Nasreddine Bencherchali 81f75c1d2e feat: updates and enhancements

2023-01-10 00:13:37 +01:00

..

file_event_win_access_susp_teams.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_access_susp_unattend_xml.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

file_event_win_advanced_ip_scanner.yml

Update Title (#3739)

2022-11-30 11:44:15 +01:00

file_event_win_anydesk_artefact.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_anydesk_writing_susp_binaries.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_apt_unidentified_nov_18.yml

Update title (#3746)

2022-12-02 18:10:43 +01:00

file_event_win_bloodhound_collection.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_crackmapexec_patterns.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_create_evtx_non_common_locations.yml

fix: update evtx tamper rules

2023-01-02 15:25:19 +01:00

file_event_win_create_non_existent_dlls.yml

fix: add modified date

2022-12-09 19:24:44 +01:00

file_event_win_creation_new_shim_database.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_creation_scr_binary_file.yml

Fix FP

2022-11-08 12:32:44 +01:00

file_event_win_creation_system_file.yml

fix: bcdedit by svchost FP

2022-11-10 16:31:54 +01:00

file_event_win_creation_unquoted_service_path.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_cred_dump_tools_dropped_files.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_cscript_wscript_dropper.yml

Update title (#3746)

2022-12-02 18:10:43 +01:00

file_event_win_csharp_compile_artefact.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_cve_2021_1675_printspooler.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

file_event_win_cve_2021_26858_msexchange.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_cve_2021_31979_cve_2021_33771_exploits.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_cve_2021_41379_msi_lpe.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

file_event_win_cve_2021_44077_poc_default_files.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_cve_2022_24527_lpe.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_dcom_iertutil_dll_hijack.yml

Refractor (#3794)

2022-12-18 21:00:14 +01:00

file_event_win_detect_powerup_dllhijacking.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_dll_sideloading_space_path.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_error_handler_cmd_persistence.yml

feat: multiple update and enhancements

2022-12-19 17:41:40 +01:00

file_event_win_exchange_webshell_drop_suspicious.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_exchange_webshell_drop.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_ghostpack_safetykatz.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_gotoopener_artefact.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_hack_dumpert.yml

Update title (#3746)

2022-12-02 18:10:43 +01:00

file_event_win_hivenightmare_file_exports.yml

fix: broken single item lists

2022-12-08 16:23:58 +01:00

file_event_win_hktl_nppspy.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

file_event_win_initial_access_dll_search_order_hijacking.yml

new rules: Sigma rules based on Elastic rules (#3632)

2022-10-28 10:13:44 +02:00

file_event_win_install_teamviewer_desktop.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_inveigh_artefacts.yml

Add Inveigh Rules

2022-10-24 22:57:48 +02:00

file_event_win_iphlpapi_dll_sideloading.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_iso_file_mount.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_iso_file_recent.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_legitimate_app_dropping_archive.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_legitimate_app_dropping_exe.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_legitimate_app_dropping_script.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_lsass_dump.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_lsass_memory_dump_file_creation.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_lsass_shtinkering.yml

feat: updates and enhancements

2022-12-16 16:52:12 +01:00

file_event_win_lsass_werfault_dump.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_macro_file.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_mal_adwind.yml

Update title (#3746)

2022-12-02 18:10:43 +01:00

file_event_win_mal_octopus_scanner.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_mal_vhd_download.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_mimikatz_kirbi_file_creation.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_mimikatz_memssp_log_file.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

file_event_win_moriya_rootkit.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_msdt_autorun.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_net_cli_artefact.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_new_files_in_uncommon_appdata_folder.yml

Add more suspicious extensions

2022-10-28 17:25:41 +02:00

file_event_win_new_src_file.yml

feat: enhance duplicate test (#3736)

2022-11-29 13:47:09 +01:00

file_event_win_notepad_plus_plus_persistence.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_ntds_dit.yml

fix: broken condition

2023-01-06 17:41:30 +01:00

file_event_win_ntds_exfil_tools.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_office_persistence.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_outlook_c2_macro_creation.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_outlook_newform.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_pcre_net_temp_file.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_pingback_backdoor.yml

Update title (#3746)

2022-12-02 18:10:43 +01:00

file_event_win_powershell_exploit_scripts.yml

feat: updates and enhancements

2023-01-10 00:13:37 +01:00

file_event_win_powershell_startup_shortcuts.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_quarkspw_filedump.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_rclone_exec_file.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_redmimicry_winnti_filedrop.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_remote_cred_dump.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_ripzip_attack.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_sam_dump.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_screenconnect_artefact.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_script_creation_by_office_using_file_ext.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_shell_write_susp_directory.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_shell_write_susp_files_extensions.yml

Rename

2022-10-28 13:14:35 +02:00

file_event_win_startup_folder_file_write.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_susp_adsi_cache_usage.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_colorcpl.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_susp_creation_by_mobsync.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_default_gpo_dir_write.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_desktop_ini.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_desktop_txt.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_desktopimgdownldr_file.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_diagcab.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_double_extension.yml

new rule for lnk files with lower score

2022-11-07 14:14:04 +01:00

file_event_win_susp_dropper.yml

fix: fix FP found in testing

2022-12-07 11:52:38 +01:00

file_event_win_susp_exchange_aspx_write.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_executable_creation.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_get_variable.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_lnk_double_extension.yml

new rule for lnk files with lower score

2022-11-07 14:14:04 +01:00

file_event_win_susp_ntds_dit.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_susp_pfx_file_creation.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_powershell_profile.yml

feat: multiple update and enhancements

2022-12-19 17:41:40 +01:00

file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml

feat: general fixes

2022-11-22 01:22:36 +01:00

file_event_win_susp_spool_drivers_color_drop.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_startup_folder_persistence.yml

fix: multiple issues

2023-01-06 18:04:04 +01:00

file_event_win_susp_system_interactive_powershell.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_task_write.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_teamviewer_remote_session.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_susp_vscode_powershell_profile.yml

fix: multiple issues

2023-01-06 18:04:04 +01:00

file_event_win_susp_winword_startup.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_system32_local_folder_privilege_escalation.yml

fix: rename files to fit logic

2022-12-19 19:28:23 +01:00

file_event_win_tool_psexec.yml

Update PsExec Rules

2022-10-26 23:15:01 +02:00

file_event_win_tsclient_filewrite_startup.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_uac_bypass_consent_comctl32.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_uac_bypass_dotnet_profiler.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_uac_bypass_eventvwr.yml

feat: general fixes

2022-11-22 01:22:36 +01:00

file_event_win_uac_bypass_idiagnostic_profile.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_uac_bypass_ieinstal.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_uac_bypass_msconfig_gui.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_uac_bypass_ntfs_reparse_point.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_uac_bypass_winsat.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_uac_bypass_wmp.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_webshell_creation_detect.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_werfault_dll_hijacking.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_winrm_awl_bypass.yml

Update title (#3734)

2022-11-29 07:36:45 +01:00

file_event_win_winword_cve_2021_40444.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_wmi_persistence_script_event_consumer_write.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_wmiexec_default_filename.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_wmiprvse_wbemcomn_dll_hijack.yml

Update title (#3746)

2022-12-02 18:10:43 +01:00

file_event_win_word_template_creation.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_wpbbin_persistence.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_writing_local_admin_share.yml

Order yaml field

2022-10-26 06:16:30 +02:00