Commits

Branch selector

 master

User selector

secDre4mer

Datepicker

All time

Commit History

Commits on Sep 6, 2024

• Merge PR SigmaHQ#5002 from @secDre4mer - Update Potential CommandLine Obfuscation Using Unicode Characters rules

  Show description for ab2fb36
  

  secDre4mer

  and

  nasbench

  authored
  ab2fb36

Commits on Sep 3, 2024

• Merge PR SigmaHQ#4995 from @secDre4mer - Add Process Deletion of Its Own Executable

  Show description for 9b39e26
  

  secDre4mer

  and

  nasbench

  authored
  9b39e26

Commits on Aug 27, 2024

• Merge PR SigmaHQ#4985 from @secDre4mer - Update Potential Active Directory Reconnaissance/Enumeration Via LDAP

  Show description for 5550ccd
  secDre4mer

  authored
  5550ccd

Commits on Mar 2, 2024

• Merge PR SigmaHQ#4750 from @secDre4mer - Fix false positive with Potential Credential Dumping Activity Via LSASS rule

  Show description for 4655938
  secDre4mer

  authored
  4655938

Commits on Oct 21, 2022

• fix: FP with conhost / csrss

  secDre4mer

  committed
  c219046

Commits on Oct 20, 2022

• Merge pull request SigmaHQ#3614 from phantinuss/master

  Show description for 5665354
  secDre4mer

  authored
  5665354

Commits on Aug 23, 2022

• fix: title casing

  secDre4mer

  committed
  74f9e77

• feat: new rule for sysnative process creation

  secDre4mer

  committed
  6711a3e

Commits on Jun 7, 2022

• feat: new rule for persistence using Office startup

  secDre4mer

  committed
  c32e0b2

Commits on Jun 2, 2022

• feat: Add rule for renamed browser core execution

  secDre4mer

  committed
  d849ece

Commits on Apr 14, 2022

• feat: Add rule for equation editor network connections

  secDre4mer

  committed
  e6dbb6b

Commits on Apr 13, 2022

• fix: copy / paste issues

  secDre4mer

  committed
  98f3135

Commits on Apr 7, 2022

• feat: Generate low sigma match for new credential logon

  secDre4mer

  committed
  47c6855

• feat: detect PS execution in public folder

  secDre4mer

  committed
  df41827

• feat: Add new rule for Creative Cloud node abuse

  secDre4mer

  committed
  3cddcc9

• fix: Add FP exclusion for vss_ps.dll load

  Show description for 0264909
  secDre4mer

  committed
  0264909

Commits on Mar 29, 2022

• fix: filter null image in process creation rule

  secDre4mer

  committed
  36ba148

Commits on Mar 15, 2022

• feat: Add log sources for process listing within THOR

  secDre4mer

  committed
  1044a20

Commits on Jan 25, 2022

• chore: update modified date

  secDre4mer

  committed
  51d9aca

• fix: Add filter for empty image to rule

  secDre4mer

  committed
  0cad38b

Commits on Dec 14, 2021

• fix: correct FP filter

  secDre4mer

  committed
  7fea250

Commits on Dec 13, 2021

• feat: Add finer powershell log source distinguation

  Show description for b4553dc
  secDre4mer

  committed
  b4553dc

Commits on Dec 9, 2021

• fix: inline list with one argument

  secDre4mer

  committed
  3c699a2

• feat: Add rules to detect uncommon process creation events

  secDre4mer

  committed
  ca2ead7

• fix: mark string as regex

  secDre4mer

  committed
  538fb06

Commits on Sep 21, 2021

• chore: properly name and describe rules

  secDre4mer

  committed
  bf9bc03

• feat: Add rule for live memory dumping

  secDre4mer

  committed
  8c3faa3

• feat: Add rule for syslog removal

  secDre4mer

  committed
  346ff26

Commits on Aug 23, 2021

• feat: Add rule for malicious CSR export on Exchange

  secDre4mer

  committed
  82dde59

Commits on Aug 16, 2021

• fix: Clean up duplicated ID

  secDre4mer

  committed
  78e2c0d

• feat: Add some rules to detect Conti behaviour

  Show description for 5b60e0e
  secDre4mer

  committed
  5b60e0e

• fix: Remove powershell_alternate_hosts from PR

  Show description for d2a35ed
  secDre4mer

  committed
  d2a35ed

Commits on Aug 13, 2021

• fix: Correct broken rules, add documentation

  secDre4mer

  committed
  ce326cb

• fix: Rewrite another message rule

  Show description for e1ef8f4
  secDre4mer

  committed
  e1ef8f4

Commits on Aug 12, 2021

• fix: Correct incorrect message / keyword usage

  Show description for 6f05e33
  secDre4mer

  committed
  6f05e33

Pagination

PreviousNext