security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Commit Graph

  • 06a9ba6463 Update Host Risk Score docs (#1397) ML-HostRiskScore-20210803-1 Apoorva Joshi 2021-08-02 21:52:12 -07:00
  • 197bb86459 Adding host risk score docs (#1390) Apoorva Joshi 2021-08-02 14:43:27 -07:00
  • c283d2a2f3 Adding host risk score docs (#1390) Apoorva Joshi 2021-08-02 14:43:27 -07:00
  • 05d01bbfe0 [Rule Tuning] Rule description tweaks (#1388) Justin Ibarra 2021-07-29 10:56:13 -08:00
  • b736d6e748 [Rule Tuning] Rule description tweaks (#1388) Justin Ibarra 2021-07-29 10:56:13 -08:00
  • 06849a82d8 [CI] Add missing clone for Fleet on-demand job (#1387) Ross Wolf 2021-07-27 16:55:28 -06:00
  • 2e8f7cd13f [CI] Add missing clone for Fleet on-demand job (#1387) Ross Wolf 2021-07-27 16:55:28 -06:00
  • f6d9295ead [CI] Fix kibana PR command again (#1386) Ross Wolf 2021-07-27 16:29:50 -06:00
  • b069b12c60 [CI] Fix kibana PR command again (#1386) integration-v0.13.3 Ross Wolf 2021-07-27 16:29:50 -06:00
  • 92937a1ad1 [CI] Fix kibana PR command again (#1386) Ross Wolf 2021-07-27 16:29:50 -06:00
  • de13977b57 Bump Fleet integration to 0.13.3 Ross Wolf 2021-07-27 16:27:36 -06:00
  • 51f8ea7526 Fix kibana_pr for click.Context (#1385) Ross Wolf 2021-07-27 16:03:28 -06:00
  • fc3ef8bbe0 Fix kibana_pr for click.Context (#1385) Ross Wolf 2021-07-27 16:03:28 -06:00
  • 64977b01bd Fix kibana_pr for click.Context (#1385) Ross Wolf 2021-07-27 16:03:28 -06:00
  • 32c0e9fff5 Disable missing rule check for the version lock (#1384) Ross Wolf 2021-07-27 13:48:28 -06:00
  • 98ced817cf Disable missing rule check for the version lock (#1384) Ross Wolf 2021-07-27 13:48:28 -06:00
  • c31a344593 Disable missing rule check for the version lock (#1384) Ross Wolf 2021-07-27 13:48:28 -06:00
  • a534cd4e85 Update the version lock for 7.14.0 and 0.13.3 (#1383) Ross Wolf 2021-07-27 12:25:12 -06:00
  • 55741e71a5 Update the version lock for 7.14.0 and 0.13.3 (#1383) Ross Wolf 2021-07-27 12:25:12 -06:00
  • 5eccaf0cd5 Update the version lock for 7.14.0 and 0.13.3 (#1383) Ross Wolf 2021-07-27 12:25:12 -06:00
  • 3c9079faf3 Ensure EQL rules with maxspan have a long enough lookback window (#1361) Justin Ibarra 2021-07-22 13:53:13 -08:00
  • ab9f055acb Ensure EQL rules with maxspan have a long enough lookback window (#1361) Justin Ibarra 2021-07-22 13:53:13 -08:00
  • 7759fa2500 Ensure EQL rules with maxspan have a long enough lookback window (#1361) Justin Ibarra 2021-07-22 13:53:13 -08:00
  • 0ae93632fc [Rule Tuning] Remove \Program Files*\ style wildcards (#1369) Ross Wolf 2021-07-22 11:55:22 -06:00
  • f7c154cb8f [Rule Tuning] Remove \Program Files*\ style wildcards (#1369) Ross Wolf 2021-07-22 11:55:22 -06:00
  • 7b62fe296d [Rule Tuning] Remove \Program Files*\ style wildcards (#1369) Ross Wolf 2021-07-22 11:55:22 -06:00
  • 8deeab2c4d [Rule Tuning] Update EQL rules with lookback < maxspan (#1362) Justin Ibarra 2021-07-22 09:08:58 -08:00
  • fbc19bebb8 [Rule Tuning] Update EQL rules with lookback < maxspan (#1362) Justin Ibarra 2021-07-22 09:08:58 -08:00
  • 4aab1278bf [Rule Tuning] Update EQL rules with lookback < maxspan (#1362) Justin Ibarra 2021-07-22 09:08:58 -08:00
  • cae7fac266 Fix metadata.extended (#1377) Ross Wolf 2021-07-22 10:29:30 -06:00
  • bc23bde4a6 Fix metadata.extended (#1377) Ross Wolf 2021-07-22 10:29:30 -06:00
  • 5ba1c26cf1 Fix metadata.extended (#1377) Ross Wolf 2021-07-22 10:29:30 -06:00
  • 600acca704 [Fleet] Track integrations in folder and metadata (#1372) Ross Wolf 2021-07-21 15:24:56 -06:00
  • b13c369dab [Fleet] Track integrations in folder and metadata (#1372) Ross Wolf 2021-07-21 15:24:56 -06:00
  • 1882f4456c [Fleet] Track integrations in folder and metadata (#1372) Ross Wolf 2021-07-21 15:24:56 -06:00
