Commits

Branch selector

 master

User selector

neu5ron

Datepicker

All time

Commit History

Commits on Feb 25, 2022

• Update zeek_dns_suspicious_zbit_flag.yml

  neu5ron

  authored
  7dc0fac

  Copy full SHA for 7dc0fac

Commits on Feb 24, 2022

• Update zeek_dns_suspicious_zbit_flag.yml

  Show description for 878df63
  neu5ron

  authored
  878df63

  Copy full SHA for 878df63

Commits on Nov 6, 2021

• remove duplicate exclusion

  Show description for 8291aba
  neu5ron

  authored
  8291aba

  Copy full SHA for 8291aba

Commits on Sep 20, 2021

• Zeek detection for OMIGOD HTTP RCE

  Show description for 61c9c9f
  neu5ron

  committed
  61c9c9f

  Copy full SHA for 61c9c9f

Commits on Aug 31, 2021

• Merge branch 'master' into qoutes_and_wildcards

  Show description for 414e851
  neu5ron

  committed
  414e851

  Copy full SHA for 414e851

Commits on Aug 30, 2021

• Merge branch 'master' of https://github.com/SigmaHQ/sigma into qoutes_and_wildcards

  Show description for 96c7e18
  neu5ron

  committed
  96c7e18

  Copy full SHA for 96c7e18

• Merge branch 'master' of https://github.com/SigmaHQ/sigma into qoutes_and_wildcards

  Show description for 61897fa
  neu5ron

  committed
  61897fa

  Copy full SHA for 61897fa

Commits on Aug 24, 2021

• Zeek dce_rpc.log Detection of print driver installs over RPC (ie: possible PrintNightmare) using the three existing known RPC functions, as well as few others "discussed" but not directly related t…

  Show description for 9e588fd
  neu5ron

  committed
  9e588fd

  Copy full SHA for 9e588fd

Commits on Aug 23, 2021

• condition fix and add fields

  Show description for b255586
  neu5ron

  authored
  b255586

  Copy full SHA for b255586

• improve rule logic zeek_default_cobalt_strike_certificate.yml

  Show description for 064d7b7
  neu5ron

  authored
  064d7b7

  Copy full SHA for 064d7b7

• correct fields for zeek_rdp_public_listener.yml

  Show description for cfc32e5
  neu5ron

  authored
  cfc32e5

  Copy full SHA for cfc32e5

• improve rule

  Show description for 1819e4b
  neu5ron

  authored
  1819e4b

  Copy full SHA for 1819e4b

• Update zeek_dns_mining_pools.yml

  neu5ron

  authored
  feb7d0e

  Copy full SHA for feb7d0e

• added logic and usage

  Show description for b00e177
  neu5ron

  authored
  b00e177

  Copy full SHA for b00e177

• Update zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml

  Show description for 4f8bd4a
  neu5ron

  authored
  4f8bd4a

  Copy full SHA for 4f8bd4a

• Update zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml

  neu5ron

  authored
  6aea58b

  Copy full SHA for 6aea58b

• Update zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml

  Show description for 78c667f
  neu5ron

  authored
  78c667f

  Copy full SHA for 78c667f

• Create zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml

  neu5ron

  authored
  96e77eb

  Copy full SHA for 96e77eb

Commits on May 9, 2021

• fix - add date

  neu5ron

  authored
  0bee1b0

  Copy full SHA for 0bee1b0

Commits on May 4, 2021

• add netbios port exclusion

  Show description for 4152199
  neu5ron

  authored
  4152199

  Copy full SHA for 4152199

• Suspicious DNS Z Flag Set

  Show description for d4bd69d
  neu5ron

  authored
  d4bd69d

  Copy full SHA for d4bd69d

Commits on Feb 1, 2021

• Merge branch 'master' of https://github.com/Neo23x0/sigma into qoutes_and_wildcards

  Show description for a3a9006
  neu5ron

  committed
  a3a9006

  Copy full SHA for a3a9006

Commits on Jan 18, 2021

• Add to ElasticsearchDSLBackend the logic to NOT quote an analyzed field if it contains wildcard, things such as '*' get treated as an exact match

  Show description for 36656c3
  neu5ron

  committed
  36656c3

  Copy full SHA for 36656c3

• Add logic to NOT quote an analyzed field if it contains wildcard, things such as '*' get treated as an exact match

  Show description for caf6586
  neu5ron

  committed
  caf6586

  Copy full SHA for caf6586

• revert commented line

  neu5ron

  committed
  47bd41f

  Copy full SHA for 47bd41f

Commits on Aug 25, 2020

• control whether to use an analyzed field or different type if a query/value contains a wildcard.

  Show description for f21b3c5
  neu5ron

  committed
  f21b3c5

  Copy full SHA for f21b3c5

• elasticsearch regex escape of '.' for case insensitivity backend options

  Show description for a7ffb96
  neu5ron

  committed
  a7ffb96

  Copy full SHA for a7ffb96

• add new options to readme for elasticbackend

  Show description for 474e04d
  neu5ron

  committed
  474e04d

  Copy full SHA for 474e04d

• fix sub field name usage if there are 3 or more fields..

  Show description for 76910ea
  neu5ron

  committed
  76910ea

  Copy full SHA for 76910ea

• control whether to use an analyzed field or different type if a query/value contains a wildcard.

  Show description for 0d713e4
  neu5ron

  committed
  0d713e4

  Copy full SHA for 0d713e4

Commits on Jun 12, 2020

• Merge remote-tracking branch 'neu5ron-sigma/sigmacs' into sigmacs

  Show description for db6c9dc
  neu5ron

  committed
  db6c9dc

  Copy full SHA for db6c9dc

• typo, was missing the = and *.

  Show description for aac1af1
  neu5ron

  committed
  aac1af1

  Copy full SHA for aac1af1

• typo, was missing the = and *.

  Show description for db0292a
  neu5ron

  committed
  db0292a

  Copy full SHA for db0292a

Commits on Jun 9, 2020

• Merge branch 'master' of https://github.com/Neo23x0/sigma into sigmacs

  neu5ron

  committed
  2b73549

  Copy full SHA for 2b73549

• update readme for some analyzed field and keyword field examples

  neu5ron

  committed
  f4fe425

  Copy full SHA for f4fe425

Pagination

Previous

Next