Florian Roth 28664dbf5a Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing

2021-12-06 16:35:34 +01:00

..

registry_event_abusing_windows_telemetry_for_persistence.yml

convert re to endswith

2021-09-24 15:39:56 +02:00

registry_event_apt_chafer_mar18.yml

Missing status in rules (#2284)

2021-11-19 22:32:26 +01:00

registry_event_apt_pandemic.yml

split sysmon_apt_pandemic

2021-09-12 09:42:11 +02:00

registry_event_cve_2021_31979_cve_2021_33771_exploits.yml

Add cve tags

2021-10-25 18:14:03 +02:00

registry_event_defender_disabled.yml

Create new rule for detecting Microsfot Defender Tampering via Registry

2021-10-18 10:07:44 +04:00

registry_event_defender_exclusions.yml

split global win_defender_exclusions.yml

2021-09-21 10:16:25 +02:00

registry_event_defender_realtime_protection_disabled.yml

Create new rule for detecting Microsfot Defender Tampering via Registry

2021-10-18 10:07:44 +04:00

registry_event_dns_serverlevelplugindll.yml

split sysmon_dns_serverlevelplugindll.yml

2021-09-12 09:53:20 +02:00

registry_event_mal_adwind.yml

split win_mal_adwind.yml

2021-09-19 10:12:03 +02:00

registry_event_mstsc_history_cleared.yml

feat: mstsc history cleared

2021-10-19 18:30:02 +02:00

registry_event_net_ntlm_downgrade.yml

Missing status in rules (#2284)

2021-11-19 22:32:26 +01:00

registry_event_stickykey_like_backdoor.yml

Missing status in rules (#2284)

2021-11-19 22:32:26 +01:00

registry_event_sysinternals_eula_accepted.yml

split sysinternals eula and uac bypass

2021-09-12 09:38:05 +02:00

registry_event_uac_bypass_eventvwr.yml

fix TargetObject HKCU

2021-09-13 12:45:10 +02:00

registry_event_uac_bypass_winsat.yml

fix duplicate name file

2021-09-20 09:31:04 +02:00

registry_event_uac_bypass_wmp.yml

fix duplicate name file

2021-09-20 09:31:04 +02:00

sysmon_apt_leviathan.yml

fix TargetObject HK

2021-09-13 13:16:16 +02:00

sysmon_apt_oceanlotus_registry.yml

Update sysmon_apt_oceanlotus_registry

2021-09-17 19:50:30 +02:00

sysmon_asep_reg_keys_modification.yml

fix: FPs noticed with Aurora

2021-12-06 16:09:50 +01:00

sysmon_bypass_via_wsreset.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_cmstp_execution_by_registry.yml

fix 3 times the same name file

2021-07-02 11:01:07 +02:00

sysmon_cobaltstrike_service_installs.yml

Merging upstream updates

2021-07-01 12:18:30 +05:45

sysmon_comhijack_sdclt.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_cve_2020_1048.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_dhcp_calloutdll.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_disable_microsoft_office_security_features.yml

Merging upstream updates

2021-07-01 12:18:30 +05:45

sysmon_disable_security_events_logging_adding_reg_key_minint.yml

Change status for old rules

2021-11-27 11:47:03 +01:00

sysmon_disable_wdigest_credential_guard.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_disabled_exploit_guard_network_protection_on_microsoft_defender.yml

Create sysmon_disabled_exploit_guard_network_protection_on_microsoft_defender.yml

2021-08-04 19:11:00 -05:00

sysmon_disabled_pua_protection_on_microsoft_defender.yml

Update sysmon_disabled_pua_protection_on_microsoft_defender.yml

2021-08-04 17:00:34 -05:00

sysmon_disabled_tamper_protection_on_microsoft_defender.yml

Create sysmon_disabled_tamper_protection_on_microsoft_defender.yml

2021-08-04 19:08:10 -05:00

sysmon_dns_over_https_enabled.yml

Update sysmon_dns_over_https_enabled.yml

2021-09-09 08:04:54 +07:00

sysmon_enabling_cor_profiler_env_variables.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_etw_disabled.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_hack_wce_reg.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_hybridconnectionmgr_svc_installation.yml

