security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Commit Graph

  • d6cc14d889 [DOCS] Update branching steps (#1290) Ross Wolf 2021-07-02 09:48:25 -06:00
  • b677264876 [DOCS] Update branching steps (#1290) Ross Wolf 2021-07-02 09:48:25 -06:00
  • df8f4af3fc Add min_stack_version to rule metadata (#1173) Justin Ibarra 2021-06-30 13:26:27 -08:00
  • 781953a0a0 Add min_stack_version to rule metadata (#1173) Justin Ibarra 2021-06-30 13:26:27 -08:00
  • 4d54a87f3c Extend metadata with [metadata.extended] section (#1306) Ross Wolf 2021-06-25 17:02:11 -06:00
  • f1476b1637 Extend metadata with [metadata.extended] section (#1306) Ross Wolf 2021-06-25 17:02:11 -06:00
  • fd0eee4cc0 Add new ECS and beats schemas (#1303) Justin Ibarra 2021-06-23 14:08:23 -08:00
  • 1099f181f9 Add new ECS and beats schemas (#1303) Justin Ibarra 2021-06-23 14:08:23 -08:00
  • 102b9ff7d5 [New Rule] AWS RDS Security Group Created (#1260) Austin Songer 2021-06-22 19:14:56 -05:00
  • 8e451f2318 [New Rule] AWS RDS Security Group Created (#1260) Austin Songer 2021-06-22 19:14:56 -05:00
  • 6fd6bb1712 [New Rule] AWS RDS Security Group Deleted (#1261) Austin Songer 2021-06-22 19:09:15 -05:00
  • fe14cd23ed [New Rule] AWS RDS Security Group Deleted (#1261) Austin Songer 2021-06-22 19:09:15 -05:00
  • 7749086f3b [New Rule] AWS RDS Instance Creation (#1269) Austin Songer 2021-06-22 19:02:48 -05:00
  • 9d4574b267 [New Rule] AWS RDS Instance Creation (#1269) Austin Songer 2021-06-22 19:02:48 -05:00
  • 78c75d71b0 [New Rule] AWS RDS Snapshot Export (#1270) Austin Songer 2021-06-22 18:58:13 -05:00
  • ccae1dc841 [New Rule] AWS RDS Snapshot Export (#1270) Austin Songer 2021-06-22 18:58:13 -05:00
  • 4823a40d19 [Rule Tuning] Potential password spraying of microsoft 365 user accounts (#1164) Austin Songer 2021-06-22 12:36:13 -05:00
  • c215c44809 [Rule Tuning] Potential password spraying of microsoft 365 user accounts (#1164) Austin Songer 2021-06-22 12:36:13 -05:00
  • ba5f3eed82 Switch from process.ppid to process.parent.pid (#1255) Ross Wolf 2021-06-22 09:10:28 -06:00
  • 31f63e728e Switch from process.ppid to process.parent.pid (#1255) Ross Wolf 2021-06-22 09:10:28 -06:00
  • 549cc9992d [Rule Tuning] Attempts to Brute Force a Microsoft 365 User Account (#1251) Brent Murphy 2021-06-22 10:38:49 -04:00
  • d8ef9a81ef [Rule Tuning] Attempts to Brute Force a Microsoft 365 User Account (#1251) Brent Murphy 2021-06-22 10:38:49 -04:00
  • c493c5df67 Update initial_access_smb_windows_file_sharing_activity_to_the_internet.toml (#1225) Brent Murphy 2021-06-22 10:22:01 -04:00
  • a8c9d7174f Update initial_access_smb_windows_file_sharing_activity_to_the_internet.toml (#1225) Brent Murphy 2021-06-22 10:22:01 -04:00
  • 74132fbbe9 [New Rule] AWS Route 53 Domain Transferred to Another Account (#1198) Austin Songer 2021-06-22 01:08:59 -05:00
  • ea9a23af8d [New Rule] AWS Route 53 Domain Transferred to Another Account (#1198) Austin Songer 2021-06-22 01:08:59 -05:00
  • 10d22d9477 [New Rule] AWS Route 53 Domain Transfer Lock Disabled (#1197) Austin Songer 2021-06-22 01:05:53 -05:00
  • 2cadee1718 [New Rule] AWS Route 53 Domain Transfer Lock Disabled (#1197) Austin Songer 2021-06-22 01:05:53 -05:00
  • b8a3f43b99 [New Rule] EC2 Full Network Packet Capture Detected (#1175) Austin Songer 2021-06-22 01:00:48 -05:00
  • d7e0e37e54 [New Rule] EC2 Full Network Packet Capture Detected (#1175) Austin Songer 2021-06-22 01:00:48 -05:00
  • 3996e94bfd [New Rule] Azure Service Principal Credentials Added (#1169) Austin Songer 2021-06-22 00:49:45 -05:00
  • 6986f28af6 [New Rule] Azure Service Principal Credentials Added (#1169) Austin Songer 2021-06-22 00:49:45 -05:00
