fukusuket 8b5a254d4f fix: update modified

2023-03-04 20:40:48 +09:00

..

zeek

No filetype or bodyMagic in zeek http log field

2021-11-14 09:24:34 +01:00

dns_query_win_possible_dns_rebinding.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

driver_load_invoke_obfuscation_clip+_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_obfuscated_iex_services.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

driver_load_invoke_obfuscation_stdin+_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_var+_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_via_compress_services.yml

fix: update modified

2023-03-04 20:40:48 +09:00

driver_load_invoke_obfuscation_via_rundll_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_via_stdin_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_via_use_clip_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_via_use_mshta_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_via_use_rundll32_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_via_var++_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_meterpreter_or_cobaltstrike_getsystem_service_installation.yml

feat: filename test enhancements (#3812)

2022-12-23 09:25:16 +01:00

driver_load_tap_driver_installation.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

file_event_executable_and_script_creation_by_office_using_file_ext.yml

Update Ref+Selection 3

2022-07-11 18:12:51 +01:00

image_load_mimikatz_inmemory_detection.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

lnx_auditd_omigod_scx_runasprovider_executescript.yml

Fix auditd field name

2021-11-11 10:13:48 +01:00

net_dns_high_subdomain_rate.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

net_dns_large_domain_name.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

net_possible_dns_rebinding.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

posh_ps_cl_invocation_lolscript_count.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

posh_ps_cl_mutexverifiers_lolscript_count.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

proc_creation_win_correlation_apt_silence_downloader_v3.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

proc_creation_win_correlation_apt_turla_commands_medium.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

proc_creation_win_correlation_dnscat2_powershell_implementation.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

proc_creation_win_correlation_multiple_susp_cli.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

proc_creation_win_correlation_susp_builtin_commands_recon.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

sysmon_always_install_elevated_msi_spawned_cmd_and_powershell_spawned_processes.yml

fix: remove penetration test as valid false positive reason

2022-03-16 14:33:18 +01:00

sysmon_always_install_elevated_parent_child_correlated.yml

fix: remove penetration test as valid false positive reason

2022-03-16 14:33:18 +01:00

sysmon_non_priv_program_files_move.yml

Integrity do not exist in file_event

2021-11-10 19:51:01 +01:00

sysmon_process_reimaging.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

win_access_fake_files_with_stored_credentials.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_apt_apt29_tor.yml

fix: Service Installation 7045 field confusion

2022-03-21 11:10:03 +01:00

win_dumping_ntdsdit_via_dcsync.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_dumping_ntdsdit_via_netsync.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_kernel_and_3rd_party_drivers_exploits_token_stealing.yml

refactor: rule level adjustments - critical to high

2022-06-18 17:43:22 +02:00

win_mal_service_installs.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_metasploit_or_impacket_smb_psexec_service_install.yml

fix: Service Installation 7045 field confusion

2022-03-21 11:10:03 +01:00

win_possible_privilege_escalation_using_rotten_potato.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_remote_schtask.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_remote_service.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_security_global_catalog_enumeration.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_security_rare_schtasks_creations.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_security_susp_failed_logons_explicit_credentials.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_security_susp_failed_logons_single_source2.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_security_susp_failed_logons_single_source.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_security_susp_failed_remote_logons_single_source.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_security_susp_multiple_files_renamed_or_deleted.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_security_susp_samr_pwset.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_susp_failed_hidden_share_mount.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_suspicious_werfault_connection_outbound.yml

ParentImage do not exist in network_connection

2021-11-10 19:38:05 +01:00

win_system_rare_service_installs.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_taskscheduler_rare_schtask_creation.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00