Florian Roth 78817d100b style: removed unneeded space chars

2021-06-10 09:42:19 +02:00

..

process_creation_dotnet.yml

Fix typo on CommandLine

2021-04-19 08:20:44 +02:00

process_creation_msdeploy.yml

fix: duplicate UUIDs

2021-05-27 10:29:21 +02:00

process_creation_SDelete.yml

Update process_creation_SDelete.yml

2021-06-03 12:40:55 +02:00

sysmon_abusing_debug_privilege.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

sysmon_accesschk_usage_after_priv_escalation.yml

add an empty line to re-run the test

2020-10-20 18:59:25 +02:00

sysmon_always_install_elevated_msi_spawned_cmd_and_powershell_spawned_processes.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

sysmon_always_install_elevated_msi_spawned_cmd_and_powershell.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

sysmon_always_install_elevated_windows_installer.yml

fix: rules causing too many false positives

2021-04-09 15:55:14 +02:00

sysmon_apt_muddywater_dnstunnel.yml

Merge pull request #989 from oscd-initiative/master

2020-09-08 13:27:58 +02:00

sysmon_cmstp_execution.yml

Fix syntax errors in some rules

2021-04-15 02:07:43 +02:00

sysmon_cve_2021_26857_msexchange.yml

Added rules for successful exploitation fo CVE-2021-26857/8 in Exchannge

2021-03-03 12:46:50 +05:45

sysmon_hack_wce.yml

att&ck tags review: windows/process_creation part 1, network

2020-08-27 20:43:47 +03:00

sysmon_high_integrity_sdclt.yml

update - GitHub Action / Test Sigma

2020-10-12 22:15:49 -04:00

sysmon_logon_scripts_userinitmprlogonscript_proc.yml

Update sysmon_logon_scripts_userinitmprlogonscript_proc.yml

2020-10-15 17:23:44 -03:00

sysmon_long_powershell_commandline.yml

Fix falsepositives list

2021-05-21 12:22:36 +02:00

sysmon_proxy_execution_wuauclt.yml

fix: duplicate UUIDs

2021-05-27 10:29:21 +02:00

sysmon_rclone_execution.yml

Added rule for RClone usage for exfiltration

2021-05-10 14:06:53 +05:45

sysmon_sdclt_child_process.yml

Fixes&improvements

2021-04-08 01:06:40 +02:00

sysmon_susp_plink_remote_forward.yml

rework: impossible rule with Sysmon

2021-01-19 14:12:40 +01:00

sysmon_susp_webdav_client_execution.yml

fix: duplicate UUIDs

2021-05-27 10:29:21 +02:00

win_ad_find_discovery.yml

added spaces for oudmp and dclist

2021-03-09 08:22:36 +11:00

win_advanced_ip_scanner.yml

Preserved creation date

2021-05-11 19:17:32 +05:45

win_apt_apt29_thinktanks.yml

Update win_apt_apt29_thinktanks.yml

2020-10-27 23:24:04 -03:00

win_apt_babyshark.yml

att&ck tags review: windows/process_creation part 1, network

2020-08-27 20:43:47 +03:00

win_apt_bear_activity_gtr19.yml

Remove Additional backslash

2020-11-26 22:59:35 -03:00

win_apt_bluemashroom.yml

Update win_apt_bluemashroom.yml

2020-11-28 09:48:30 +01:00

win_apt_chafer_mar18.yml

feat: generic registry events compatible with native audit logging

2021-04-26 09:31:36 +02:00

win_apt_cloudhopper.yml

Update win_apt_cloudhopper.yml

2020-11-28 10:20:12 +01:00

win_apt_dragonfly.yml

Update win_apt_dragonfly.yml

2020-10-15 17:27:42 -03:00

win_apt_elise.yml

Update win_apt_elise.yml

2020-10-15 17:28:07 -03:00

win_apt_emissarypanda_sep19.yml

Update win_apt_emissarypanda_sep19.yml

2020-10-15 17:28:33 -03:00

win_apt_empiremonkey.yml

Update win_apt_empiremonkey.yml

2020-10-15 17:29:19 -03:00

win_apt_equationgroup_dll_u_load.yml

Update win_apt_equationgroup_dll_u_load.yml

2020-10-15 17:29:44 -03:00

win_apt_evilnum_jul20.yml

Update win_apt_evilnum_jul20.yml

2020-11-26 23:05:08 -03:00

win_apt_gallium.yml

logsource change

2020-02-07 15:47:27 +01:00

win_apt_greenbug_may20.yml

Update win_apt_greenbug_may20.yml

2020-11-26 23:05:44 -03:00

win_apt_hafnium.yml

extended Exchange post-exploitation rule

2021-03-17 18:01:45 +01:00

win_apt_hurricane_panda.yml

Update win_apt_hurricane_panda.yml

2020-11-26 23:12:26 -03:00

win_apt_judgement_panda_gtr19.yml

Update win_apt_judgement_panda_gtr19.yml

2020-11-28 11:14:23 +01:00

win_apt_ke3chang_regadd.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_apt_lazarus_activity_apr21.yml

Added rule for Lazarus activity of Apr 2021

2021-04-20 20:05:51 +05:45

win_apt_lazarus_activity_dec20.yml

fix: typos and description

2020-12-23 14:46:08 +01:00

win_apt_lazarus_loader.yml

fix: typo in rule

2020-12-23 13:26:44 +01:00

win_apt_lazarus_session_highjack.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_apt_mustangpanda.yml

