megan201296 74fce5f511 Create apt_oceanlotus_registry.yml ...

Rule based on https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/. Based on OSINT, these keys are unique to the oceanlotus activity and not at all legitimate.

2019-04-14 12:01:52 -05:00

..

apt_apt29_thinktanks.yml

add tags to apt29 thinktanks rule

2019-03-13 09:22:41 +00:00

apt_apt29_tor.yml

fix tags on apt29 tor rule

2019-03-13 09:25:28 +00:00

apt_babyshark.yml

add tags to apt babyshark rule

2019-03-13 09:32:10 +00:00

apt_bear_activity_gtr19.yml

fix and add tags to apt bear activity gtr19 rule

2019-03-13 09:40:28 +00:00

apt_carbonpaper_turla.yml

fix tags in apt carbonpaper turla rule

2019-03-13 09:43:18 +00:00

apt_chafer_mar18.yml

Converted to use the new process_creation data source

2019-03-09 20:57:59 +03:00

apt_cloudhopper.yml

updated to use process_creation

2019-03-02 21:05:15 +03:00

apt_dragonfly.yml

updated to use process_creation

2019-03-02 21:05:15 +03:00

apt_elise.yml

updated to use process_creation

2019-03-02 21:05:15 +03:00

apt_empiremonkey.yml

adjusted link

2019-04-03 16:40:18 +02:00

apt_equationgroup_c2.yml

Fixed log source and field names

2018-08-04 22:58:19 +02:00

apt_equationgroup_dll_u_load.yml

add tags on apt equationgroup dll_u load rule

2019-03-13 09:48:27 +00:00

apt_equationgroup_lnx.yml

Removed duplicate filters

2019-01-25 12:21:57 +03:00

apt_hurricane_panda.yml

Updated to use the new process_creation logsource

2019-03-04 16:13:27 +03:00

apt_judgement_panda_gtr19.yml

Increased indentation to 4

2019-03-02 00:14:20 +01:00

apt_oceanlotus_registry.yml

Create apt_oceanlotus_registry.yml

2019-04-14 12:01:52 -05:00

apt_pandemic.yml

Converted to use the new process_creation data source

2019-03-09 20:57:59 +03:00

apt_slingshot.yml

add tags to apt slingshot rule

2019-03-13 09:50:39 +00:00

apt_sofacy_zebrocy.yml

Updated to use the new process_creation logsource

2019-03-04 16:13:27 +03:00

apt_sofacy.yml

add tags to apt sofacy rule

2019-03-13 09:53:02 +00:00

apt_stonedrill.yml

Add tags to APT rules

2018-07-25 09:50:01 +02:00

apt_ta17_293a_ps.yml

Converted to use the new process_creation data source

2019-03-09 20:57:59 +03:00

apt_tropictrooper.yml

Updated to use the new process_creation logsource

2019-03-04 16:13:27 +03:00

apt_turla_commands.yml

add tags to apt turla commands rule

2019-03-13 10:06:34 +00:00

apt_turla_namedpipes.yml

Replace "logsource: description" with "definition" to match the specs

2018-11-15 09:00:06 +03:00

apt_turla_service_png.yml

fix tagging in turla png dropper service rule

2019-03-02 09:01:00 +00:00

apt_unidentified_nov_18.yml

More conversions to the new process_creation logsource

2019-03-05 09:46:53 +03:00

apt_zxshell.yml

fixed tag typo on rules

2019-03-13 10:25:41 +00:00

crime_fireball.yml

fixed tag typo on rules

2019-03-13 10:25:41 +00:00