yugoslavskiy 82f23c5f63 Merge pull request #477 from zinint/oscd ...

add 13 new rules:

- rules/linux/auditd/lnx_auditd_masquerading_crond.yml 
- rules/linux/auditd/lnx_auditd_user_discovery.yml 
- rules/linux/auditd/lnx_data_compressed.yml 
- rules/linux/auditd/lnx_network_sniffing.yml 
- rules/windows/powershell/powershell_data_compressed.yml 
- rules/windows/powershell/powershell_winlogon_helper_dll.yml 
- rules/windows/process_creation/win_change_default_file_association.yml 
- rules/windows/process_creation/win_data_compressed_with_rar.yml 
- rules/windows/process_creation/win_local_system_owner_account_discovery.yml 
- rules/windows/process_creation/win_network_sniffing.yml 
- rules/windows/process_creation/win_query_registry.yml 
- rules/windows/process_creation/win_service_execution.yml 
- rules/windows/process_creation/win_xsl_script_processing.yml 

modify 1 rule:

- rules/windows/process_creation/win_possible_applocker_bypass.yml

2019-11-05 04:55:29 +03:00

..

auditd

Merge pull request #477 from zinint/oscd

2019-11-05 04:55:29 +03:00

modsecurity

ModSecurity rule: multiple blocks

2017-02-28 17:53:32 +01:00

lnx_buffer_overflows.yml

Update lnx_buffer_overflows.yml

2018-08-25 00:20:34 +02:00

lnx_clamav.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

lnx_shell_clear_cmd_history.yml

Added Additional history clearing options

2019-09-26 12:53:13 -04:00

lnx_shell_priv_esc_prep.yml

Update lnx_shell_priv_esc_prep.yml

2019-09-06 11:29:42 -04:00

lnx_shell_susp_commands.yml

Rule: removed overlapping strings in Linux rule

2019-02-05 16:12:07 +01:00

lnx_shell_susp_log_entries.yml

Linux Generic Rules

2017-05-02 20:32:38 +02:00

lnx_shell_susp_rev_shells.yml

Merge pull request #294 from Pr0t3an/patch-3

2019-04-03 01:07:07 +02:00

lnx_shellshock.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

lnx_ssh_cve_2018_15473.yml

rule: Linux SSHD exploit CVE-2018-15473

2018-08-24 16:40:41 +02:00

lnx_sudo_cve_2019_14287.yml

rule: modified sudo vuln rule to be most generic

2019-10-20 14:02:10 +02:00

lnx_susp_failed_logons_single_source.yml

Adjusted rules to the new specs reg "not null" usage

2018-06-28 09:30:31 +02:00

lnx_susp_jexboss.yml

Linux JexBoss back connect shell

2018-11-08 23:21:36 +01:00

lnx_susp_named.yml

Rule: Linux > named > suspicious activity

2018-02-20 14:56:28 +01:00

lnx_susp_ssh.yml

Rules: Extended and fixed (*) sshd rules

2018-02-20 13:44:06 +01:00

lnx_susp_vsftp.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00