Commits

Branch selector

 master

User selector

All users

Datepicker

All time

Commit History

Commits on Feb 15, 2024

• Merge PR #4721 from @MalGamy - Add UA used by RedCurl APT

  Show description for 1b0eb51
  

  MalGamy

  and

  nasbench

  authored
  1b0eb51

  Copy full SHA for 1b0eb51

• Merge PR #4722 from @nasbench - Archive new rule references and update cache file

  Show description for 0993b78
  github-actions[bot]

  authored
  0993b78

  Copy full SHA for 0993b78

Commits on Feb 12, 2024

• Merge PR #4698 from @swachchhanda000 - Added rules that detect possible activities associated with services and modules enumeration

  Show description for 7509f6a
  

  swachchhanda000

  and

  nasbench

  authored
  7509f6a

  Copy full SHA for 7509f6a

• Merge PR #4702 from @nasbench - Rule tuning and updates

  Show description for 2acebc9
  nasbench

  authored
  2acebc9

  Copy full SHA for 2acebc9

• Merge PR #4716 from @qasimqlf - Update rule condition and filter

  Show description for cf84dcd
  

  qasimqlf

  and

  nasbench

  authored
  cf84dcd

  Copy full SHA for cf84dcd

• Merge PR #4717 from @qasimqlf - Add missing field name in rule

  Show description for 9ae511e
  qasimqlf

  authored
  9ae511e

  Copy full SHA for 9ae511e

Commits on Feb 9, 2024

• Merge PR #4705 from @slincoln-aiq - New rule: WMIC Disk and Volume Recon

  Show description for 8eeffa7
  

  3 peopleauthored
  8eeffa7

  Copy full SHA for 8eeffa7

Commits on Feb 8, 2024

• Merge PR #4712 from @prashanthpulisetti - Add a rule for Anydesk execution with known compromised certificate

  Show description for b9c0dd6
  

  3 peopleauthored
  b9c0dd6

  Copy full SHA for b9c0dd6

• Merge PR #4692 from @jstnk9 - Add new rules related to IExpress abuse

  Show description for 5fac8cb
  

  3 peopleauthored
  5fac8cb

  Copy full SHA for 5fac8cb

• Merge PR #4714 from @douglasrose75 - Add Rule Covering Exploitation Indicators For CVE 2022-42475

  Show description for a572fc5
  

  douglasrose75

  and

  nasbench

  authored
  a572fc5

  Copy full SHA for a572fc5

• Merge PR #4704 from @slincoln-aiq - Add RDP reg keys for darkgate malware

  Show description for 66f964f
  

  slincoln-detections-ai

  and

  nasbench

  authored
  66f964f

  Copy full SHA for 66f964f

• Merge PR #4715 from @Neo23x0 - Use Image field in filter

  Show description for eb914a8
  Neo23x0

  authored
  eb914a8

  Copy full SHA for eb914a8

• Merge PR #4710 from @xiangchen96 - Add ipconfig.io domain

  Show description for 6eb7ce7
  

  xiangchen96

  and

  nasbench

  authored
  6eb7ce7

  Copy full SHA for 6eb7ce7

• Merge PR #4711 from @xiangchen96 - Fix some FP in Rundll32 Execution With Uncommon DLL Extension

  Show description for 0376019
  

  xiangchen96

  and

  nasbench

  authored
  0376019

  Copy full SHA for 0376019

Commits on Feb 7, 2024

• Merge PR #4703 from @Neo23x0 - Add `EventLogCrasher` imphash

  Show description for 027ba7e
  Neo23x0

  authored
  027ba7e

  Copy full SHA for 027ba7e

Commits on Feb 6, 2024

• Merge PR #4713 from @X-Junior - Update `Potential Dead Drop Resolvers` rule

  Show description for 6eaba7e
  X-Junior

  authored
  6eaba7e

  Copy full SHA for 6eaba7e

Commits on Feb 1, 2024

• Merge PR #4701 from @nasbench - Archive new rule references and update cache file

  Show description for 889efd1
  github-actions[bot]

  authored
  889efd1

  Copy full SHA for 889efd1

• Merge PR #4700 from @nasbench - Promote older rules status from `experimental` to `test`

