Florian Roth 003e5bee6d Merge pull request #3018 from SigmaHQ/rule-devel ...

refactor: rule addition

2022-05-19 07:50:36 +02:00

..

application

fix: missing modified date mod

2022-05-16 17:24:26 +02:00

applocker

chore: test rules: capitalization on FP list entries

2022-05-09 16:07:44 +02:00

bits_client

Add Bits-Client rules

2022-03-03 06:27:00 +01:00

code_integrity

move to builtin

2022-01-21 11:59:13 +01:00

dns_server

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

driverframeworks

move to builtin

2022-01-21 11:59:13 +01:00

firewall_as

fix: FPs from fresh Windows 2022 install

2022-04-07 14:15:44 +02:00

ldap

move to builtin

2022-01-21 11:59:13 +01:00

msexchange

fix: legitimate --> Legitimate

2022-03-16 14:35:19 +01:00

ntlm

Update win_susp_ntlm_brute_force.yml

2022-02-03 22:02:33 +01:00

printservice

move to builtin

2022-01-21 11:59:13 +01:00

security

FP: filter m$ removaltools from %system32%\MRT.exe and reducing level to low from medium. Task removal could possibly even be just informational.

2022-05-16 14:48:01 +00:00

servicebus

move to builtin

2022-01-21 11:59:13 +01:00

smbclient

move to builtin

2022-01-21 11:59:13 +01:00

system

User meant to use service vs category. currently no category assignment for "system". We need a unit test to detect new sections here, vs backends. this was untested in the field.

2022-05-16 22:18:35 +00:00

taskscheduler

fix: several issues

2022-05-12 17:30:30 +02:00

terminalservices

fix: description

2022-04-29 13:10:36 +02:00

windefend

chore: test rules: reactivate single value list check

2022-05-10 17:13:04 +02:00

wmi

fix: several FPs against a fresh installed Windows with example applications and basic user interaction 2

2022-02-10 16:12:17 +01:00

win_alert_mimikatz_keywords.yml

fix: remove penetration test as valid false positive reason

2022-03-16 14:33:18 +01:00

win_susp_logon_newcredentials.yml

feat: Generate low sigma match for new credential logon

2022-04-07 10:50:50 +02:00