f69ac5c345
Merge PR #5714 from @RobertN87 - Add missing MITRE tactics for 2 rules
...
chore: add missing MITRE tactics for 2 rules
2025-10-21 20:17:56 +02:00
ac1137183f
Merge PR #5090 from @CheraghiMilad - add rule for impair system power settings
...
new: Mask System Power Settings Via Systemctl
---------
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com >
Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com >
2025-10-20 08:24:44 +05:45
208fee50a0
Merge PR #5658 from @swachchhanda000 - feat: shai hulud worm targeting npm supply chain attack
...
new - Shai-Hulud Malicious GitHub Workflow Creation
new - Shai-Hulud NPM Attack GitHub Activity
new - Shai-Hulud NPM Package Malicious Exfiltration via Curl
new - PUA - TruffleHog Execution
new - PUA - TruffleHog Execution - Linux
2025-10-19 07:28:08 +05:45
f4e9d5f3c4
Merge PR #5671 from @swachchhanda000 - feat: add detection rules for CVE-2025-32463 sudo chroot vulnerability
...
new: Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation
new: Linux Sudo Chroot Execution
---------
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2025-10-19 07:21:26 +05:45
de97c83224
Merge PR #5533 from @swachchhanda000 - fix: github reported issues
...
new: AWS IAM user with Console Access Login Without MFA (#5074 )
new: Suspicious BitLocker Access Agent Update Utility Execution (#5502 )
new: BaaUpdate.exe Suspicious DLL Load
update: Suspicious C2 Activities - update definition (#5142 )
fix: Firewall Configuration Discovery Via Netsh.EXE - fix logic (#5171 )
fix: WannaCry Ransomware Activity - remove generic indicators (#5131 )
fix: Rare Remote Thread Creation By Uncommon Source Image - filter office FPs (#5529 )
---------
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2025-10-18 07:07:22 +05:45
84425b8889
Merge PR #5677 from @vl43den - Modify System Firewall - add nftables delete/flush
...
update: Modify System Firewall - add nftables delete/flush
---------
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-10-17 11:56:55 +02:00
15b9599eb0
Change alert level from high to medium
2025-08-29 10:34:46 +02:00
4ba778f030
fix: potentially suspicious execution from tmp folder - nextcloud fp from tmp folder
2025-08-08 15:01:07 +05:45
4316ad64da
Merge PR #5506 from @nasbench -promote older rules status from experimental to test
...
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-07-01 10:34:38 +02:00
8fd6a5167d
Merge PR #5489 from @hashdr1ft - Suspicious Download and Execute Pattern via Curl/Wget
...
new: Suspicious Download and Execute Pattern via Curl/Wget
---------
Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com >
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2025-06-25 12:48:57 +02:00
0304ffbbd6
Merge PR #5050 from @wieso-itzi - detect vacuuming of journald for log clearing
...
update: Commands to Clear or Remove the Syslog - detect journald vacuuming
---------
Signed-off-by: wieso-itzi <85185077+wieso-itzi@users.noreply.github.com >
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2025-06-24 13:29:27 +02:00
39537caa0d
Merge PR #5486 from @phantinuss - fix: reduce FP matching with regex pattern
...
fix: Hidden Files and Directories - reduce FP matching with regex pattern
2025-06-24 10:35:56 +02:00
dfed136f16
Merge PR #5477 from @phantinuss - chore: update MITRE tag t1219 to t1219.002
...
chore: update MITRE tag t1219 to t1219.002
2025-06-13 10:00:52 +02:00
ff60fa5f91
Merge PR #5444 from @CheraghiMilad - Discovery System Info via Sysinfo Syscall
...
new: System Info Discovery via Sysinfo Syscall
---------
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com >
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-06-05 13:53:57 +02:00
4c8e709469
Merge PR #5446 from @CheraghiMilad - Special File Creation via Mknod Syscall
...
new: Special File Creation via Mknod Syscall
---------
Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com >
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2025-06-05 13:27:24 +02:00
298e18c9c2
Merge PR #5467 from @phantinuss - use syscall names instead of ids
...
the integration pipeline or the rule consumer has to take care of the mapping
update: Audio Capture - use syscall name instead of id
update: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall - use syscall name instead of id
update: Disable ASLR Via Personality Syscall - Linux - use syscall name instead of id
2025-06-05 13:25:58 +02:00
0f4572c9ac
Merge PR #5459 from @CheraghiMilad - add execveat and match on euid instead of key
...
update: Webshell Remote Command Execution - add execveat and match on euid instead of key
---------
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2025-06-05 13:22:24 +02:00
2fda33e611
Merge PR #5461 from @CheraghiMilad - add uname
...