  • 6d9997435f [Rule Tuning] Convert unusual extension rule to regex (#1368) Ross Wolf 2021-07-21 11:49:32 -06:00
  • a578a3815c [Rule Tuning] Convert unusual extension rule to regex (#1368) Ross Wolf 2021-07-21 11:49:32 -06:00
  • 9f3d5328f4 [Rule Tuning] Convert unusual extension rule to regex (#1368) Ross Wolf 2021-07-21 11:49:32 -06:00
  • fc2f5866a2 [Rule Tuning] Creation of Hidden Files and Directories (#1357) Ross Wolf 2021-07-21 11:47:40 -06:00
  • 92d432c78b [Rule Tuning] Creation of Hidden Files and Directories (#1357) Ross Wolf 2021-07-21 11:47:40 -06:00
  • 9b559d0cd9 [Rule Tuning] Creation of Hidden Files and Directories (#1357) Ross Wolf 2021-07-21 11:47:40 -06:00
  • f0270973bb [Rule Tuning] Update Google Workspace rules to use google_workspace event schema (#1374) David French 2021-07-21 11:38:43 -06:00
  • b81f29cddf [Rule Tuning] Update Google Workspace rules to use google_workspace event schema (#1374) David French 2021-07-21 11:38:43 -06:00
  • 23626b814c [Rule Tuning] Update Google Workspace rules to use google_workspace event schema (#1374) David French 2021-07-21 11:38:43 -06:00
  • cb3ceb93da [New Rule] Windows Defender Exclusions Added via PowerShell (#1370) dstepanic17 2021-07-21 11:54:11 -05:00
  • acc15485fa [New Rule] Windows Defender Exclusions Added via PowerShell (#1370) dstepanic17 2021-07-21 11:54:11 -05:00
  • fbd4cf2117 [New Rule] Windows Defender Exclusions Added via PowerShell (#1370) dstepanic17 2021-07-21 11:54:11 -05:00
  • 07a7784659 Update cardinality field in schema for threshold rules (#1349) Justin Ibarra 2021-07-21 08:32:54 -08:00
  • e9b2ebab2d Update cardinality field in schema for threshold rules (#1349) Justin Ibarra 2021-07-21 08:32:54 -08:00
  • 163d9e3864 Update cardinality field in schema for threshold rules (#1349) Justin Ibarra 2021-07-21 08:32:54 -08:00
  • bc82e214c7 [Rule Tuning] Mimikatz powershell module activity detected (#1297) Austin Songer 2021-07-21 02:08:04 -05:00
  • 34b37c0bfd [Rule Tuning] Mimikatz powershell module activity detected (#1297) Austin Songer 2021-07-21 02:08:04 -05:00
  • 95e6458c6e [Rule Tuning] Mimikatz powershell module activity detected (#1297) Austin Songer 2021-07-21 02:08:04 -05:00
  • ce66c684b0 [Rule Tuning] Add Filebeat and Auditbeat to Network Rules (#1282) Andrew Pease 2021-07-21 01:59:22 -05:00
  • f0514de6a2 [Rule Tuning] Add Filebeat and Auditbeat to Network Rules (#1282) Andrew Pease 2021-07-21 01:59:22 -05:00
  • 34df7c6b89 [Rule Tuning] Add Filebeat and Auditbeat to Network Rules (#1282) Andrew Pease 2021-07-21 01:59:22 -05:00
  • 324d46ee74 [New Rule] O365 Excessive SSO Logon Errors (#1215) Austin Songer 2021-07-21 01:55:00 -05:00
  • f64a9599d0 [New Rule] O365 Excessive SSO Logon Errors (#1215) Austin Songer 2021-07-21 01:55:00 -05:00
  • 64c3f7cdc5 [New Rule] O365 Excessive SSO Logon Errors (#1215) Austin Songer 2021-07-21 01:55:00 -05:00
  • 55d2780a6e [New Rule] Disable Windows Event and Security Logs (#1181) Austin Songer 2021-07-21 01:44:35 -05:00
  • 47ca92f97a [New Rule] Disable Windows Event and Security Logs (#1181) Austin Songer 2021-07-21 01:44:35 -05:00
  • c82790f588 [New Rule] Disable Windows Event and Security Logs (#1181) Austin Songer 2021-07-21 01:44:35 -05:00
  • 4d69ad4ae6 [Rule Tuning] Suspicious CertUtil Commands (#1180) Austin Songer 2021-07-21 01:26:36 -05:00
  • 77b80d7e6d [Rule Tuning] Suspicious CertUtil Commands (#1180) Austin Songer 2021-07-21 01:26:36 -05:00
  • 4a11ef9514 [Rule Tuning] Suspicious CertUtil Commands (#1180) Austin Songer 2021-07-21 01:26:36 -05:00
  • 8916b7dd4b [Rule Tuning] External IP Lookup from Non-Browser Process (#1147) Austin Songer 2021-07-21 00:47:39 -05:00
