Commits

Branch selector

 master

User selector

hieutt35

Datepicker

All time

Commit History

Commits on Mar 24, 2022

• Add new MFA Denied rule

  hieutt35

  committed
  713bc24

  Copy full SHA for 713bc24

Commits on Oct 18, 2021

• Create new rule for detecting Microsfot Defender Tampering via Registry

  hieutt35

  committed
  ccf6c8d

  Copy full SHA for ccf6c8d

Commits on Oct 14, 2021

• Delete .DS_Store file

  hieutt35

  committed
  a7e6eb5

  Copy full SHA for a7e6eb5

Commits on Oct 13, 2021

• Merge branch 'master' of https://github.com/hieuttmmo/sigma

  hieutt35

  committed
  15c472e

  Copy full SHA for 15c472e

• Change the service to the form service: azure._a_name_ and add falsepositives field

  hieutt35

  committed
  7c01710

  Copy full SHA for 7c01710

Commits on Oct 10, 2021

• Azure Security Operations for Priveleged Accounts

  hieutt35

  committed
  5fdaefc

  Copy full SHA for 5fdaefc

Commits on Jul 23, 2021

• Update the references

  hieutt35

  committed
  77b4a37

  Copy full SHA for 77b4a37

Commits on Jul 16, 2021

• More suspicious flag fot bitsadmin execution

  hieutt35

  committed
  8effde4

  Copy full SHA for 8effde4

• Suspicious behaviours related to SOURGUM

  hieutt35

  committed
  1cb6310

  Copy full SHA for 1cb6310

Commits on Jun 30, 2021

• Detect the PrintNighmare exploit using ImageLoad

  hieutt35

  committed
  579220d

  Copy full SHA for 579220d

Commits on Mar 3, 2021

• Detect HAFNIUM operations

  hieutt35

  committed
  5f74a58

  Copy full SHA for 5f74a58

Commits on Dec 25, 2020

• Edit title convention

  hieutt35

  committed
  d551b88

  Copy full SHA for d551b88

• Detect Emotet DLL loading by looking rundll32.exe

  hieutt35

  committed
  4297e68

  Copy full SHA for 4297e68

Commits on Dec 11, 2020

• Detects suspicious shell spawn from MSSQL process, this might be sight of RCE or SQL Injection

  hieutt35

  committed
  edc79a8

  Copy full SHA for edc79a8

Commits on Sep 26, 2020

• Fix logsource service to process_creation

  hieutt35

  committed
  d4dd060

  Copy full SHA for d4dd060

• Detect Suspicious AdFind Execution

  hieutt35

  committed
  c756fc8

  Copy full SHA for c756fc8

Commits on Sep 10, 2020

• Fixed Title

  hieutt35

  committed
  49ba107

  Copy full SHA for 49ba107

• Added UID, fixed rule description

  hieutt35

  committed
  f7d5240

  Copy full SHA for f7d5240

• Detects a suspicious activities of MpCmdRun.exe, which could be an action for downloading a file from the internet using Windows Defender

  hieutt35

  committed
  1b6c6ec

  Copy full SHA for 1b6c6ec

Commits on May 14, 2020

• Update condition to filter out printer port

  hieutt35

  committed
  e53a97f

  Copy full SHA for e53a97f

• Add author

  hieutt35

  committed
  443bf09

  Copy full SHA for 443bf09

• Suspicious network connection from notepad.exe

  hieutt35

  committed
  e74970c

  Copy full SHA for e74970c

• Change level from Critical to High

  hieutt35

  committed
  97b690d

  Copy full SHA for 97b690d

Commits on May 13, 2020

• Reformat rule

  hieutt35

  committed
  d0b1c98

  Copy full SHA for d0b1c98

• New rule to detect possible CVE-2020-1048 exploitation

  hieutt35

  committed
  3e5b333

  Copy full SHA for 3e5b333