update: System Owner or User Discovery - Linux - add uname
---------
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-06-05 13:20:16 +02:00
6509b21b82
Merge PR #5462 from @CheraghiMilad - add text output tools
...
update: Local Groups Discovery - Linux - add text output tools
---------
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-06-05 13:19:27 +02:00
0627225cab
Merge PR #5463 from @CheraghiMilad - add more text output tools ( #5463 )
...
update: Access of Sudoers File Content - add more tools
---------
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2025-06-05 13:19:04 +02:00
3eaaa050b7
Merge PR #5452 from @david-syk - Update the MITRE ATT&CK tags for multiple rules
...
chore: update the MITRE ATT&CK tags for multiple rules
2025-06-04 14:39:25 +02:00
74fc1c74ec
Merge PR #5451 from @frack113 - chore: cleanup metadata
...
chore: 🧹 Remove redundant modified field
chore: 🧹 Use Mitre tags instead of url
chore: 🧹 Use permalink for github file reference
chore: 🧹 Order emerging-threats Exploits rules
2025-06-04 13:33:36 +02:00
ad1bfd3d28
Merge PR #5438 from @CheraghiMilad - new: clean dmesg logs
...
new: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall
---------
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com >
2025-05-31 14:24:43 +02:00
a5e070fc9d
Merge PR #5441 from @CheraghiMilad - chore: update reference
...
chore: Disable ASLR Via Personality Syscall - Linux - update reference for PoC
---------
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2025-05-31 14:08:26 +02:00
5a1e44c525
Merge PR #5432 from @CheraghiMilad - Potential Abuse of Linux Magic System Request Key
...
new: Potential Abuse of Linux Magic System Request Key
---------
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com >
2025-05-31 13:12:25 +02:00
9ebd94a00a
Merge PR #5435 from @CheraghiMilad - Disable ASLR Via Personality Syscall - Linux
...
new: Disable ASLR Via Personality Syscall - Linux
---------
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com >
2025-05-28 13:29:58 +02:00
304b019212
Merge PR #5385 from @CheraghiMilad - Added new tool for recording audio - ecasound
...
Create Release / Create Release (push) Has been cancelled
update: Audio Capture - add ecasound detection
---------
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com >
2025-05-21 09:10:51 +02:00
b0481bea13
Merge PR #5393 from @Koifman - Update VMware rules for MITREv17
...
update: proc_creation_lnx_esxcli_vm_kill.yml - updating MITRE to match v17
update: proc_creation_lnx_esxcli_vsan_discovery.yml - updating MITRE to match v17
update: proc_creation_lnx_esxcli_system_discovery.yml - updating MITRE to match v17
update: proc_creation_lnx_esxcli_network_discovery.yml - updating MITRE to match v17
update: proc_creation_lnx_esxcli_storage_discovery.yml - updating MITRE to match v17
update: proc_creation_lnx_esxcli_syslog_config_change.yml - updating MITRE to match v17
update: proc_creation_lnx_esxcli_user_account_creation.yml - updating MITRE to match v17
update: proc_creation_lnx_esxcli_permission_change_admin.yml - updating MITRE to match v17
update: proc_creation_lnx_esxcli_vm_discovery.yml - updating MITRE to match v17
---------
Co-authored-by: Koifman <primeless42@gmail.com >
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
2025-05-21 08:39:49 +02:00
6fe3ac8a02
Merge PR #5389 from @david-syk - Update MITRE ATT&CK tags
...
chore: update the tags of multiple rules
2025-05-20 23:09:50 +02:00
efcfe43fae
Merge PR #5388 from @david-syk - Update MITRE ATT&CK tags
...
chore: update the tags of multiple rules
2025-05-20 23:09:23 +02:00
f255ba29e6
Merge PR #5390 from @david-syk - Update MITRE ATT&CK tags
...
chore: update the tags of multiple rules
2025-05-20 23:08:57 +02:00
350fec2f51
Merge PR #5397 from @nasbench - Promote older rules status from experimental to test
...
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-05-20 22:58:46 +02:00
29ad6f9617
Merge PR #5249 from @nasbench - Promote older rules status from experimental to test
...
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-04-17 00:41:35 +02:00
357838c404
Merge PR #5237 from @Neo23x0 - Update Buffer Overflow Attempts
...
update: Buffer Overflow Attempts - Enhance and reworked logic with new keywords
2025-04-07 11:08:55 +02:00
a719612ab8
Merge PR #5098 from @CheraghiMilad - Update Service Reload or Start - Linux
...
update: Service Reload or Start - Linux - Add additional flags and binaries used to changes services status
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-03-05 00:50:23 +01:00
64852d95a9
Merge PR #5216 from @nasbench - Promote older rules status from experimental to test
...
