SigmaHQ-sigma

proc_creation_lnx_at_command.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_base64_decode.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_base64_execution.yml

new rules: lnx susp shell exec

2022-07-26 16:40:12 +02:00

proc_creation_lnx_base64_shebang_cli.yml

Update proc_creation_lnx_base64_shebang_cli.yml

2022-09-16 09:38:00 +02:00

proc_creation_lnx_bpftrace_unsafe_option_usage.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_cat_sudoers.yml

Fix after review

2022-09-16 11:47:19 +02:00

proc_creation_lnx_chattr_immutable_removal.yml

fix: Rename Linux process creation rule to use established pattern

2022-09-22 17:42:54 +01:00

proc_creation_lnx_clear_logs.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_clear_syslog.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_clipboard_collection.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_crontab_removal.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_crypto_mining.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_curl_usage.yml

Fix after review

2022-09-16 11:47:19 +02:00

proc_creation_lnx_cve_2022_26134_atlassian_confluence.yml

refactor: rule level adjustments - critical to high

2022-06-18 17:43:22 +02:00

proc_creation_lnx_cve_2022_33891_spark_shell_command_injection.yml

Update proc_creation_lnx_cve_2022_33891_spark_shell_command_injection.yml

2022-07-21 15:17:48 +01:00

proc_creation_lnx_dd_file_overwrite.yml

Update selections and indentation

2022-07-07 20:13:45 +01:00

proc_creation_lnx_doas_execution.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_file_and_directory_discovery.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

proc_creation_lnx_file_deletion.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_install_root_certificate.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

proc_creation_lnx_local_account.yml

Fix after review

2022-09-16 11:47:19 +02:00

proc_creation_lnx_local_groups.yml

Fix after review

2022-09-16 11:47:19 +02:00

proc_creation_lnx_network_service_scanning.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

proc_creation_lnx_nohup.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_omigod_scx_runasprovider_executescript.yml

Update Wildcard + Int to Str fields

2022-10-05 23:15:20 +02:00

proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml

Update Wildcard + Int to Str fields

2022-10-05 23:15:20 +02:00

proc_creation_lnx_process_discovery.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

proc_creation_lnx_proxy_connection.yml

Fix wildcard

2022-10-05 17:21:34 +02:00

proc_creation_lnx_python_pty_spawn.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_remote_system_discovery.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

proc_creation_lnx_schedule_task_job_cron.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

proc_creation_lnx_security_software_discovery.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_security_tools_disabling.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_services_stop_and_disable.yml

Update proc_creation_lnx_services_stop_and_disable.yml

2022-09-16 13:43:01 +02:00

proc_creation_lnx_setgid_setuid.yml

Fix wildcard

2022-10-05 17:21:34 +02:00

proc_creation_lnx_sudo_cve_2019_14287.yml

Update proc_creation_lnx_sudo_cve_2019_14287.yml

2022-10-06 00:18:18 +02:00

proc_creation_lnx_susp_chmod_directories.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

proc_creation_lnx_susp_curl_fileupload.yml

Fix after review

2022-09-16 11:47:19 +02:00

proc_creation_lnx_susp_curl_useragent.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_susp_history_delete.yml

Quick update

2022-09-16 09:29:45 +02:00

proc_creation_lnx_susp_history_recon.yml

Fix after review

2022-09-16 11:47:19 +02:00

proc_creation_lnx_susp_interactive_bash.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_susp_java_children.yml

Quick Update

2022-06-03 08:31:53 +01:00

proc_creation_lnx_susp_pipe_shell.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_susp_recon_indicators.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

proc_creation_lnx_system_info_discovery.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

proc_creation_lnx_system_network_connections_discovery.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

proc_creation_lnx_system_network_discovery.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_triple_cross_rootkit_execve_hijack.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_triple_cross_rootkit_install.yml

Linux rules update

2022-09-16 09:22:57 +02:00

proc_creation_lnx_webshell_detection.yml

Update proc_creation_lnx_webshell_detection.yml

2022-08-01 23:40:34 +01:00