SigmaHQ-sigma

lnx_auditd_alter_bash_profile.yml

Updated modified date

2022-02-22 12:48:41 -03:00

lnx_auditd_audio_capture.yml

chore: test rules: reactivate single value list check

2022-05-10 17:13:04 +02:00

lnx_auditd_auditing_config_change.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_binary_padding.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_bpfdoor_file_accessed.yml

Update lnx_auditd_bpfdoor_file_accessed.yml

2022-08-12 21:39:11 +02:00

lnx_auditd_bpfdoor_port_redirect.yml

Fix a lot of typos in rules text and comments #Part 3 (#3446 )

2022-08-30 08:21:25 +02:00

lnx_auditd_capabilities_discovery.yml

Fix a lot of typos in rules text and comments #Part 3 (#3446 )

2022-08-30 08:21:25 +02:00

lnx_auditd_change_file_time_attr.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_chattr_immutable_removal.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_clipboard_collection.yml

refactor condition

2022-06-03 15:35:24 +02:00

lnx_auditd_clipboard_image_collection.yml

refactor condition

2022-06-03 15:35:24 +02:00

lnx_auditd_coinminer.yml

refactor: change all " of them" expressions

2022-01-11 10:59:57 +01:00

lnx_auditd_create_account.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

lnx_auditd_cve_2021_3156_sudo_buffer_overflow_brutforce.yml

refactor: rule level adjustments - critical to high

2022-06-18 17:43:22 +02:00

lnx_auditd_cve_2021_3156_sudo_buffer_overflow.yml

refactor: rule level adjustments - critical to high

2022-06-18 17:43:22 +02:00

lnx_auditd_cve_2021_4034.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

lnx_auditd_data_compressed.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_data_exfil_wget.yml

refactor condition

2022-06-03 15:35:24 +02:00

lnx_auditd_dd_delete_file.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_disable_system_firewall.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_file_or_folder_permissions.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_find_cred_in_files.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_hidden_files_directories.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_hidden_zip_files_steganography.yml

fix: none --> Unknown

2022-03-16 14:19:21 +01:00

lnx_auditd_keylogging_with_pam_d.yml

Fix a lot of typos in rules text and comments #Part 3 (#3446 )

2022-08-30 08:21:25 +02:00

lnx_auditd_ld_so_preload_mod.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_load_module_insmod.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_logging_config_change.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

lnx_auditd_masquerading_crond.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_network_service_scanning.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_network_sniffing.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_omigod_scx_runasprovider_executeshellcommand.yml

fix modified

2021-11-11 10:26:08 +01:00

lnx_auditd_password_policy_discovery.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_pers_systemd_reload.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_screencapture_import.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_screencaputre_xwd.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_split_file_into_pieces.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_steghide_embed_steganography.yml

refactor condition

2022-06-03 15:35:24 +02:00

lnx_auditd_steghide_extract_steganography.yml

refactor condition

2022-06-03 15:35:24 +02:00

lnx_auditd_susp_c2_commands.yml

chore: test rules: reactivate single value list check

2022-05-10 17:13:04 +02:00

lnx_auditd_susp_cmds.yml

refactor: change all " of them" expressions

2022-01-11 10:59:57 +01:00

lnx_auditd_susp_exe_folders.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

lnx_auditd_susp_histfile_operations.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_system_info_discovery2.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_system_info_discovery.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_system_shutdown_reboot.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_systemd_service_creation.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_unzip_hidden_zip_files_steganography.yml

chore: test rules: reactivate single value list check

2022-05-10 17:13:04 +02:00

lnx_auditd_user_discovery.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

lnx_auditd_web_rce.yml

Fix auditd field name

2021-11-11 10:13:48 +01:00