Nasreddine Bencherchali 3d9372bef3 feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

..

aws_ec2_download_userdata.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

aws_enum_backup.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

aws_enum_listing.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

aws_enum_network.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

aws_enum_storage.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

aws_lambda_function_created_or_invoked.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

aws_macic_evasion.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

aws_ses_messaging_enabled.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

azure_aad_secops_signin_failure_bad_password_threshold.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

dns_query_win_possible_dns_rebinding.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

driver_load_invoke_obfuscation_clip+_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_obfuscated_iex_services.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

driver_load_invoke_obfuscation_stdin+_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_var+_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_via_compress_services.yml

fix: update modified

2023-03-04 20:40:48 +09:00

driver_load_invoke_obfuscation_via_rundll_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_via_stdin_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_via_use_clip_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_via_use_mshta_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_via_use_rundll32_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_invoke_obfuscation_via_var++_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

driver_load_meterpreter_or_cobaltstrike_getsystem_service_installation.yml

feat: filename test enhancements (#3812)

2022-12-23 09:25:16 +01:00

driver_load_tap_driver_installation.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

file_event_executable_and_script_creation_by_office_using_file_ext.yml

Update Ref+Selection 3

2022-07-11 18:12:51 +01:00

image_load_mimikatz_inmemory_detection.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

lnx_auditd_cve_2021_3156_sudo_buffer_overflow_brutforce.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

lnx_auditd_cve_2021_3156_sudo_buffer_overflow.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

lnx_auditd_cve_2021_4034.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

lnx_auditd_debugfs_usage.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

lnx_auditd_omigod_scx_runasprovider_executescript.yml

Fix auditd field name

2021-11-11 10:13:48 +01:00

lnx_auth_susp_failed_logons_single_source.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

lnx_shell_priv_esc_prep.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

modsec_mulitple_blocks.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

net_dns_c2_detection.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

net_dns_high_bytes_out.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

net_dns_high_null_records_requests_rate.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

net_dns_high_requests_rate.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

net_dns_high_subdomain_rate.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

net_dns_high_txt_records_requests_rate.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

net_dns_large_domain_name.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

net_firewall_high_dns_bytes_out.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

net_firewall_high_dns_requests_rate.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

net_firewall_susp_network_scan_by_ip.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

net_firewall_susp_network_scan_by_port.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

net_possible_dns_rebinding.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

posh_ps_cl_invocation_lolscript_count.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

posh_ps_cl_mutexverifiers_lolscript_count.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

proc_creation_win_correlation_apt_silence_downloader_v3.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

proc_creation_win_correlation_apt_turla_commands_medium.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

proc_creation_win_correlation_dnscat2_powershell_implementation.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

proc_creation_win_correlation_multiple_susp_cli.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

proc_creation_win_correlation_susp_builtin_commands_recon.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

sysmon_always_install_elevated_msi_spawned_cmd_and_powershell_spawned_processes.yml

fix: remove penetration test as valid false positive reason

2022-03-16 14:33:18 +01:00

sysmon_always_install_elevated_parent_child_correlated.yml

fix: remove penetration test as valid false positive reason

2022-03-16 14:33:18 +01:00

sysmon_non_priv_program_files_move.yml

Integrity do not exist in file_event

2021-11-10 19:51:01 +01:00

sysmon_process_reimaging.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

web_multiple_susp_resp_codes_single_source.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

win_access_fake_files_with_stored_credentials.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_apt_apt29_tor.yml

fix: Service Installation 7045 field confusion

2022-03-21 11:10:03 +01:00

win_dumping_ntdsdit_via_dcsync.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_dumping_ntdsdit_via_netsync.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_kernel_and_3rd_party_drivers_exploits_token_stealing.yml

refactor: rule level adjustments - critical to high

2022-06-18 17:43:22 +02:00

win_mal_service_installs.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_metasploit_or_impacket_smb_psexec_service_install.yml

fix: Service Installation 7045 field confusion

2022-03-21 11:10:03 +01:00

win_possible_privilege_escalation_using_rotten_potato.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_remote_schtask.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_remote_service.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_security_global_catalog_enumeration.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_security_rare_schtasks_creations.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_security_susp_failed_logons_explicit_credentials.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_security_susp_failed_logons_single_process.yml

chore: change state to unsupported

2023-03-13 10:35:44 +01:00

win_security_susp_failed_logons_single_source2.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_security_susp_failed_logons_single_source_kerberos2.yml

chore: change state to unsupported

2023-03-13 10:35:44 +01:00

win_security_susp_failed_logons_single_source_kerberos3.yml

chore: change state to unsupported

2023-03-13 10:35:44 +01:00

win_security_susp_failed_logons_single_source_kerberos.yml

chore: change state to unsupported

2023-03-13 10:35:44 +01:00

win_security_susp_failed_logons_single_source_ntlm2.yml

chore: change state to unsupported

2023-03-13 10:35:44 +01:00

win_security_susp_failed_logons_single_source_ntlm.yml

chore: change state to unsupported

2023-03-13 10:35:44 +01:00

win_security_susp_failed_logons_single_source.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_security_susp_failed_remote_logons_single_source.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_security_susp_multiple_files_renamed_or_deleted.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_security_susp_samr_pwset.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_susp_failed_hidden_share_mount.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_suspicious_werfault_connection_outbound.yml

ParentImage do not exist in network_connection

2021-11-10 19:38:05 +01:00

win_system_rare_service_installs.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

win_taskscheduler_rare_schtask_creation.yml

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

zeek_dce_rpc_domain_user_enumeration.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00

zeek_http_exfiltration_compressed_files.yml

feat: new rules, updates and fp fixes (#4136)

2023-04-03 12:06:14 +02:00