  Show description for 367ebd9
  github-actions[bot]

  authored
  367ebd9

  Copy full SHA for 367ebd9

Commits on Jan 30, 2024

• Merge PR #4697 from @frack113 - Fix errors in rule status and logsource

  Show description for ebaa1ab
  frack113

  authored
  ebaa1ab

  Copy full SHA for ebaa1ab

Commits on Jan 29, 2024

• Merge PR #4681 from @nasbench - Add Missing Ref & Tags

  Show description for be359ef
  

  nasbench

  and

  phantinuss

  authored
  be359ef

  Copy full SHA for be359ef

• Merge PR #4686 from @CrimpSec - Add new rule for SharpMove based on PE metadata and CLI options

  Show description for 7f582c3
  

  3 peopleauthored
  7f582c3

  Copy full SHA for 7f582c3

• Merge PR #4678 from @swachchhanda000 - Adds and updates Pikabot and rundll32 related rules

  Show description for 2fc5330
  

  3 peopleauthored
  2fc5330

  Copy full SHA for 2fc5330

• Merge PR #4685 from @t-pol - Add EDR-Silencer rule based on filter name indicator

  Show description for d7206ad
  

  3 peopleauthored
  d7206ad

  Copy full SHA for d7206ad

• Merge PR #4690 from @tr0mb1r - filter Websense named pipe

  Show description for 5b3ae27
  

  tr0mb1r

  and

  nasbench

  authored
  5b3ae27

  Copy full SHA for 5b3ae27

Commits on Jan 26, 2024

• Merge PR #4656 from @frack113 - Upgrade rule promotion script to use pySigma

  Show description for a158d89
  frack113

  authored
  a158d89

  Copy full SHA for a158d89

• Merge PR #4693 from @qasimqlf - Update selection to remove overlap

  Show description for 7a4eb6c
  qasimqlf

  authored
  7a4eb6c

  Copy full SHA for 7a4eb6c

Commits on Jan 24, 2024

• Merge PR #4691 from @qasimqlf - Fix typo in wmic process name

  Show description for 24f3228
  qasimqlf

  authored
  24f3228

  Copy full SHA for 24f3228

Commits on Jan 23, 2024

• Merge PR #4684 from @phantinuss - Multiple FP fixes & rule updates

  Show description for 399cca3
  

  phantinuss

  and

  nasbench

  authored
  399cca3

  Copy full SHA for 399cca3

• Merge PR #4687 from @qasimqlf - Increase coverage of rule by adding additional image names

  Show description for c1a67a3
  qasimqlf

  authored
  c1a67a3

  Copy full SHA for c1a67a3

• Merge PR #4689 from @slincoln-aiq - Update README.md to add AttackIQ to the projects and products section

  Show description for e2f0a3f
  slincoln-detections-ai

  authored
  e2f0a3f

  Copy full SHA for e2f0a3f

Commits on Jan 22, 2024

• Merge PR #4679 from @swachchhanda000 - Suspicious unsigned DLL Loaded by RunDLL32/RegSvr32

  Show description for 2ee4323
  

  swachchhanda000

  and

  nasbench

  authored
  2ee4323

  Copy full SHA for 2ee4323

• Merge PR #4682 from @jstnk9 - Add new rules related to MODE.COM usage in changing code pages

  Show description for 8cc9841
  

  3 peopleauthored
  8cc9841

  Copy full SHA for 8cc9841

Commits on Jan 19, 2024

• Merge PR #4680 from @xiangchen96 - new domains from `miningocean.org`

  Show description for efb61f9
  

  xiangchen96

  and

  nasbench

  authored
  efb61f9

  Copy full SHA for efb61f9

Commits on Jan 15, 2024

• Merge PR #4675 from @X-Junior - New Emerging Threat Rules For Peach Sandstorm APT

  Show description for 3fb5392
  

  3 peopleauthored
  3fb5392

  Copy full SHA for 3fb5392

• Merge PR #4672 from @tr0mb1r - move to TH and filter vmware tools

  Show description for feded2f
  

  tr0mb1r

  and

  nasbench

  authored
  feded2f

  Copy full SHA for feded2f

Pagination

Previous

Next