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-03-05 00:23:27 +01:00
2bfb0935a0
Merge PR #5177 from @nasbench - promote older rules status from experimental to test
...
Create Release / Create Release (push) Has been cancelled
chore: promote older rules status from `experimental` to `test`
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2025-02-03 18:23:12 +01:00
a99b163c93
Merge PR #5166 from @frack113 - Fix Privileged User Has Been Created
...
fix: Privileged User Has Been Created - Add missing comma to avoid false positives
2025-01-22 22:30:58 +01:00
06a5d08508
Merge PR #5163 from @Neo23x0 - Add/Update Rsync Linux Rules
...
update: Shell Execution via Rsync - Linux - Rework logic to make it more generic and include additional shells.
new: Suspicious Invocation of Shell via Rsync
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-01-19 21:55:40 +01:00
957c1fc3d9
Merge PR #5119 from @CheraghiMilad - Update Terminate Linux Process Via Kill
...
update: Terminate Linux Process Via Kill - Add "xkill"
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2024-12-14 22:26:02 +02:00
44775b80b9
Merge PR #5117 from @CheraghiMilad - Update Process Discovery
...
update: Process Discovery - Add additional processes like "htop" and "atop"
---------
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com >
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2024-12-14 22:24:15 +02:00
c6b7a19b59
Merge PR #5099 from @CheraghiMilad - Update Local System Accounts Discovery - Linux
...
update: Local System Accounts Discovery - Linux - Add additional binaries to read password files such as "less" and "emacs" as well as additional password file locations such as "/etc/pwd.db"
2024-12-14 20:49:32 +02:00
aac4335550
Merge PR #5102 from @CheraghiMilad - Update Password Policy Discovery - Linux
...
update: Password Policy Discovery - Linux - Add additional new paths for "pam.d" , namely "/etc/pam.d/common-account", "/etc/pam.d/common-auth" and "/etc/pam.d/auth"
---------
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com >
2024-12-01 14:09:27 +01:00
c8e1d66a35
Merge PR #5091 from @CheraghiMilad - Update File and Directory Discovery - Linux
...
update: File and Directory Discovery - Linux - Add 2 additional binaries, "findmnt" and "mlocate"
---------
Co-authored-by: Milad Cheraghi <cheraghimiladmail@gmail.com >
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com >
2024-12-01 14:07:54 +01:00
af41386535
Merge PR #5097 from @CheraghiMilad - Update System Owner or User Discovery - Linux
...
update: System Owner or User Discovery - Linux - Add 4 additional tools that can be used for host and user discovery: "whoami", "hostname", "id", "last"
---------
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com >
2024-12-01 13:51:14 +01:00
d0e4e78f7a
Merge PR #5086 from @AlbinoGazelle - Update ESXCLI reference docs after Broadcom acquisition of VMWare
...
chore: update broken references to ESXCLI rules
2024-11-20 20:44:32 +01:00
4f4ef7a8cc
Merge PR #5042 from @wieso-itzi - Update Python PTY rules
...
Create Release / Create Release (push) Has been cancelled
update: Python Spawning Pretty TTY Via PTY Module - Update the logic to account for the possibility of calling the spawn function via a variable, as an alias or other methods.
update: Python Reverse Shell Execution Via PTY And Socket Modules - Add additional strings to increase accuracy and coverage.
---------
Signed-off-by: wieso-itzi <85185077+wieso-itzi@users.noreply.github.com >
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com >
2024-11-04 12:15:00 +01:00
d270dc542c
Merge PR #5039 from @CheraghiMilad - Update Local System Accounts Discovery - Linux
...
update: Local System Accounts Discovery - Linux - Increase coverage by adding additional utilities such as "nano", "tail, "vim"
---------
Co-authored-by: Milad Cheraghi <cheraghimiladmail@gmail.com >
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com >
2024-10-08 22:09:13 +02:00
08c52c367c
Merge PR #5027 from @nasbench - Promote older rules status from experimental to test
...
chore: promote older rules status from experimental to test
Co-authored-by: nasbench <nasbench@users.noreply.github.com >
2024-10-01 14:56:09 +02:00
35a5eb9a4c
Merge PR #5013 from @ruppde - Update linux scanning rules
...
update: Linux HackTool Execution - Remove "zenmap" and "nmap" as they are already covered by 3e102cd9-a70d-4a7a-9508-403963092f31
update: Linux Network Service Scanning Tools Execution - Add "zenmap" utility
2024-09-22 19:29:20 +02:00
RobertN87