Fix logic

2020-11-26 23:16:03 -03:00

win_apt_slingshot.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_apt_sofacy.yml

Update win_apt_sofacy.yml

2020-11-28 11:21:23 +01:00

win_apt_ta17_293a_ps.yml

att&ck tags review: windows/process_creation part 1, network

2020-08-27 20:43:47 +03:00

win_apt_ta505_dropper.yml

TA505 Loader Rule

2020-12-08 10:15:30 +01:00

win_apt_taidoor.yml

att&ck tags review: windows/process_creation part 1, network

2020-08-27 20:43:47 +03:00

win_apt_tropictrooper.yml

Update win_apt_tropictrooper.yml

2020-10-15 17:35:41 -03:00

win_apt_turla_commands.yml

att&ck tags review: windows/process_creation part 1, network

2020-08-27 20:43:47 +03:00

win_apt_turla_comrat_may20.yml

att&ck tags review: windows/process_creation part 1, network

2020-08-27 20:43:47 +03:00

win_apt_unc2452_cmds.yml

Improved UNC2452 activity rules

2021-01-22 09:18:11 +01:00

win_apt_unc2452_ps.yml

Improved UNC2452 activity rules

2021-01-22 09:18:11 +01:00

win_apt_unidentified_nov_18.yml

Remove another reference to hardcoded event ID

2021-04-15 03:07:18 +02:00

win_apt_winnti_mal_hk_jan20.yml

att&ck tags review: windows/process_creation part 2

2020-08-29 04:39:30 +00:00

win_apt_winnti_pipemon.yml

Update win_apt_winnti_pipemon.yml

2020-11-26 23:29:10 -03:00

win_apt_wocao.yml

Update win_apt_wocao.yml

2020-10-15 17:38:05 -03:00

win_apt_zxshell.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_attrib_hiding_files.yml

Update win_attrib_hiding_files.yml

2020-10-15 17:41:44 -03:00

win_bad_opsec_sacrificial_processes.yml

Enhanced to improve specificity

2020-10-26 12:05:16 -04:00

win_bootconf_mod.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_bypass_squiblytwo.yml

Update win_bypass_squiblytwo.yml

2020-11-26 23:33:00 -03:00

win_change_default_file_association.yml

att&ck tags review: windows/process_creation part 2

2020-08-29 04:39:30 +00:00

win_CL_Invocation_LOLScript.yml

Fix falsepositives list

2021-05-21 12:19:17 +02:00

win_CL_Mutexverifiers_LOLScript.yml

Fix falsepositives list

2021-05-21 11:29:17 +02:00

win_class_exec_xwizard.yml

Update win_class_exec_xwizard.yml

2020-10-09 09:38:14 +03:00

win_cmdkey_recon.yml

Update win_cmdkey_recon.yml

2020-10-15 17:46:14 -03:00

win_cmstp_com_object_access.yml

att&ck tags review: windows/process_creation part 2

2020-08-29 04:39:30 +00:00

win_commandline_path_traversal.yml

Update win_commandline_path_traversal.yml

2020-11-27 12:13:45 -03:00

win_control_panel_item.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_copying_sensitive_files_with_credential_data.yml

fixing test runner issues

2020-09-15 15:45:33 -06:00

win_crime_fireball.yml

Update win_crime_fireball.yml

2020-10-15 17:48:37 -03:00

win_crime_maze_ransomware.yml

att&ck tags review: windows/process_creation part 2

2020-08-29 04:39:30 +00:00

win_crime_snatch_ransomware.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_data_compressed_with_rar.yml

att&ck tags review: windows/process_creation part 2

2020-08-29 04:39:30 +00:00

win_dns_exfiltration_tools_execution.yml

Update win_dns_exfiltration_tools_execution.yml

2020-10-15 17:49:18 -03:00

win_dnscat2_powershell_implementation.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_dsquery_domain_trust_discovery.yml

OSCD QA wave 3

2020-02-02 12:41:12 +01:00

win_encoded_frombase64string.yml

att&ck tags review: windows/process_creation part 2

2020-08-29 04:39:30 +00:00

win_encoded_iex.yml

att&ck tags review: windows/process_creation part 2

2020-08-29 04:39:30 +00:00

win_etw_modification_cmdline.yml

att&ck tags review: windows/process_creation part 2

2020-08-29 04:39:30 +00:00

win_etw_trace_evasion.yml

Fix win_etw_trace_evasion rule

2021-03-15 15:02:18 +01:00

win_exfiltration_and_tunneling_tools_execution.yml

fix tags

2020-08-29 21:34:20 +02:00

win_exploit_cve_2015_1641.yml

Update win_exploit_cve_2015_1641.yml

2020-10-15 17:50:55 -03:00

win_exploit_cve_2017_0261.yml

Update win_exploit_cve_2017_0261.yml

2020-11-27 12:18:06 -03:00

win_exploit_cve_2017_8759.yml

Update win_exploit_cve_2017_8759.yml

2020-10-15 17:51:34 -03:00

win_exploit_cve_2017_11882.yml

Update win_exploit_cve_2017_11882.yml

2020-10-15 17:51:20 -03:00

win_exploit_cve_2019_1378.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_exploit_cve_2019_1388.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_exploit_cve_2020_1048.yml

