security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Commit Graph

  • ebeb270075 [Security Content] Current Investigation Guides Review (#1896) Jonhnathan 2022-04-12 22:05:13 -03:00
  • 77ceccf49e [Security Content] Add Investigation Guides - 5 (#1895) Jonhnathan 2022-04-12 21:12:59 -03:00
  • 03677ca4e8 [Security Content] Add Investigation Guides - 5 (#1895) Jonhnathan 2022-04-12 21:12:59 -03:00
  • 46f5af436e [Security Content] Add Investigation Guides - 5 (#1895) Jonhnathan 2022-04-12 21:12:59 -03:00
  • 9c15f99d99 [Security Content] Add Investigation Guides - 3 (#1836) Jonhnathan 2022-04-12 20:58:50 -03:00
  • 7fdf870d31 [Security Content] Add Investigation Guides - 3 (#1836) Jonhnathan 2022-04-12 20:58:50 -03:00
  • 3a5fceac3b [Security Content] Add Investigation Guides - 3 (#1836) Jonhnathan 2022-04-12 20:58:50 -03:00
  • a80bc6da9a Remove deprecated elasticsearch parameter (#1913) Justin Ibarra 2022-04-12 12:06:11 -08:00
  • a911907422 Remove deprecated elasticsearch parameter (#1913) Justin Ibarra 2022-04-12 12:06:11 -08:00
  • b3e789a202 Remove deprecated elasticsearch parameter (#1913) Justin Ibarra 2022-04-12 12:06:11 -08:00
  • 5294bca91d Update discovery_net_command_system_account.toml (#1912) Jonhnathan 2022-04-11 15:03:49 -03:00
  • deed08b896 Update discovery_net_command_system_account.toml (#1912) Jonhnathan 2022-04-11 15:03:49 -03:00
  • 3b6c594a22 Update discovery_net_command_system_account.toml (#1912) Jonhnathan 2022-04-11 15:03:49 -03:00
  • 8b3d4f6691 [Rule Tuning] AWS RDS Instance/Cluster Deletion (#1916) Isai 2022-04-10 15:33:33 -04:00
  • dfa41821ef [Rule Tuning] AWS RDS Instance/Cluster Deletion (#1916) Isai 2022-04-10 15:33:33 -04:00
  • 9640ecb3fe [Rule Tuning] AWS RDS Instance/Cluster Deletion (#1916) Isai 2022-04-10 15:33:33 -04:00
  • 3d838c2e7f [Security Content] Add Investigation Guides - 4 (#1871) Jonhnathan 2022-04-10 15:37:06 -03:00
  • 3c503f7c95 [Security Content] Add Investigation Guides - 4 (#1871) Jonhnathan 2022-04-10 15:37:06 -03:00
  • 290763d9bb [Security Content] Add Investigation Guides - 4 (#1871) Jonhnathan 2022-04-10 15:37:06 -03:00
  • 2a48335813 [Rule Tuning] AWS Security Group Configuration Change Detection (#1915) Isai 2022-04-07 14:47:09 -04:00
  • b3e51520c4 [Rule Tuning] AWS Security Group Configuration Change Detection (#1915) Isai 2022-04-07 14:47:09 -04:00
  • 5073ef8be7 [Rule Tuning] AWS Security Group Configuration Change Detection (#1915) Isai 2022-04-07 14:47:09 -04:00
  • 1b32a137f7 Update elasticsearch dependency to 8.1 (#1911) Justin Ibarra 2022-04-06 11:52:22 -08:00
  • bd5ada51e3 Update elasticsearch dependency to 8.1 (#1911) Justin Ibarra 2022-04-06 11:52:22 -08:00
  • ad99c6b489 Update elasticsearch dependency to 8.1 (#1911) Justin Ibarra 2022-04-06 11:52:22 -08:00
  • c31d5ffd32 [Rule Tuning] Add EQL optional field syntax (#1910) Jonhnathan 2022-04-05 16:32:37 -03:00
  • c425d98de1 [Rule Tuning] Add EQL optional field syntax (#1910) Jonhnathan 2022-04-05 16:32:37 -03:00
  • 49074ddeaa [Rule Tuning] Add EQL optional field syntax (#1910) Jonhnathan 2022-04-05 16:32:37 -03:00
  • 3311168e28 Expand timestamp override tests (#1907) Justin Ibarra 2022-04-01 15:27:08 -08:00
  • eeb8ab7744 Expand timestamp override tests (#1907) Justin Ibarra 2022-04-01 15:27:08 -08:00
  • 6bdfddac8e Expand timestamp override tests (#1907) ML-HostRiskScore-20220404-5 Justin Ibarra 2022-04-01 15:27:08 -08:00
  • 4d9124aaf7 Prep for Creation of 8.3 Branch (#1906) Terrance DeJesus 2022-04-01 17:33:18 -04:00
  • 2edb1e0ee7 Prep for Creation of 8.3 Branch (#1906) Terrance DeJesus 2022-04-01 17:33:18 -04:00
