security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
2c3dbfc039ec8d9a0e54ec78bc69f545ef3773b0
sigma-rules/rules_building_block
T
History
Mika Ayenson 2c3dbfc039 Revert "Back-porting Version Trimming (#3681)" 
This reverts commit 71d2c59b5c.
2024-05-22 13:51:46 -05:00
..
.gitkeep
[FR] Add support for building block rules (BBR) (#2822)
2023-06-20 09:00:30 -04:00
collection_archive_data_zip_imageload.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
collection_common_compressed_archived_file.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
collection_files_staged_in_recycle_bin_root.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
collection_linux_suspicious_clipboard_activity.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
collection_outlook_email_archive.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
collection_posh_compression.toml
[Rule Tuning] Replace KQL exceptions for Query DSL Exceptions (#3505)
2024-04-01 17:44:50 -03:00
command_and_control_bitsadmin_activity.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
command_and_control_certutil_network_connection.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
command_and_control_linux_ssh_x11_forwarding.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
command_and_control_non_standard_http_port.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
credential_access_mdmp_file_creation.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
credential_access_mdmp_file_unusual_extension.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
credential_access_win_private_key_access.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_cmd_copy_binary_contents.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_cmstp_execution.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_collection_masquerading_unusual_archive_file_extension.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_communication_apps_suspicious_child_process.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_creation_of_hidden_files_directories.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_dll_hijack.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_dotnet_clickonce_dfsvc_netcon.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_download_susp_extension.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_execution_via_visualstudio_prebuildevent.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_file_permission_modification.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_generic_deletion.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_indirect_command_exec_pcalua_forfiles.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_injection_from_msoffice.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_installutil_command_activity.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_invalid_codesign_imageload.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_masquerading_browsers.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_masquerading_unusual_exe_file_extension.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_masquerading_vlc_dll.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_masquerading_windows_dll.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_masquerading_windows_system32_exe.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_msdt_suspicious_diagcab.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_msiexec_installsource_archive_file.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_powershell_clear_logs_script.toml
[Rule Tuning] Replace KQL exceptions for Query DSL Exceptions (#3505)
2024-04-01 17:44:50 -03:00
defense_evasion_processes_with_trailing_spaces.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_service_disabled_registry.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_service_path_registry.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_services_exe_path.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_suspicious_msiexec_execution.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_unsigned_bits_client.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_unusual_process_extension.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_unusual_process_path_wbem.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
defense_evasion_write_dac_access.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_capnetraw_capability.toml
[Tuning] event.action and event.type change (#3495)
2024-03-13 10:11:21 +01:00
discovery_files_dir_systeminfo_via_cmd.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_generic_account_groups.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_generic_process_discovery.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_generic_registry_query.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_hosts_file_access.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_internet_capabilities.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_kernel_module_enumeration_via_proc.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_linux_modprobe_enumeration.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_linux_sysctl_enumeration.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_linux_system_information_discovery.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_linux_system_owner_user_discovery.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_net_share_discovery_winlog.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_net_view.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_of_accounts_or_groups_via_builtin_tools.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_of_domain_groups.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_posh_generic.toml
[Rule Tuning] Windows BBR Rule Tuning - 2 (#3580)
2024-04-08 09:34:26 -03:00
discovery_posh_password_policy.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_post_exploitation_external_ip_lookup.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_potential_memory_seeking_activity.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_process_discovery_via_builtin_tools.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_remote_system_discovery_commands_windows.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_security_software_wmic.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_signal_unusual_user_host.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_suspicious_memory_grep_activity.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_suspicious_proc_enumeration.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_system_network_connections.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_system_service_discovery.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_system_time_discovery.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_win_network_connections.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
discovery_windows_system_information_discovery.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
execution_github_new_event_action_for_pat.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
execution_github_new_repo_interaction_for_pat.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
execution_github_new_repo_interaction_for_user.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
execution_github_repo_created.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
execution_github_repo_interaction_from_new_ip.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
execution_linux_segfault.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
execution_settingcontent_ms_file_creation.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
execution_unix_socket_communication.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
execution_unsigned_service_executable.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
execution_wmi_wbemtest.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
impact_github_member_removed_from_organization.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
impact_github_pat_access_revoked.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
impact_github_user_blocked_from_organization.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
initial_access_cross_site_scripting.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
initial_access_github_new_ip_address_for_pat.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
initial_access_github_new_ip_address_for_user.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
initial_access_github_new_user_agent_for_pat.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
initial_access_github_new_user_agent_for_user.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
lateral_movement_at.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
lateral_movement_posh_winrm_activity.toml
[Rule Tuning] Replace KQL exceptions for Query DSL Exceptions (#3505)
2024-04-01 17:44:50 -03:00
lateral_movement_rdp_conn_unusual_process.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
lateral_movement_unusual_process_sql_accounts.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
lateral_movement_wmic_remote.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
persistence_aws_iam_login_profile_added_to_user.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
persistence_cap_sys_admin_added_to_new_binary.toml
[Tuning] event.action and event.type change (#3495)
2024-03-13 10:11:21 +01:00
persistence_creation_of_kernel_module.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
persistence_github_new_pat_for_user.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
persistence_github_new_user_added_to_organization.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
persistence_startup_folder_lnk.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
persistence_transport_agent_exchange.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00
privilege_escalation_trap_execution.toml
Revert "Back-porting Version Trimming (#3681)"
2024-05-22 13:51:46 -05:00