att&ck tags review: windows/process_creation part 2

2020-08-29 04:39:30 +00:00

win_exploit_cve_2020_1350.yml

fix: more FPs based on feedback

2020-07-15 12:05:50 +02:00

win_exploit_cve_2020_10189.yml

Update win_exploit_cve_2020_10189.yml

2020-10-15 17:52:53 -03:00

win_file_permission_modifications.yml

Rule fixes

2020-02-20 23:00:16 +01:00

win_grabbing_sensitive_hives_via_reg.yml

Update win_grabbing_sensitive_hives_via_reg.yml

2020-10-15 17:53:20 -03:00

win_hack_bloodhound.yml

att&ck tags review: windows/process_creation part 3

2020-09-01 17:02:59 +00:00

win_hack_koadic.yml

Update win_hack_koadic.yml

2020-11-28 11:12:06 +01:00

win_hack_rubeus.yml

Update win_hack_rubeus.yml

2021-04-06 20:18:54 +03:00

win_hack_secutyxploded.yml

Correct cast-sensitive Key "OriginalFilename"

2021-05-11 11:13:33 +02:00

win_hh_chm.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_hktl_createminidump.yml

Merge branch 'master' of https://github.com/SigmaHQ/sigma

2021-04-15 01:25:48 +02:00

win_html_help_spawn.yml

att&ck tags review: windows/process_creation part 3

2020-09-01 17:02:59 +00:00

win_hwp_exploits.yml

Update win_hwp_exploits.yml

2020-10-15 17:55:04 -03:00

win_impacket_lateralization.yml

Update win_impacket_lateralization.yml

2020-11-27 12:35:27 -03:00

win_indirect_cmd_compatibility_assistant.yml

Pcwrun.exe detection added

2020-10-12 13:52:49 +03:00

win_indirect_cmd.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_install_reg_debugger_backdoor.yml

Update Logic

2020-11-27 12:37:04 -03:00

win_interactive_at.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_invoke_obfuscation_clip+.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_invoke_obfuscation_obfuscated_iex_commandline.yml

att&ck tags review: windows/process_creation part 3

2020-09-01 17:02:59 +00:00

win_invoke_obfuscation_stdin+.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_invoke_obfuscation_var+.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_invoke_obfuscation_via_compress.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_invoke_obfuscation_via_rundll.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_invoke_obfuscation_via_stdin.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_invoke_obfuscation_via_use_clip.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_invoke_obfuscation_via_use_mhsta.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_invoke_obfuscation_via_use_rundll32.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_invoke_obfuscation_via_var++.yml

fix: duplicate UUIDs

2021-05-27 10:29:21 +02:00

win_kernel_and_3rd_party_drivers_exploits_token_stealing.yml

Revert "Moved rules with enrichments into unsupported"

2020-02-15 22:52:06 +01:00

win_lethalhta.yml

Update win_lethalhta.yml

2020-10-15 17:58:14 -03:00

win_local_system_owner_account_discovery.yml

att&ck tags review: windows/process_creation part 3

2020-09-01 17:02:59 +00:00

win_lsass_dump.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_mal_adwind.yml

Update win_mal_adwind.yml

2020-11-28 11:25:28 +01:00

win_malware_dridex.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

win_malware_dtrack.yml

Update win_malware_dtrack.yml

2020-10-15 18:00:12 -03:00

win_malware_emotet.yml

Update win_malware_emotet.yml

2020-10-15 18:01:00 -03:00

win_malware_formbook.yml

Update win_malware_formbook.yml

2020-11-27 15:26:15 -03:00

win_malware_notpetya.yml

Update win_malware_notpetya.yml

2020-11-27 15:29:29 -03:00

win_malware_qbot.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_malware_ryuk.yml

att&ck tags review: windows/process_creation part 3

2020-09-01 17:02:59 +00:00

win_malware_script_dropper.yml

Update win_malware_script_dropper.yml

2020-12-01 02:12:53 +01:00

win_malware_trickbot_recon_activity.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_malware_trickbot_wermgr.yml

New Trickbot wermgr rule

2020-11-26 09:54:27 +01:00

win_malware_wannacry.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_manage-bde_lolbas.yml

Fix falsepositives list

2021-05-21 11:17:36 +02:00

win_mavinject_proc_inj.yml

Update win_mavinject_proc_inj.yml

2020-10-15 18:06:51 -03:00

win_meterpreter_or_cobaltstrike_getsystem_service_start.yml

rule refactoring: Cobalt Strike service start

2021-05-20 10:05:12 +02:00

win_mimikatz_command_line.yml

review windows/process_creation part 4

2020-09-02 02:34:34 +02:00

win_mmc_spawn_shell.yml

Update win_mmc_spawn_shell.yml

2020-11-27 15:42:22 -03:00

win_mouse_lock.yml

Add missing product in logsource

2020-12-23 15:45:00 -05:00

win_mshta_javascript.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_mshta_spawn_shell.yml