  • 648daf1237 Prep for Creation of 8.3 Branch (#1906) Terrance DeJesus 2022-04-01 17:33:18 -04:00
  • 93edc44284 [Rule Tuning] Timeline Templates For Windows and Linux (#1892) Terrance DeJesus 2022-04-01 13:44:35 -04:00
  • 16fa48b56d added comprehensive timeline template definitions (#1905) Terrance DeJesus 2022-04-01 12:51:54 -04:00
  • 1ca68f9d85 added comprehensive timeline template definitions (#1905) Terrance DeJesus 2022-04-01 12:51:54 -04:00
  • e72031a71a added comprehensive timeline template definitions (#1905) Terrance DeJesus 2022-04-01 12:51:54 -04:00
  • c3b7dc58b0 Svchost spawning Cmd - False Positives Tuning (#1894) Jonhnathan 2022-03-31 19:28:46 -03:00
  • 8d322f40c0 Svchost spawning Cmd - False Positives Tuning (#1894) Jonhnathan 2022-03-31 19:28:46 -03:00
  • e1b4a0d87c Svchost spawning Cmd - False Positives Tuning (#1894) Jonhnathan 2022-03-31 19:28:46 -03:00
  • a078da877b [Security Content] Adjust Investigation Guides to be less generic (#1805) Jonhnathan 2022-03-31 11:29:30 -03:00
  • 4ed2fbe932 [Security Content] Adjust Investigation Guides to be less generic (#1805) Jonhnathan 2022-03-31 11:29:30 -03:00
  • 8a59b49fea [Security Content] Adjust Investigation Guides to be less generic (#1805) Jonhnathan 2022-03-31 11:29:30 -03:00
  • 2ad8b32ce2 [Security Content] Add Investigation Guides - 2 (#1822) Jonhnathan 2022-03-30 14:43:55 -03:00
  • 5a263b253d [Security Content] Add Investigation Guides - 2 (#1822) Jonhnathan 2022-03-30 14:43:55 -03:00
  • a3d7427d29 [Security Content] Add Investigation Guides - 2 (#1822) Jonhnathan 2022-03-30 14:43:55 -03:00
  • b67a0f6602 Linux Shell Evasion Rule Tuning (#1878) Colson Wilhoit 2022-03-29 09:16:21 -05:00
  • 150ff0502e Linux Shell Evasion Rule Tuning (#1878) Colson Wilhoit 2022-03-29 09:16:21 -05:00
  • 1dc901ba09 reset evasion rules (#1902) Justin Ibarra 2022-03-29 15:47:48 -08:00
  • 5214209f8d reset evasion rules (#1902) Justin Ibarra 2022-03-29 15:47:48 -08:00
  • 44facd7c2a reset linux evasion rules (#1901) Justin Ibarra 2022-03-29 15:23:08 -08:00
  • bd228ae2fb Re-add c89 rules (#1900) Justin Ibarra 2022-03-29 15:01:48 -08:00
  • 8d09bca633 Re-add c89 rules (#1900) Justin Ibarra 2022-03-29 15:01:48 -08:00
  • 507a23ba01 temp remove rule to readd with backport (#1898) Justin Ibarra 2022-03-29 14:52:04 -08:00
  • bcec8a4479 Linux Shell Evasion Rule Tuning (#1878) Colson Wilhoit 2022-03-29 09:16:21 -05:00
  • bec28db01c Description updation across multiple rules (#1893) shashank-elastic 2022-03-28 22:54:37 +05:30
  • fb40a4a8c7 Description updation across multiple rules (#1893) shashank-elastic 2022-03-28 22:54:37 +05:30
  • 941b85bcdf Add Jamf Connect exception for macOS users enumeration rule (#1891) Damià Poquet Femenia 2022-03-28 18:13:28 +02:00
  • 9ad3d39a32 Add Jamf Connect exception for macOS users enumeration rule (#1891) Damià Poquet Femenia 2022-03-28 18:13:28 +02:00
  • dd65a325af Adding path as stated in #1812 (#1889) Stijn Holzhauer 2022-03-27 13:07:38 +02:00
  • 3d4eaf4caf Adding path as stated in #1812 (#1889) Stijn Holzhauer 2022-03-27 13:07:38 +02:00
  • 0f545def6e [New Rule] Account configured with never Expiring Password (#1790) Jonhnathan 2022-03-26 08:19:28 -03:00
  • 940689576d [New Rule] Account configured with never Expiring Password (#1790) Jonhnathan 2022-03-26 08:19:28 -03:00
  • 3622584cf3 Add kibana-update and fleet-release templates (#1887) Justin Ibarra 2022-03-25 23:44:35 -08:00
  • cbeb767156 Add kibana-update and fleet-release templates (#1887) Justin Ibarra 2022-03-25 23:44:35 -08:00
  • 3d088787d2 remove update templates Justin Ibarra 2022-03-25 23:36:40 -08:00