  • c6987f2484 [Rule Tuning] External IP Lookup from Non-Browser Process (#1147) Austin Songer 2021-07-21 00:47:39 -05:00
  • 920d973064 [Rule Tuning] External IP Lookup from Non-Browser Process (#1147) Austin Songer 2021-07-21 00:47:39 -05:00
  • f3c794c48a [New Rule] CyberArkPas promotion rules (#1336) Justin Ibarra 2021-07-20 10:01:02 -08:00
  • adc63cd84b Add optional integration field to the schema (#1359) Ross Wolf 2021-07-19 12:52:44 -06:00
  • 9bddabf8e9 Add optional integration field to the schema (#1359) Ross Wolf 2021-07-19 12:52:44 -06:00
  • 816e31cd38 Add optional integration field to the schema (#1359) Ross Wolf 2021-07-19 12:52:44 -06:00
  • 9b9bebbd27 [New Rule] Parent Process PID Spoofing (#1338) Samirbous 2021-07-15 22:55:46 +02:00
  • f052e81907 [New Rule] Parent Process PID Spoofing (#1338) Samirbous 2021-07-15 22:55:46 +02:00
  • 81ab43898c [New Rule] Parent Process PID Spoofing (#1338) Samirbous 2021-07-15 22:55:46 +02:00
  • cfc0fdd5db Add 7.14 to the list of target backport branches (#1341) Ross Wolf 2021-07-14 16:29:23 -06:00
  • f9cc25565c Add 7.14 to the list of target backport branches (#1341) Ross Wolf 2021-07-14 16:29:23 -06:00
  • 809c06ad5f Add 7.14 to the list of target backport branches (#1341) Ross Wolf 2021-07-14 16:29:23 -06:00
  • 51d171c50e [CI] Publish to integrations from on-demand job (#1340) Ross Wolf 2021-07-14 16:19:41 -06:00
  • 77c23da1db [CI] Publish to integrations from on-demand job (#1340) Ross Wolf 2021-07-14 16:19:41 -06:00
  • fe816747e7 [APM] Adds APM data stream 'traces-apm*' to apm rules (#105334) (#1335) Oliver Gupte 2021-07-13 09:04:58 -04:00
  • 7ec97e622f [APM] Adds APM data stream 'traces-apm*' to apm rules (#105334) (#1335) Oliver Gupte 2021-07-13 09:04:58 -04:00
  • c94b70413e [CI] Update backport job to filter out incompatible rules (#1332) Ross Wolf 2021-07-12 14:41:48 -06:00
  • 1e6e5ef0a0 [CI] Update backport job to filter out incompatible rules (#1332) Ross Wolf 2021-07-12 14:41:48 -06:00
  • 4e2a141145 [CI/CD] Create on-demand job to release from Kibana (#1334) Ross Wolf 2021-07-12 14:34:54 -06:00
  • 5b0f72ffc3 [CI/CD] Create on-demand job to release from Kibana (#1334) Ross Wolf 2021-07-12 14:34:54 -06:00
  • 6c15c3c0e7 Add command to unstage incompatible rules from git (#1317) Ross Wolf 2021-07-08 13:44:04 -06:00
  • cf736046f1 Add command to unstage incompatible rules from git (#1317) Ross Wolf 2021-07-08 13:44:04 -06:00
  • 7b9bed72be Bump the Fleet package version integration-v0.13.2 Ross Wolf 2021-07-07 21:19:06 -06:00
  • 2f03035342 Lock versions for Fleet package 0.13.2 (#1330) Ross Wolf 2021-07-07 15:43:40 -06:00
  • 42957129ad Lock versions for Fleet package 0.13.2 (#1330) Ross Wolf 2021-07-07 15:43:40 -06:00
  • 43dd58d11d [New Rule] Potential PrintNightmare Exploitation rules (#1326) Samirbous 2021-07-07 18:56:39 +02:00
  • 89420ae976 [New Rule] Potential PrintNightmare Exploitation rules (#1326) Samirbous 2021-07-07 18:56:39 +02:00
  • dd24dabb0d [New Rule] Complementary Rules for Recent REvil TTPs (#1329) Samirbous 2021-07-07 17:02:40 +02:00
  • 9fadc4c1dc [New Rule] Complementary Rules for Recent REvil TTPs (#1329) Samirbous 2021-07-07 17:02:40 +02:00
  • 68e7b6bbe3 Make "config" in note field consistent (#1310) Justin Ibarra 2021-07-06 15:54:01 -08:00
  • 63a39665e3 Make "config" in note field consistent (#1310) Justin Ibarra 2021-07-06 15:54:01 -08:00
  • c82e89ad34 Add min_stack_version to 7.14+ only rules (#1321) ML-DGA-20210706-5 Ross Wolf 2021-07-06 13:42:09 -06:00
  • 77eaa64bf9 Update the pythonpackage.yml job to only upload artifacts for 'push' (#1322) Ross Wolf 2021-07-06 13:40:39 -06:00
  • 3120252982 Update the pythonpackage.yml job to only upload artifacts for 'push' (#1322) Ross Wolf 2021-07-06 13:40:39 -06:00