  • 119cd60f4e Lock versions for 0.13.1 package Ross Wolf 2021-06-17 12:38:27 -06:00
  • 045d928daf Lock versions for 0.13.1 package integration-v0.13.1 Ross Wolf 2021-06-17 12:38:27 -06:00
  • 1ff659a634 Update the package version to 0.14.0-dev.0 Ross Wolf 2021-06-17 07:25:41 -06:00
  • 1f5820be76 Bump package version to 0.13.1 Ross Wolf 2021-06-17 07:23:50 -06:00
  • 6fca31c5de Fix fleet package generation (#1296) Ross Wolf 2021-06-17 06:16:09 -06:00
  • e897a67604 Fix fleet package generation (#1296) Ross Wolf 2021-06-17 06:16:09 -06:00
  • 98cb7b00cc Simplify version locking code and fix 7.13.0 lock (#1295) Ross Wolf 2021-06-16 18:02:47 -06:00
  • f6839e98d1 Simplify version locking code and fix 7.13.0 lock (#1295) Ross Wolf 2021-06-16 18:02:47 -06:00
  • e41fe620e6 [New Rule] Add detection rules for auth ML jobs (#1283) Apoorva Joshi 2021-06-16 16:00:17 -07:00
  • 18765631fb Fix rules which were note using v2 license (#1291) Justin Ibarra 2021-06-16 06:21:30 -08:00
  • e0fa25ae8e Fix rules which were note using v2 license (#1291) Justin Ibarra 2021-06-16 06:21:30 -08:00
  • 915c2dea2a [Bug] Fix ML job IDs that used hyphens (#1287) Ross Wolf 2021-06-15 11:40:47 -06:00
  • 49cb2e8dbf [Bug] Fix ML job IDs that used hyphens (#1287) Ross Wolf 2021-06-15 11:40:47 -06:00
  • fb93735c0f [Rule Tuning] Attempts to Brute Force an Okta User Account (#1216) David French 2021-06-15 09:07:51 -07:00
  • 177cfc85bf [Rule Tuning] Attempts to Brute Force an Okta User Account (#1216) David French 2021-06-15 09:07:51 -07:00
  • cce7c126b6 Updating rules to query v2 (#1254) Apoorva Joshi 2021-06-15 07:20:50 -07:00
  • 1f7c88c6f4 Updating rules to query v2 (#1254) Apoorva Joshi 2021-06-15 07:20:50 -07:00
  • 1fd625d650 [Fleet] Update template and packaging code for fleet packages (#1280) Ross Wolf 2021-06-15 07:54:50 -06:00
  • 61e5b44c44 [Fleet] Update template and packaging code for fleet packages (#1280) Ross Wolf 2021-06-15 07:54:50 -06:00
  • 683621fe62 [Rule Tuning] Update network rule address blocks (#1227) Brent Murphy 2021-06-15 09:22:59 -04:00
  • 12577f7380 [Rule Tuning] Update network rule address blocks (#1227) Brent Murphy 2021-06-15 09:22:59 -04:00
  • 3d6cefb296 [Rule Tuning] Attempts to brute force a microsoft 365 user account (#1163) Austin Songer 2021-06-15 08:20:20 -05:00
  • 546e43071c [Rule Tuning] Attempts to brute force a microsoft 365 user account (#1163) Austin Songer 2021-06-15 08:20:20 -05:00
  • 8b3d085f73 Update persistence_suspicious_com_hijack_registry.toml (#1244) Brent Murphy 2021-06-14 09:00:22 -04:00
  • 13bf55480a Update persistence_suspicious_com_hijack_registry.toml (#1244) Brent Murphy 2021-06-14 09:00:22 -04:00
  • ecbfb8b572 Add KQL support for additional ES field types (#1247) Ross Wolf 2021-06-10 22:30:11 -06:00
  • c98398f1ef Add KQL support for additional ES field types (#1247) Ross Wolf 2021-06-10 22:30:11 -06:00
  • 5d41f2719a [New Rule] AWS EC2 VM Export Failure (#1142) Austin Songer 2021-06-09 14:03:37 -05:00
  • 6b45186827 [New Rule] AWS EC2 VM Export Failure (#1142) Austin Songer 2021-06-09 14:03:37 -05:00
  • 1eb36b1a9e [New Rule] Modification of AmsiEnable Registry Key (#1248) Brent Murphy 2021-06-07 13:21:18 -04:00
  • fce022c275 [New Rule] Modification of AmsiEnable Registry Key (#1248) Brent Murphy 2021-06-07 13:21:18 -04:00
  • cc6cc6bd3e Lock the versions from 7.13.0 (#1256) Ross Wolf 2021-06-04 16:15:33 -06:00
  • 90c6f24e8f Lock the versions from 7.13.0 (#1256) Ross Wolf 2021-06-04 16:15:33 -06:00
  • 30644d0d6a Update problem-child.md (#1253) Apoorva Joshi 2021-06-03 12:47:00 -07:00