Update win_mshta_spawn_shell.yml

2020-11-27 15:43:29 -03:00

win_multiple_suspicious_cli.yml

fix: fixed missing date fields in remaining files

2020-01-30 16:07:37 +01:00

win_net_enum.yml

Fix match for double-backslash

2020-06-15 13:39:50 -04:00

win_net_user_add.yml

review windows/process_creation part 4

2020-09-02 02:34:34 +02:00

win_netsh_allow_port_rdp.yml

review windows/process_creation part 4

2020-09-02 02:34:34 +02:00

win_netsh_fw_add_susp_image.yml

Update win_netsh_fw_add_susp_image.yml

2020-11-28 11:05:04 +01:00

win_netsh_fw_add.yml

Update win_netsh_fw_add.yml

2020-11-28 10:22:24 +01:00

win_netsh_packet_capture.yml

review windows/process_creation part 4

2020-09-02 02:34:34 +02:00

win_netsh_port_fwd_3389.yml

Update win_netsh_port_fwd_3389.yml

2020-11-28 11:32:35 +01:00

win_netsh_port_fwd.yml

Merge branch 'oscd' into oscd-5

2021-01-06 00:09:47 +03:00

win_netsh_wifi_credential_harvesting.yml

Update win_netsh_wifi_credential_harvesting.yml

2020-11-28 10:39:37 +01:00

win_network_sniffing.yml

Added UUIDs to rules

2019-11-12 23:12:27 +01:00

win_new_service_creation.yml

Merge pull request #989 from oscd-initiative/master

2020-09-08 13:27:58 +02:00

win_nltest_query.yml

Update win_nltest_query.yml

2021-01-05 23:03:41 +03:00

win_non_interactive_powershell.yml

Update Threat Hunter Playbook Reference

2021-05-22 01:04:20 -03:00

win_non_priv_reg_or_ps.yml

Split up powershell detection

2020-10-12 09:00:08 -04:00

win_office_shell.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_office_spawn_exe_from_users_directory.yml

Merge branch 'oscd'

2021-04-06 00:05:35 +02:00

win_plugx_susp_exe_locations.yml

Merge branch 'oscd'

2021-04-06 00:05:35 +02:00

win_possible_applocker_bypass.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_possible_privilege_escalation_using_rotten_potato.yml

review windows/process_creation part 4

2020-09-02 02:34:34 +02:00

win_powershell_amsi_bypass.yml

Update win_powershell_amsi_bypass.yml

2020-10-15 18:20:08 -03:00

win_powershell_audio_capture.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_powershell_b64_shellcode.yml

Update win_powershell_b64_shellcode.yml

2020-10-15 18:20:29 -03:00

win_powershell_bitsjob.yml

OSCD QA wave 1

2020-01-11 00:11:27 +01:00

win_powershell_defender_exclusion.yml

rule: PowerShell Cmdlet Defender Exclusions

2021-04-29 09:56:26 +02:00

win_powershell_disable_windef_av.yml

[OSCD] Powershell Disable Windows Defender AV

2020-10-13 02:05:00 +02:00

win_powershell_dll_execution.yml

Update win_powershell_dll_execution.yml

2020-10-15 20:38:55 -03:00

win_powershell_downgrade_attack.yml

review windows/process_creation part 4

2020-09-02 02:34:34 +02:00

win_powershell_download.yml

Update win_powershell_download.yml

2020-11-28 10:37:30 +01:00

win_powershell_frombase64string.yml

att&ck tags review: windows/process_creation part 5

2020-09-07 02:00:41 +04:00

win_powershell_reverse_shell_connection.yml

Detect HAFNIUM operations

2021-03-04 00:01:54 +07:00

win_powershell_suspicious_parameter_variation.yml

att&ck tags review: windows/process_creation part 5

2020-09-07 02:00:41 +04:00

win_powershell_xor_commandline.yml

att&ck tags review: windows/process_creation part 5

2020-09-07 02:00:41 +04:00

win_powersploit_empire_schtasks.yml

Update win_powersploit_empire_schtasks.yml

2020-11-28 10:29:07 +01:00

win_proc_wrong_parent.yml

Merge branch 'oscd'

2021-04-06 00:05:35 +02:00

win_process_creation_bitsadmin_download.yml

Update win_process_creation_bitsadmin_download.yml

2020-10-15 18:23:29 -03:00

win_process_dump_rundll32_comsvcs.yml

refactor: extended comsvcs.dll MiniDump rule

2021-04-23 16:46:04 +02:00

win_psexesvc_start.yml

att&ck tags review: windows/process_creation part 5

2020-09-07 02:00:41 +04:00

win_query_registry.yml

Converted to Unix line end

2019-12-15 23:30:42 +01:00

win_rasautou_dll_execution.yml

Update win_rasautou_dll_execution.yml

2020-10-17 21:27:50 +02:00

win_rdp_hijack_shadowing.yml

att&ck tags review: windows/process_creation part 5

2020-09-07 02:00:41 +04:00

win_redmimicry_winnti_proc.yml

att&ck tags review: windows/process_creation part 5

2020-09-07 02:00:41 +04:00

win_regedit_export_critical_keys.yml

update syntax a bit to re-run the test

2020-10-20 17:39:04 +02:00

win_regedit_export_keys.yml

Update win_regedit_export_keys.yml

2020-11-30 02:08:54 +01:00

win_regedit_import_keys_ads.yml

Created Win Regedit import rules

2020-10-15 18:14:56 +02:00

win_regedit_import_keys.yml

Created Win Regedit import rules

2020-10-15 18:14:56 +02:00

win_regini_ads.yml

fix typo of fields

2021-05-24 10:37:14 +02:00

win_regini.yml

fix typo of fields

2021-05-24 10:34:56 +02:00

win_remote_powershell_session_process.yml

Update Threat Hunter Playbook Reference

2021-05-22 01:04:53 -03:00

win_remote_time_discovery.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_renamed_binary_highly_relevant.yml