  • a843337350 Add kibana-update and fleet-release issue tempaltes Justin Ibarra 2022-03-25 23:21:12 -08:00
  • be8ef24c5f Add type to deprecated rules in version.lock (#1881) Justin Ibarra 2022-03-24 17:42:13 -08:00
  • d71154b272 Add type to deprecated rules in version.lock (#1881) Justin Ibarra 2022-03-24 17:42:13 -08:00
  • 22945ed97b [Bug] Fix bug in version_lock.py (#1880) Justin Ibarra 2022-03-24 15:41:16 -08:00
  • 17ef6c558c [Bug] Fix bug in version_lock.py (#1880) Justin Ibarra 2022-03-24 15:41:16 -08:00
  • 14a55aed05 [Security Content] Add Investigation Guides (#1799) Jonhnathan 2022-03-24 18:16:00 -03:00
  • cdb3dd6dbe [Security Content] Add Investigation Guides (#1799) Jonhnathan 2022-03-24 18:16:00 -03:00
  • c2d4ec90cc flock shell evasion threat (#1863) shashank-elastic 2022-03-25 02:22:18 +05:30
  • 3474f8c8e4 flock shell evasion threat (#1863) shashank-elastic 2022-03-25 02:22:18 +05:30
  • 42c6e68cc3 vim shell evasion threat (#1865) shashank-elastic 2022-03-25 02:07:20 +05:30
  • 152477904f vim shell evasion threat (#1865) shashank-elastic 2022-03-25 02:07:20 +05:30
  • 37419d94e7 Prevent changes to rule type for locked rules (#1855) Justin Ibarra 2022-03-24 11:56:27 -08:00
  • 11ec9c230e Prevent changes to rule type for locked rules (#1855) Justin Ibarra 2022-03-24 11:56:27 -08:00
  • 742c3c49c8 [Bug] Version bump with previous (#1870) Justin Ibarra 2022-03-24 11:12:06 -08:00
  • f4c94af994 [Bug] Version bump with previous (#1870) Justin Ibarra 2022-03-24 11:12:06 -08:00
  • 4e97631893 1554 update eql schemas to fail validation on text fields (#1866) Mika Ayenson 2022-03-23 16:22:26 -04:00
  • 1f015ebe85 1554 update eql schemas to fail validation on text fields (#1866) Mika Ayenson 2022-03-23 16:22:26 -04:00
  • 8282d34781 [New Rule] User account exposed to Kerberoasting (#1789) Jonhnathan 2022-03-23 16:31:47 -03:00
  • df7bed4408 [New Rule] User account exposed to Kerberoasting (#1789) Jonhnathan 2022-03-23 16:31:47 -03:00
  • cfa5bafb79 [New Rule] Suspicious Remote Registry Access via SeBackupPrivilege (#1783) Samirbous 2022-03-23 19:42:03 +01:00
  • c254d0de8b [New Rule] Suspicious Remote Registry Access via SeBackupPrivilege (#1783) Samirbous 2022-03-23 19:42:03 +01:00
  • 5bc3d1e2d5 [New Rule] Okta User Session Impersonation (#1867) Justin Ibarra 2022-03-22 16:11:29 -08:00
  • 46c2383e5b [New Rule] Okta User Session Impersonation (#1867) Justin Ibarra 2022-03-22 16:11:29 -08:00
  • 99597a2ed2 [Rule Tuning] Adding event.provider to AWS WAF Rule or Rule Group Deletion (#1833) Stijn Holzhauer 2022-03-23 00:36:53 +01:00
  • 2ed97d2e8c [Rule Tuning] Adding event.provider to AWS WAF Rule or Rule Group Deletion (#1833) Stijn Holzhauer 2022-03-23 00:36:53 +01:00
  • bbf92cec94 crash shell evasion threat (#1861) shashank-elastic 2022-03-22 18:46:05 +05:30
  • 22367d3702 crash shell evasion threat (#1861) shashank-elastic 2022-03-22 18:46:05 +05:30
  • d4c426a022 [New Rule] cpulimit shell evasion threat (#1851) shashank-elastic 2022-03-21 22:46:53 +05:30
  • 2ab5a1f44a [New Rule] cpulimit shell evasion threat (#1851) shashank-elastic 2022-03-21 22:46:53 +05:30
  • d26759d5a8 [Rule Tuning] Symbolic Link to Shadow Copy Created (#1830) Terrance DeJesus 2022-03-18 11:08:29 -04:00
  • 096723b2a1 [Rule Tuning] Symbolic Link to Shadow Copy Created (#1830) Terrance DeJesus 2022-03-18 11:08:29 -04:00
  • a951b99c13 update beats master branch ref to main (#1853) Mika Ayenson 2022-03-18 10:06:34 -04:00
  • 84b7ce6582 update beats master branch ref to main (#1853) Mika Ayenson 2022-03-18 10:06:34 -04:00