  • 8bb7218e38 Update problem-child.md (#1253) ML-DGA-20210604-4 Apoorva Joshi 2021-06-03 12:47:00 -07:00
  • 14349b342d Refactor experimental ML CLI and code (#1218) Justin Ibarra 2021-06-02 20:37:12 -08:00
  • 0ec8d67e78 Refactor experimental ML CLI and code (#1218) ML-experimental-detections-20210603-5 ML-experimental-detections-20210602-4 ML-ProblemChild-20210602-1 ML-DGA-20210602-3 Justin Ibarra 2021-06-02 20:37:12 -08:00
  • 057d29a8d2 Fix create-rule bug (#1246) Justin Ibarra 2021-06-01 08:31:36 -08:00
  • e46f5e96d3 Fix create-rule bug (#1246) Justin Ibarra 2021-06-01 08:31:36 -08:00
  • f91e0facea Update privilege_escalation_persistence_phantom_dll.toml (#1228) Brent Murphy 2021-06-01 09:29:09 -04:00
  • 6626cbb943 Update privilege_escalation_persistence_phantom_dll.toml (#1228) Brent Murphy 2021-06-01 09:29:09 -04:00
  • f9805954ee [New Rule] Unusual Network Connection via DllHost (#1232) Brent Murphy 2021-05-28 15:09:09 -04:00
  • c457614e37 [New Rule] Unusual Network Connection via DllHost (#1232) Brent Murphy 2021-05-28 15:09:09 -04:00
  • acfca54f73 [New Rule] Suspicious Execution from a Mounted Device (#1230) Brent Murphy 2021-05-28 14:44:07 -04:00
  • 31e8d03438 [New Rule] Suspicious Execution from a Mounted Device (#1230) Brent Murphy 2021-05-28 14:44:07 -04:00
  • 4088f6b544 Add a command to create a Kibana PR (#1208) Ross Wolf 2021-05-17 14:57:21 -06:00
  • b0270d059f Add a command to create a Kibana PR (#1208) Ross Wolf 2021-05-17 14:57:21 -06:00
  • fcd29373d5 [Rule Tuning] High Number of Okta User Password Reset or Unlock Attempts (#1200) Austin Songer 2021-05-14 19:52:02 +00:00
  • 58ea49b092 [Rule Tuning] High Number of Okta User Password Reset or Unlock Attempts (#1200) Austin Songer 2021-05-14 19:52:02 +00:00
  • afa6f1b541 Update backport.yml (#1205) Ross Wolf 2021-05-13 16:54:52 -06:00
  • a940c10ead Update backport.yml (#1205) Ross Wolf 2021-05-13 16:54:52 -06:00
  • 79cd81288a Port historical schemas to jsonschema (#1084) Ross Wolf 2021-05-13 14:27:32 -06:00
  • eb40c52c7c Port historical schemas to jsonschema (#1084) Ross Wolf 2021-05-13 14:27:32 -06:00
  • 88fda20b78 [Bug] Update main.py to fix toml-lint (#1202) Brent Murphy 2021-05-13 11:43:13 -04:00
  • e40276c12b [Bug] Update main.py to fix toml-lint (#1202) Brent Murphy 2021-05-13 11:43:13 -04:00
  • 138e410a06 Cleanup note field in rules (#1194) Justin Ibarra 2021-05-10 13:40:56 -08:00
  • 6ef5c53b0c Cleanup note field in rules (#1194) Justin Ibarra 2021-05-10 13:40:56 -08:00
  • 9ac3de7c82 Retrieve branch history of main in backport job Ross Wolf 2021-05-06 23:12:57 -06:00
  • c11a07316c Disable persist-credentials from checkout job (#1187) Ross Wolf 2021-05-06 22:58:31 -06:00
  • 342c35766d Use @protectionsmachine to push backports (#1186) Ross Wolf 2021-05-06 22:26:30 -06:00
  • 60f5168f07 Retrieve branch history of main in backport job Ross Wolf 2021-05-06 23:12:57 -06:00
  • 700c63d7d5 Disable persist-credentials from checkout job (#1187) Ross Wolf 2021-05-06 22:58:31 -06:00
  • a33e943591 Use @protectionsmachine to push backports (#1186) Ross Wolf 2021-05-06 22:26:30 -06:00
  • 00b479cb33 Fix backport job webhook + push (#1185) Ross Wolf 2021-05-06 21:32:40 -06:00
  • 67febf3b45 Add job for 'backport: auto' labeled PRs (#1174) Ross Wolf 2021-05-06 20:03:05 -06:00
  • f3f344018b Fix backport job webhook + push (#1185) Ross Wolf 2021-05-06 21:32:40 -06:00
  • 2ceb5b52c9 Add job for 'backport: auto' labeled PRs (#1174) Ross Wolf 2021-05-06 20:03:05 -06:00
  • a623e34a9e Fix rule filenames during packaging (#1158) Justin Ibarra 2021-05-05 11:27:04 -08:00