Update win_renamed_binary_highly_relevant.yml

2020-11-28 09:08:09 -03:00

win_renamed_binary.yml

att&ck tags review: windows/process_creation part 5

2020-09-07 02:00:41 +04:00

win_renamed_jusched.yml

att&ck tags review: windows/process_creation part 5

2020-09-07 02:00:41 +04:00

win_renamed_paexec.yml

Update win_renamed_paexec.yml

2020-11-28 09:08:48 -03:00

win_renamed_powershell.yml

Update win_renamed_powershell.yml

2020-10-15 18:24:16 -03:00

win_renamed_procdump.yml

refactor: renamed procdump rule

2021-04-29 17:59:49 +02:00

win_renamed_psexec.yml

Update win_renamed_psexec.yml

2020-10-15 18:24:48 -03:00

win_run_powershell_script_from_ads.yml

att&ck tags review: windows/process_creation part 5

2020-09-07 02:00:41 +04:00

win_run_powershell_script_from_input_stream.yml

fix tabs... again...

2020-10-17 16:07:40 +00:00

win_rundll32_without_parameters.yml

Create win_rundll32_without_parameters.yml

2021-02-03 22:18:23 +01:00

win_sdbinst_shim_persistence.yml

fix: FP tuning for IIS Express and making use of value modifiers

2021-04-01 14:37:20 +02:00

win_service_execution.yml

att&ck tags review: windows/process_creation part 5

2020-09-07 02:00:41 +04:00

win_service_stop.yml

fix false positive on taskkill.exe not related to service stop at all

2020-02-24 03:03:46 -05:00

win_shadow_copies_access_symlink.yml

att&ck tags review: windows/process_creation part 5

2020-09-07 02:00:41 +04:00

win_shadow_copies_creation.yml

Initial round of subtechnique updates

2020-06-16 14:46:08 -06:00

win_shadow_copies_deletion.yml

fix: rules with duplicate tags

2020-07-27 11:44:47 +02:00

win_shell_spawn_susp_program.yml

Remove additional backlash

2020-11-20 02:16:51 -03:00

win_silenttrinity_stage_use.yml

- Cleaned up some more rules where 'service: sysmon' was combined with category

2020-10-02 10:45:29 +02:00

win_soundrec_audio_capture.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_spn_enum.yml

Update win_spn_enum.yml

2020-11-20 02:17:31 -03:00

win_sus_auditpol_usage.yml

Update win_sus_auditpol_usage.yml

2021-02-02 22:24:54 +11:00

win_susp_adfind.yml

process_creation is a category

2021-05-12 08:57:57 +02:00

win_susp_atbroker.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_susp_bcdedit.yml

Update win_susp_bcdedit.yml

2020-10-15 18:28:42 -03:00

win_susp_bginfo.yml

att&ck tags review: windows/process_creation part 6

2020-09-05 20:35:21 +03:00

win_susp_calc.yml

Update win_susp_calc.yml

2020-10-15 18:29:12 -03:00

win_susp_cdb.yml

att&ck tags review: windows/process_creation part 6

2020-09-05 20:35:21 +03:00

win_susp_certutil_command.yml

Got Rid of References that are no longer valid.

2021-05-06 14:14:08 -05:00

win_susp_certutil_encode.yml

Update win_susp_certutil_encode.yml

2020-11-28 12:31:40 +01:00

win_susp_cli_escape.yml

Update win_susp_cli_escape.yml

2020-10-15 18:30:46 -03:00

win_susp_cmd_http_appdata.yml

Update win_susp_cmd_http_appdata.yml

2020-11-28 12:34:28 +01:00

win_susp_codepage_switch.yml

Update win_susp_codepage_switch.yml

2020-11-28 12:42:27 +01:00

win_susp_commands_recon_activity.yml

Update win_susp_commands_recon_activity.yml

2020-11-28 18:43:04 +01:00

win_susp_compression_params.yml

Update win_susp_compression_params.yml

2020-11-20 02:29:41 -03:00

win_susp_comsvcs_procdump.yml

Update win_susp_comsvcs_procdump.yml

2020-10-15 19:21:11 -03:00

win_susp_conhost.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_susp_control_dll_load.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_susp_copy_lateral_movement.yml

Update win_susp_copy_lateral_movement.yml

2020-11-28 12:44:54 +01:00

win_susp_copy_system32.yml

Update win_susp_copy_system32.yml

2020-11-20 02:31:26 -03:00

win_susp_covenant.yml

Update win_susp_covenant.yml

2020-11-20 02:36:20 -03:00

win_susp_crackmapexec_execution.yml

Fixes

2021-04-03 23:21:13 +02:00

win_susp_crackmapexec_powershell_obfuscation.yml

att&ck tags review: windows/process_creation part 6

2020-09-05 20:35:21 +03:00

win_susp_csc_folder.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_susp_csc.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_susp_csi.yml

Correct cast-sensitive Key "OriginalFileName"

