Thomas Patzke 96eb460944 Converted Sysmon/1 and Security/4688 to generic process creation rules

2019-01-16 23:36:31 +01:00

..

sysmon_ads_executable.yml

Replace "logsource: description" with "definition" to match the specs

2018-11-15 09:00:06 +03:00

sysmon_cmstp_execution.yml

Further ATT&CK tagging

2018-07-19 23:36:13 +02:00

sysmon_cobaltstrike_process_injection.yml

rule: Cobalt Strike beacon detection via Remote Threat Creation

2018-11-30 10:25:05 +01:00

sysmon_dhcp_calloutdll.yml

Cleaning up empty list items

2018-01-28 02:36:39 +03:00

sysmon_dns_serverlevelplugindll.yml

Simplified rule conditions with new condition constructs

2018-03-06 23:14:43 +01:00

sysmon_ghostpack_safetykatz.yml

Cosmetics

2018-07-25 07:37:17 +02:00

sysmon_logon_scripts_userinitmprlogonscript.yml

Rule: UserInitMprLogonScript persistence method

2019-01-12 12:03:36 +01:00

sysmon_mal_namedpipes.yml

Replace "logsource: description" with "definition" to match the specs

2018-11-15 09:00:06 +03:00

sysmon_malware_backconnect_ports.yml

Replace "logsource: description" with "definition" to match the specs

2018-11-15 09:00:06 +03:00

sysmon_malware_verclsid_shellcode.yml

Replace "logsource: description" with "definition" to match the specs

2018-11-15 09:00:06 +03:00

sysmon_mimikatz_detection_lsass.yml

ATT&CK tagging QA

2018-09-20 12:44:44 +02:00

sysmon_mimikatz_inmemory_detection.yml

added a few mitre attack tags to windows sysmon rules

2018-07-26 21:15:07 -07:00

sysmon_password_dumper_lsass.yml

ATT&CK tagging

2018-07-17 23:58:11 +02:00

sysmon_powershell_exploit_scripts.yml

Add ATT&CK Matrix tags

2018-08-22 09:30:55 -05:00

sysmon_powershell_network_connection.yml

Corrected class B private IP range to prevent false negatives

2019-01-04 12:50:41 +03:00

sysmon_powersploit_schtasks.yml

Update sysmon_powersploit_schtasks.yml

2018-10-09 19:10:37 -05:00

sysmon_quarkspw_filedump.yml

Various rule fixes

2018-03-27 14:35:49 +02:00

sysmon_rundll32_net_connections.yml

Corrected class B private IP range to prevent false negatives

2019-01-04 12:50:41 +03:00

sysmon_stickykey_like_backdoor.yml

Fixed tag

2018-07-24 07:58:25 +02:00

sysmon_susp_driver_load.yml

Update sysmon_susp_driver_load.yml

2018-07-13 18:36:12 -05:00

sysmon_susp_image_load.yml

user subTee was removed from Twitter

2018-07-04 17:29:05 +02:00

sysmon_susp_powershell_rundll32.yml

Update sysmon_susp_powershell_rundll32.yml

2018-10-09 19:11:47 -05:00

sysmon_susp_prog_location_network_connection.yml

Rule: false positive reduction in rule

2018-12-17 10:02:55 +01:00

sysmon_susp_reg_persist_explorer_run.yml

Corrected reference to references as per Sigma's standard

2018-12-25 16:25:12 +03:00

sysmon_susp_run_key_img_folder.yml

Rule simplification

2018-09-28 10:58:50 +03:00

sysmon_sysinternals_eula_accepted.yml

Rule: SysInternals EULA accept improved and renamed

2018-08-30 13:16:28 +02:00

sysmon_uac_bypass_eventvwr.yml

Fixed tags

2018-08-07 08:20:09 +02:00

sysmon_uac_bypass_sdclt.yml

Tag fixes

2018-08-07 08:18:16 +02:00

sysmon_win_binary_github_com.yml

Rule: Improved Github communication rule

2018-08-30 10:12:12 +02:00

sysmon_win_binary_susp_com.yml

Rule: Suspicious communication endpoints

2018-08-30 10:12:12 +02:00

sysmon_win_reg_persistence.yml

changed .yaml files to .yml for consistency

2018-11-20 21:07:36 -08:00

sysmon_wmi_event_subscription.yml

Rule: WMI Event Subscription

2019-01-12 12:03:36 +01:00

sysmon_wmi_persistence_commandline_event_consumer.yml

added a few mitre attack tags to windows sysmon rules

2018-07-26 21:15:07 -07:00

sysmon_wmi_persistence_script_event_consumer_write.yml

added a few mitre attack tags to windows sysmon rules

2018-07-26 21:15:07 -07:00