Add Technique tags

2021-11-20 09:53:35 +01:00

sysmon_logon_scripts_userinitmprlogonscript_reg.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_modify_screensaver_binary_path.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_narrator_feedback_persistance.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_new_application_appcompat.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_new_dll_added_to_appcertdlls_registry_key.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_new_dll_added_to_appinit_dlls_registry_key.yml

updating modified date and author fields

2021-11-11 20:34:00 +00:00

sysmon_office_test_regadd.yml

fix TargetObject HK

2021-09-13 13:16:16 +02:00

sysmon_office_vsto_persistence.yml

Tune false positive

2021-07-27 09:58:00 +02:00

sysmon_powershell_as_service.yml

Merging upstream updates

2021-07-01 12:18:30 +05:45

sysmon_rdp_registry_modification.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_rdp_settings_hijack.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_redmimicry_winnti_reg.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_reg_office_security.yml

Added latest McAfee zloader's reference for Office Security Settings Changed

2021-07-12 16:56:21 +05:45

sysmon_reg_silentprocessexit_lsass.yml

Missing status in rules (#2284)

2021-11-19 22:32:26 +01:00

sysmon_reg_silentprocessexit.yml

Missing status in rules (#2284)

2021-11-19 22:32:26 +01:00

sysmon_reg_vbs_payload_stored.yml

add missing tags

2021-09-01 19:38:35 +02:00

sysmon_registry_add_local_hidden_user.yml

Merging upstream updates

2021-07-01 12:18:30 +05:45

sysmon_registry_persistence_key_linking.yml

fix detection

2021-09-17 19:52:40 +02:00

sysmon_registry_persistence_search_order.yml

fix: FPs noticed with Aurora

2021-12-03 23:47:37 +01:00

sysmon_registry_susp_printer_driver.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_registry_trust_record_modification.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_removal_amsi_registry_key.yml

Merging upstream updates

2021-07-01 12:18:30 +05:45

sysmon_removal_com_hijacking_registry_key.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_runkey_winekey.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_runonce_persistence.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_ssp_added_lsa_config.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_susp_atbroker_change.yml

Missing status in rules (#2284)

2021-11-19 22:32:26 +01:00

sysmon_susp_download_run_key.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_susp_lsass_dll_load.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_susp_mic_cam_access.yml

Missing status in rules (#2284)

2021-11-19 22:32:26 +01:00

sysmon_susp_reg_persist_explorer_run.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_susp_run_key_img_folder.yml

add temp folder

2021-10-30 17:28:07 +02:00

sysmon_susp_service_installed.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_suspicious_keyboard_layout_load.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_sysinternals_sdelete_registry_keys.yml

Merging upstream updates

2021-07-01 12:18:30 +05:45

sysmon_taskcache_entry.yml

fix: FPs noticed with Aurora

2021-12-06 16:35:32 +01:00

sysmon_uac_bypass_sdclt.yml

fix detection

2021-09-17 19:54:50 +02:00

sysmon_volume_shadow_copy_service_keys.yml

Merging upstream updates

2021-07-01 12:18:30 +05:45

sysmon_wab_dllpath_reg_change.yml

Merging upstream updates

2021-07-01 12:18:30 +05:45

sysmon_wdigest_enable_uselogoncredential.yml

Merging upstream updates

2021-07-01 12:18:30 +05:45

sysmon_win_reg_persistence_recycle_bin.yml

Forget the status

2021-11-27 09:07:54 +01:00

sysmon_win_reg_persistence.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_win_reg_telemetry_persistence.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

win_outlook_c2_registry_key.yml

fix TargetObject HK

2021-09-13 13:16:16 +02:00

win_outlook_registry_todaypage.yml

clean string

2021-09-16 16:26:53 +02:00

win_outlook_registry_webview.yml

cleanup condition

2021-09-17 08:23:14 +02:00

win_portproxy_registry_key.yml

fix TargetObject HK

2021-09-13 13:16:16 +02:00

win_registry_file_association_exefile.yml

Improve exefile rule logic

2021-11-20 00:18:55 +01:00

win_registry_mimikatz_printernightmare.yml

Add Technique tags

2021-11-20 09:53:35 +01:00

win_registry_shell_open_keys_manipulation.yml

Add note regarding persistence in shell open rule

2021-11-19 16:18:25 +01:00