2021-05-11 11:16:12 +02:00

win_susp_curl_download.yml

att&ck tags review: windows/process_creation part 6

2020-09-05 20:35:21 +03:00

win_susp_curl_fileupload.yml

att&ck tags review: windows/process_creation part 6

2020-09-05 20:35:21 +03:00

win_susp_curl_start_combo.yml

Update win_susp_curl_start_combo.yml

2020-11-28 12:31:55 -03:00

win_susp_dctask64_proc_inject.yml

att&ck tags review: windows/process_creation part 7

2020-08-30 19:17:38 +03:00

win_susp_desktopimgdownldr.yml

att&ck tags review: windows/process_creation part 7

2020-08-30 19:17:38 +03:00

win_susp_devtoolslauncher.yml

att&ck tags review: windows/process_creation part 7

2020-08-30 19:17:38 +03:00

win_susp_direct_asep_reg_keys_modification.yml

Update win_susp_direct_asep_reg_keys_modification.yml

2020-11-28 12:32:35 -03:00

win_susp_disable_eventlog.yml

fix: condition in eventlog rule

2021-02-22 17:24:19 +01:00

win_susp_disable_ie_features.yml

att&ck tags review: windows/process_creation part 7

2020-08-30 19:17:38 +03:00

win_susp_disable_raccine.yml

style: removed unneeded space chars

2021-06-10 09:42:19 +02:00

win_susp_diskshadow.yml

Create win_susp_diskshadow.yml

2021-03-10 11:33:12 +03:00

win_susp_ditsnap.yml

att&ck tags review: windows/process_creation part 7

2020-08-30 19:17:38 +03:00

win_susp_dnx.yml

att&ck tags review: windows/process_creation part 7

2020-08-30 19:17:38 +03:00

win_susp_double_extension.yml

Update win_susp_double_extension.yml

2020-10-15 19:27:17 -03:00

win_susp_dxcap.yml

att&ck tags review: windows/process_creation part 7

2020-08-30 19:17:38 +03:00

win_susp_emotet_rudll32_execution.yml

Update win_susp_emotet_rudll32_execution.yml

2020-12-25 09:05:55 +01:00

win_susp_eventlog_clear.yml

att&ck tags review: windows/process_creation part 7

2020-08-30 19:17:38 +03:00

win_susp_execution_path_webserver.yml

Remove Additional backslash

2020-11-28 12:34:06 -03:00

win_susp_execution_path.yml

Merge branch 'oscd'

2021-04-06 00:05:35 +02:00

win_susp_explorer_break_proctree.yml

att&ck tags review: windows/process_creation part 7

2020-08-30 19:17:38 +03:00

win_susp_explorer.yml

Deleted a part of an already-defined rule

2020-10-11 21:08:17 +03:00

win_susp_file_characteristics.yml

Update win_susp_file_characteristics.yml

2020-10-15 19:30:07 -03:00

win_susp_file_download_via_gfxdownloadwrapper.yml

wrong field name

2020-11-28 10:10:00 +01:00

win_susp_findstr_lnk.yml

Update win_susp_findstr_lnk.yml

2020-10-15 19:30:21 -03:00

win_susp_findstr.yml

Fixed OSCD wording

2020-10-09 09:26:01 +03:00

win_susp_finger_usage.yml

Added the author of the duplicated rule (finger.exe)

2021-03-07 23:20:21 +03:00

win_susp_firewall_disable.yml

att&ck tags review: windows/process_creation part 7

2020-08-30 19:17:38 +03:00

win_susp_fsutil_usage.yml

fix: rules with duplicate tags

2020-07-27 11:44:47 +02:00

win_susp_ftp.yml

Fixed title

2020-10-09 16:46:18 +04:00

win_susp_gup.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_susp_iss_module_install.yml

Update win_susp_iss_module_install.yml

2020-11-28 13:30:27 +01:00

win_susp_mounted_share_deletion.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_susp_mpcmdrun_download.yml

docs: added MITRE ATT&CK tags

2020-09-05 09:17:23 +02:00

win_susp_msiexec_cwd.yml

Remove additional backslash

2020-11-28 12:38:19 -03:00

win_susp_msiexec_web_install.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_susp_msoffice.yml

fix: fixed casing and long rule titles

2020-01-30 17:26:09 +01:00

win_susp_net_execution.yml

Update win_susp_net_execution.yml

2020-11-28 13:33:30 +01:00

win_susp_netsh_dll_persistence.yml

att&ck tags review: windows/process_creation part 7

2020-08-30 19:17:38 +03:00

win_susp_ngrok_pua.yml

update ngrok rule

2021-05-14 17:44:53 +02:00

win_susp_ntdsutil.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_susp_odbcconf.yml

att&ck tags review: windows/process_creation part 7

2020-08-30 19:17:38 +03:00

win_susp_openwith.yml

att&ck tags review: windows/process_creation part 7

2020-08-30 19:17:38 +03:00

win_susp_outlook_temp.yml

Update win_susp_outlook_temp.yml

2020-10-15 19:33:45 -03:00

win_susp_outlook.yml

Update win_susp_outlook.yml

2020-11-28 13:34:57 +01:00

win_susp_pcwutl.yml

CommandLine|contains -> CommandLine|contains|all:

