...
Add tags when missing
2021-09-01 14:07:31 +02:00
1aac21ba79
fix: single list item issue
2021-09-01 14:03:42 +02:00
1c4f642227
Merge pull request #1699 from matsto/patch-1
...
Fixed transformation modifier for keywords
2021-09-01 14:02:10 +02:00
2dbbaf0180
fix missing char in date
2021-09-01 14:00:55 +02:00
frack113