Commits

Branch selector

 master

User selector

Cyb3rWard0g

Datepicker

All time

Commit History

Commits on Oct 27, 2021

• added definition to Sysmon 13.30 rule for priv escalation

  Cyb3rWard0g

  committed
  7543b3e

  Copy full SHA for 7543b3e

• Added the right System string to User filter

  Cyb3rWard0g

  committed
  d80f736

  Copy full SHA for d80f736

• added integrity level for user

  Cyb3rWard0g

  committed
  9c7a736

  Copy full SHA for 9c7a736

• Unsupported rule now possible with Sysmonv13.30

  Cyb3rWard0g

  committed
  5aac1b6

  Copy full SHA for 5aac1b6

Commits on Oct 16, 2021

• Rule for Cron activity - file creation

  Cyb3rWard0g

  committed
  2b3e40e

  Copy full SHA for 2b3e40e

Commits on Oct 15, 2021

• added indentation to lists per request

  Cyb3rWard0g

  committed
  2c0e89c

  Copy full SHA for 2c0e89c

• Fixed format indentation to fix block error

  Cyb3rWard0g

  committed
  7b11987

  Copy full SHA for 7b11987

• split commandline arguments in a few rules

  Cyb3rWard0g

  committed
  d391ecc

  Copy full SHA for d391ecc

• updated rules schema and added Clipboard Collection with Xclip Tool

  Cyb3rWard0g

  committed
  eed8607

  Copy full SHA for eed8607

• Updated at command rule to use Image field

  Cyb3rWard0g

  committed
  04ff9ae

  Copy full SHA for 04ff9ae

• commands to clear or remove the syslog rule

  Cyb3rWard0g

  committed
  aa0a5b8

  Copy full SHA for aa0a5b8

• OMI SCX Execute RunAsProvider rules

  Cyb3rWard0g

  committed
  f8cb088

  Copy full SHA for f8cb088

• detect overwriting and deletion of files via dd

  Cyb3rWard0g

  committed
  ca99394

  Copy full SHA for ca99394

Commits on Oct 8, 2021

• added rule to detect suspicious named pipe connections to an AD FS server

  Cyb3rWard0g

  committed
  7f17eae

  Copy full SHA for 7f17eae

Commits on Sep 18, 2021

• Rule to detect the execution of a script via SCX RunAsprovider ExecuteScript

  Cyb3rWard0g

  committed
  407289d

  Copy full SHA for 407289d

Commits on Sep 17, 2021

• updated level to high

  Cyb3rWard0g

  committed
  c17104b

  Copy full SHA for c17104b

• Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell

  Cyb3rWard0g

  committed
  7618cf4

  Copy full SHA for 7618cf4

Commits on Aug 26, 2021

• Merge branch 'master' into feature/AADHealth-Agent-HybridADFSServices

  Cyb3rWard0g

  committed
  f05cf20

  Copy full SHA for f05cf20

• adding basic rules to detect behavior around AAD health agents and AAD Hybrid Health AD FS services in Azure

  Cyb3rWard0g

  committed
  f98970e

  Copy full SHA for f98970e

Commits on Apr 12, 2021

• HybridConnectionMgr Service Activity

  Cyb3rWard0g

  committed
  db0e969

  Copy full SHA for db0e969

Commits on Oct 30, 2020

• A few more - 7 Rules

  Cyb3rWard0g

  committed
  972326f

  Copy full SHA for 972326f

• Merge branch 'master' of https://github.com/Neo23x0/sigma

  Cyb3rWard0g

  committed
  25b92d4

  Copy full SHA for 25b92d4

Commits on Oct 17, 2020

• Create sysmon_wmic_remote_xsl_scripting_dlls.yml

  Show description for 7c9249f
  Cyb3rWard0g

  committed
  7c9249f

  Copy full SHA for 7c9249f

Commits on Oct 16, 2020

• Merge branch 'master' of https://github.com/Neo23x0/sigma

  Cyb3rWard0g

  committed
  4f039c7

  Copy full SHA for 4f039c7

Commits on Oct 13, 2020

• Update win_sysmon_channel_reference_deletion.yml

  Cyb3rWard0g

  committed
  6500c23

  Copy full SHA for 6500c23

• Updated Contains keys

  Cyb3rWard0g

  committed
  a9bcf45

  Copy full SHA for a9bcf45

• 13 Rules from THP - Backlog Rules (old)

  Cyb3rWard0g

  committed
  2cb540f

  Copy full SHA for 2cb540f

• Update delete alternate powershell host

  Cyb3rWard0g

  committed
  cd27067

  Copy full SHA for cd27067

• Update - Adding description to zeek exfiltration compressed files

  Cyb3rWard0g

  committed
  55d6bd8

  Copy full SHA for 55d6bd8

• update - GitHub Action / Test Sigma

  Cyb3rWard0g

  committed
  354b6a9

  Copy full SHA for 354b6a9

• update - GitHub Action / Test Sigma

  Cyb3rWard0g

  committed
  189e3c2

  Copy full SHA for 189e3c2

• update - GitHub Action / Test Sigma

  Cyb3rWard0g

  committed
  24e0d09

  Copy full SHA for 24e0d09

• update - GitHub Action / Test Sigma

  Cyb3rWard0g

  committed
  72f3537

  Copy full SHA for 72f3537

• update - GitHub Action / Test Sigma

  Cyb3rWard0g

  committed
  644f222

  Copy full SHA for 644f222

• Updated - GitHub Action / Test Sigma

  Cyb3rWard0g

  committed
  491049b

  Copy full SHA for 491049b

Pagination

Previous

Next