2020-10-07 08:43:22 +03:00

win_susp_pester.yml

chertovy testy, prohoditezz

2020-10-15 10:21:01 +03:00

win_susp_ping_hex_ip.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_susp_powershell_empire_launch.yml

att&ck tags review: windows/process_creation part 8

2020-08-28 17:14:26 +03:00

win_susp_powershell_empire_uac_bypass.yml

Update win_susp_powershell_empire_uac_bypass.yml

2020-10-15 19:34:18 -03:00

win_susp_powershell_enc_cmd.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_susp_powershell_encoded_param.yml

att&ck tags review: windows/process_creation part 8

2020-08-28 17:14:26 +03:00

win_susp_powershell_getprocess_lsass.yml

docs: FPs and changed level

2021-04-23 16:45:52 +02:00

win_susp_powershell_hidden_b64_cmd.yml

Update win_susp_powershell_hidden_b64_cmd.yml

2020-10-15 19:40:23 -03:00

win_susp_powershell_parent_combo.yml

Update win_susp_powershell_parent_combo.yml

2020-11-28 17:31:37 +01:00

win_susp_powershell_parent_process.yml

att&ck tags review: windows/process_creation part 8

2020-08-28 17:14:26 +03:00

win_susp_print.yml

Fixed OSCD wording

2020-10-09 11:59:08 +03:00

win_susp_procdump_lsass.yml

Applied the fixes made by the participants during the second sprint.

2021-03-07 23:40:08 +03:00

win_susp_procdump.yml

refactor: procdump use

2021-03-02 23:36:25 +01:00

win_susp_procs_req_dlls.yml

fix: other locations

2021-05-27 18:12:20 +02:00

win_susp_ps_appdata.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_susp_ps_downloadfile.yml

att&ck tags review: windows/process_creation part 8

2020-08-28 17:14:26 +03:00

win_susp_psexec_eula.yml

Update win_susp_psexec_eula.yml

2020-11-29 17:45:29 +05:30

win_susp_psexex_paexec_flags.yml

fix: bug in rule syntax

2021-05-22 15:31:23 +02:00

win_susp_psr_capture_screenshots.yml

att&ck tags review: windows/process_creation part 8

2020-08-28 17:14:26 +03:00

win_susp_rar_flags.yml

fix: rules causing too many false positives

2021-04-09 15:55:14 +02:00

win_susp_rasdial_activity.yml

att&ck tags review: windows/process_creation part 8

2020-08-28 17:14:26 +03:00

win_susp_rclone_exec.yml

refactor: re-add exec seldction

2021-05-27 19:24:20 +02:00

win_susp_recon_activity.yml

ryuk changes

2020-10-30 13:15:11 +05:30

win_susp_regedit_trustedinstaller.yml

Update win_susp_regedit_trustedinstaller.yml

2021-05-27 16:57:41 +02:00

win_susp_register_cimprovider.yml

fix: bug in rule syntax

2021-05-22 15:31:23 +02:00

win_susp_regsvr32_anomalies.yml

Update win_susp_regsvr32_anomalies.yml

2020-11-28 17:40:40 +01:00

win_susp_regsvr32_flags_anomaly.yml

att&ck tags review: windows/process_creation part 8

2020-08-28 17:14:26 +03:00

win_susp_renamed_dctask64.yml

att&ck tags review: windows/process_creation part 8

2020-08-28 17:14:26 +03:00

win_susp_renamed_debugview.yml

Correct cast-sensitive Key "OriginalFileName"

2021-05-11 11:18:01 +02:00

win_susp_renamed_paexec.yml

PAExec and PSexec rules

2021-05-22 10:52:01 +02:00

win_susp_rpcping.yml

Spaces are cool but not enough!

2020-10-16 01:41:53 +03:00

win_susp_run_locations.yml

Update win_susp_run_locations.yml

2020-11-28 17:42:47 +01:00

win_susp_rundll32_activity.yml

Update win_susp_rundll32_activity.yml

2020-10-10 10:08:02 -03:00

win_susp_rundll32_by_ordinal.yml

fix: FP with Edge and call by ordinal

2021-04-29 18:23:14 +02:00

win_susp_rundll32_inline_vbs.yml

UNC2452 rules - GoldMax, Sibot, GoldFinder

2021-03-05 11:54:35 +01:00

win_susp_rundll32_no_params.yml

fix: other locations

2021-05-27 18:12:20 +02:00

win_susp_rundll32_setupapi_installhinfsection.yml

Remove asterisk from condition

2020-10-07 14:54:13 +03:00

win_susp_rundll32_sys.yml

fix: duplicate UUID

2021-03-05 12:09:43 +01:00

win_susp_runonce_execution.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_susp_runscripthelper.yml

Small fix

2020-10-23 12:50:27 +04:00

win_susp_schtask_creation_temp_folder.yml

fix: wrong field name

2021-03-15 08:14:43 +01:00

win_susp_schtask_creation.yml

Update win_susp_schtask_creation.yml

2020-10-15 19:47:15 -03:00

win_susp_screenconnect_access.yml

rule: ScreenConnect remote access

2021-02-11 13:04:16 +01:00

win_susp_script_execution.yml

att&ck tags review: windows/process_creation part 8

2020-08-28 17:14:26 +03:00

win_susp_service_dacl_modification.yml

Update win_susp_service_dacl_modification.yml

2020-10-16 11:57:54 -03:00

win_susp_service_dir.yml

fix: 1 of them condition

2021-03-09 09:15:12 +01:00

win_susp_service_path_modification.yml

att&ck tags review: windows/process_creation part 8

2020-08-28 17:14:26 +03:00

win_susp_shell_spawn_from_mssql.yml

fix identation

2020-12-11 18:40:17 +01:00

win_susp_shimcache_flush.yml

fix: error in condition

2021-02-22 17:30:11 +01:00

win_susp_sqldumper_activity.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_susp_squirrel_lolbin.yml

