frack113 8595478b36 Merge pull request #2149 from OTRF/feature/Sysmon-For-Linux-Rules ...

OTR - Migrating rules to Sysmon for Linux schema :)

2021-10-21 19:10:32 +02:00

..

auditd

rule: coin miner param --cpu-priority

2021-10-09 10:28:16 +02:00

file_create

Rule for Cron activity - file creation

2021-10-16 02:33:01 -04:00

modsecurity

add missing tags

2021-09-07 18:16:46 +02:00

process_creation

Merge pull request #2149 from OTRF/feature/Sysmon-For-Linux-Rules

2021-10-21 19:10:32 +02:00

lnx_apt_equationgroup_lnx.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_base64_decode.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_buffer_overflows.yml

add missing tags

2021-09-07 18:16:46 +02:00

lnx_clamav.yml

add missing tags

2021-09-07 18:16:46 +02:00

lnx_clear_logs.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

lnx_clear_syslog.yml

Update lnx_clear_syslog.yml

2021-09-22 09:46:05 +02:00

lnx_file_and_directory_discovery.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

lnx_file_copy.yml

fix: Correct broken rules, add documentation

2021-08-13 15:46:30 +02:00

lnx_file_deletion.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

lnx_install_root_certificate.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_ldso_preload_injection.yml

add missing tags

2021-09-07 18:16:46 +02:00

lnx_local_account.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_local_groups.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_network_service_scanning.yml

split global lnx_network_service_scanning.yml

2021-09-14 19:27:28 +02:00

lnx_process_discovery.yml

Fix selection with only 1 element

2021-08-14 09:54:27 +02:00

lnx_proxy_connection.yml

restore original rule

2020-11-30 01:32:06 +01:00

lnx_remote_system_discovery.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_schedule_task_job_cron.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_security_software_discovery.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_security_tools_disabling_syslog.yml

split global lnx_security_tools_disabling.yml

2021-09-14 19:32:58 +02:00

lnx_security_tools_disabling.yml

split global lnx_security_tools_disabling.yml

2021-09-14 19:32:58 +02:00

lnx_setgid_setuid.yml

restore the rule

2020-11-28 18:53:13 +01:00

lnx_shell_clear_cmd_history.yml

Updated ART reference links from .yaml

2021-07-06 17:39:25 +08:00

lnx_shell_priv_esc_prep.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_shell_susp_commands.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_shell_susp_log_entries.yml

add missing tags

2021-09-07 18:16:46 +02:00

lnx_shell_susp_rev_shells.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

lnx_shellshock.yml

add missing tags

2021-09-07 18:16:46 +02:00

lnx_space_after_filename_.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_ssh_cve_2018_15473.yml

add missing tags

2021-09-07 18:16:46 +02:00

lnx_sudo_cve_2019_14287_user.yml

split global lnx_sudo_cve_2019_14287.yml

2021-09-14 20:07:13 +02:00

lnx_sudo_cve_2019_14287.yml

split global lnx_sudo_cve_2019_14287.yml

2021-09-14 20:07:13 +02:00

lnx_susp_failed_logons_single_source.yml

add missing tags

2021-09-07 18:16:46 +02:00

lnx_susp_guacamole.yml

add missing tags

2021-09-07 18:16:46 +02:00

lnx_susp_jexboss.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_susp_named.yml

Update lnx_susp_named.yml

2020-11-29 21:31:54 +01:00

lnx_susp_ssh.yml

restore the original file

2020-11-29 21:30:50 +01:00

lnx_susp_vsftp.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_symlink_etc_passwd.yml

add missing tags

2021-09-07 18:16:46 +02:00

lnx_system_info_discovery.yml

Update lnx_system_info_discovery.yml

2021-09-14 21:03:46 +02:00

lnx_system_network_connections_discovery.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_applescript.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_base64_decode.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_binary_padding.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_change_file_time_attr.yml

fix: duplicate UUIDs

2021-05-27 10:29:21 +02:00

macos_clear_system_logs.yml

Fix selection with only 1 element

2021-08-14 09:54:27 +02:00

macos_create_account.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_create_hidden_account.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_creds_from_keychain.yml

Changed selections and condition

2020-11-27 19:23:31 +01:00

macos_disable_security_tools.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_emond_launch_daemon.yml

Sigma rule

2020-10-23 10:16:59 +02:00

macos_file_and_directory_discovery.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_find_cred_in_files.yml

fix: duplicate UUIDs

2021-05-27 10:29:21 +02:00

macos_gui_input_capture.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_local_account.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_local_groups.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_network_service_scanning.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_network_sniffing.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_remote_system_discovery.yml

fix: duplicate UUIDs

2021-05-27 10:29:21 +02:00

macos_schedule_task_job_cron.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_screencapture.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_security_software_discovery.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_split_file_into_pieces.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_startup_items.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_susp_histfile_operations.yml

added fish to macos rule

2020-10-17 02:37:21 +03:00

macos_suspicious_macos_firmware_activity.yml

Create macos_suspicious_macos_firmware_activity.yml

2021-09-30 18:47:15 -05:00

macos_system_network_connections_discovery.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_system_network_discovery.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_system_shutdown_reboot.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_xattr_gatekeeper_bypass.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00