Update win_susp_squirrel_lolbin.yml

2020-11-28 17:47:16 +01:00

win_susp_svchost_no_cli.yml

fix: FPs with Suspect Svchost Activity

2021-02-24 13:55:40 +01:00

win_susp_svchost.yml

Update win_susp_svchost.yml

2020-10-15 19:47:47 -03:00

win_susp_sysprep_appdata.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_susp_sysvol_access.yml

Update win_susp_sysvol_access.yml

2020-11-28 17:49:21 +01:00

win_susp_taskmgr_localsystem.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_susp_taskmgr_parent.yml

Update win_susp_taskmgr_parent.yml

2020-10-15 19:50:04 -03:00

win_susp_tracker_execution.yml

[OSCD] Added a rule to detect the execution of tracker.exe with suspicious arguments

2020-10-18 19:35:57 -04:00

win_susp_tscon_localsystem.yml

Update win_susp_tscon_localsystem.yml

2020-10-15 19:50:14 -03:00

win_susp_tscon_rdp_redirect.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_susp_use_of_csharp_console.yml

fix: fixed several issues

2020-03-09 17:43:16 +01:00

win_susp_use_of_sqlps_bin.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_susp_use_of_sqltoolsps_bin.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_susp_use_of_te_bin.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_susp_use_of_vsjitdebugger_bin.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_susp_userinit_child.yml

Update win_susp_userinit_child.yml

2020-10-15 19:51:42 -03:00

win_susp_vboxdrvInst.yml

Remove asterisk from condition

2020-10-13 22:37:51 +03:00

win_susp_vbscript_unc2452.yml

fix: wrong conditions

2021-03-05 11:55:49 +01:00

win_susp_volsnap_disable.yml

fix: tags

2021-01-28 13:51:51 +01:00

win_susp_whoami.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_susp_winrm_AWL_bypass.yml

Rule collection implemented

2020-10-07 17:35:14 +03:00

win_susp_winrm_execution.yml

Fixed typo

2020-10-13 22:27:27 +02:00

win_susp_wmi_execution.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_susp_wmic_proc_create_rundll32.yml

fix: rule title casing

2020-10-12 09:51:35 +02:00

win_susp_wmic_security_product_uninstall.yml

rule: security product uninstallation

2021-01-30 11:24:08 +01:00

win_susp_wsl_lolbin.yml

Update win_susp_wsl_lolbin.yml

2020-10-07 08:12:51 +11:00

win_susp_wuauclt.yml

process_creation is a category

2021-05-12 08:55:35 +02:00

win_syncappvpublishingserver_exe.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_sysmon_driver_unload.yml

att&ck tags review: windows/process_creation part 9

2020-08-29 19:22:09 +03:00

win_system_exe_anomaly.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_tap_installer_execution.yml

Rule fixes

2020-02-20 23:00:16 +01:00

win_task_folder_evasion.yml

att&ck tags review: windows/process_creation part 9

2020-08-29 19:22:09 +03:00

win_termserv_proc_spawn.yml

Update win_termserv_proc_spawn.yml

2020-10-15 19:57:05 -03:00

win_trust_discovery.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_uac_cmstp.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_uac_fodhelper.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_uac_wsreset.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

win_using_sc_to_change_sevice_image_path_by_non_admin.yml

fixed typo in tag

2020-08-29 20:19:46 +03:00

win_using_settingsynchost_as_lolbin.yml

Fix ATTACK technique.

2020-10-10 20:27:00 +03:00

win_verclsid_runs_com.yml

Small fix

2020-10-23 12:41:39 +04:00

win_visual_basic_compiler.yml

Update win_visual_basic_compiler.yml

2020-10-09 09:35:33 +03:00

win_vul_java_remote_debugging.yml

Update win_vul_java_remote_debugging.yml

2020-10-15 19:57:43 -03:00

win_webshell_detection.yml

Added missed changes in win_net_ntlm_downgrade and merged duplicate rules

2021-03-02 23:34:34 +03:00

win_webshell_recon_detection.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_webshell_spawn.yml

Merge remote-tracking branch 'upstream/master' and fix conflicts

2021-03-07 23:36:13 +03:00

win_whoami_as_system.yml

att&ck tags review: windows/process_creation part 9

2020-08-29 19:22:09 +03:00

win_whoami_priv.yml

rule: whoami priv

2021-05-05 14:27:36 +02:00

win_win10_sched_task_0day.yml

Update win_win10_sched_task_0day.yml

2020-11-28 13:42:30 -03:00

win_winword_dll_load.yml

Small fix

2020-10-23 12:44:46 +04:00

win_wmi_backdoor_exchange_transport_agent.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

win_wmi_persistence_script_event_consumer.yml

att&ck tags review: windows/process_creation part 9

2020-08-29 19:22:09 +03:00

win_wmi_spwns_powershell.yml

Merge branch 'oscd'

2021-03-02 22:58:41 +03:00

win_wmiprvse_spawning_process.yml

Update Threat Hunter Playbook Reference

2021-05-22 01:08:23 -03:00

win_workflow_compiler.yml

Update win_workflow_compiler.yml

2020-10-15 20:00:57 -03:00

win_wsreset_uac_bypass.yml

att&ck tags review: windows/process_creation part 9

2020-08-29 19:22:09 +03:00

win_xsl_script_processing.yml

att&ck tags review: windows/process_creation part 9

2020-08-29 19:22:09 +03:00