admin/ditekshen-detection
1
0
Fork 0
mirror of https://github.com/ditekshen/detection synced 2026-06-08 13:49:35 +00:00
Code Issues Packages Projects Releases Wiki Activity
214 Commits 1 Branch 0 Tags
master
Commit Graph

214 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
ditekshen e76c93dcde Add new rule 2024-11-01 09:29:35 +03:00
ditekshen cd99e732c8 Update indicator_rmm 2024-10-04 09:44:02 +03:00
ditekshen ee5945d7a8 Add new rules 2024-10-04 08:07:30 +03:00
ditekshen 6bba6f5266 Add and update rules in rmm and tools indicators 2024-09-25 18:35:57 +03:00
ditekshen 085f534be2 Add new rules 2024-09-23 15:42:55 +03:00
ditekshen 56f976ff24 Add new rules 2024-09-21 09:03:05 +03:00
ditekshen 5784a57044 Dedup and update rule 2024-09-06 16:45:07 +03:00
ditekshen ea89528820 Disable performance hog indicator_office rules fixing #29, add new rules 2024-09-06 16:36:32 +03:00
diˈtekSHən 6419013759 Fix #30 2024-07-19 09:16:13 +03:00
diˈtekSHən 2ddbbe14ee FP: Disable INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL 2024-06-08 11:46:45 +03:00
diˈtekSHən 7c2d40d839 Relax houdini match condition 2024-05-28 16:28:05 +03:00
diˈtekSHən 3e5b6d03c7 Add Houdini 2024-05-28 16:18:59 +03:00
diˈtekSHən 7a20810fb6 Update malware.yar 2024-05-28 15:15:48 +03:00
diˈtekSHən f57369c1c6 Add ScoutElite and Landroid from back-in-2017 2024-05-28 10:14:00 +03:00
diˈtekSHən 9876b5a1a1 Update malware.yar 
Remove zgrat.
 2024-05-27 14:45:37 +03:00
ditekshen c37b067259 Fix FNs for INDICATOR_RTF_EXPLOIT_CVE_2017_11882_1 2024-02-22 18:04:22 +03:00
ditekshen a896a95adc Add and update rules 2024-02-22 15:26:54 +03:00
ditekshen 5fc671f9f4 Add rules 2024-01-23 15:15:43 +03:00
ditekshen e6a95b7968 Fix false detection 2023-12-30 21:11:45 +03:00
ditekshen 59bcc4cdd6 Fix error in INDICATOR_OLE_ObjectPool_Embedded_Files 2023-12-29 12:07:16 +03:00
ditekshen a9ef14211d Add and update rules 2023-12-29 12:03:54 +03:00
ditekshen 045ba6f813 Add detection against simda/shifu 2023-12-27 09:54:01 +03:00
ditekshen e3f2c56070 Update rules 2023-12-26 11:50:19 +03:00
ditekshen a0de2f7cca Fix FPs 2023-12-19 14:43:20 +03:00
ditekshen e5d86022d9 Fixes 2023-12-19 14:39:35 +03:00
ditekshen 7ffd5b0512 Add and updates rules in malware and office 2023-12-19 13:29:22 +03:00
ditekshen 859b6c7a67 Add and update rules 2023-12-17 12:22:18 +03:00
ditekshen febe5f51f1 Update .yara-ci 2023-12-08 12:23:20 +03:00
ditekshen 87cdb8e5e3 Fix #23 and add rules to indicator_knownbad_certs 2023-12-08 12:08:09 +03:00
ditekshen 369627fad5 Fix errors 2023-11-30 10:40:32 +03:00
ditekshen d838fb41c7 Add signatures 2023-11-30 10:38:17 +03:00
diˈtekSHən e83e7ff38f Merge pull request #21 from iam-py-test/patch-1 
Minor changes
 2023-11-18 18:38:29 +03:00
iam-py-test d53924bbc1 Minor changes 
- Fix minor spelling/grammar errors
- Add new ad blockers
 2023-11-18 10:23:18 -05:00
ditekshen 91ebea452d Add signatures 2023-11-16 14:31:52 +03:00
ditekshen 8a781cd417 Fix #19 2023-10-26 09:28:42 +03:00
ditekshen 0519f0af59 Add and update rules. Fix #17 2023-10-13 13:08:32 +03:00
ditekshen e657959077 Add indicator_suspicious detection for service interfaces 2023-09-11 10:03:24 +03:00
ditekshen c47b8d0405 Small updates 2023-09-05 18:28:11 +03:00
ditekshen d150d8dcf0 Add Snort detection against CVE-2023-36844 2023-08-29 13:58:39 +03:00
ditekshen 033a1d897b Add multiple detections 2023-08-29 13:07:08 +03:00
ditekshen 1ea379e46d Add new detection for malware and rmm 2023-08-25 12:20:08 +03:00
ditekshen 80623ed98a Disable INDICATOR_RMM_MeshCentral_CERT 2023-08-23 14:43:54 +03:00
ditekshen 7442eeef89 Fixes and updates to RMM yara, calmav and invenotry 2023-08-23 14:33:56 +03:00
ditekshen 61a0009bbb Disable FP until fixed 2023-08-22 16:54:01 +03:00
ditekshen 9062a7ff71 Add new INDICATOR_RMM category and RMM inventory, add new detection in malware and indicator_tools 2023-08-22 16:36:58 +03:00
ditekshen c12acd0081 Add detection against Rhysida,JanelaRAT,PovertyStealer,TelegramRAT/ToxicEye,QwixxRAT 2023-08-15 15:59:33 +03:00
ditekshen 33a1aba357 Add Yara detection against LOLKEK,Spacecolon and ClamAV and Snort detecction against LummaStealer 2023-08-13 19:07:48 +03:00
ditekshen acbc315234 Update Fiber of other variants 2023-08-11 12:51:24 +03:00
ditekshen c5edde1e74 Remove FP and addd Fiber injector 2023-08-10 16:13:43 +03:00
ditekshen 342c77c241 Add associated ClamAV signatures 2023-08-10 15:15:36 +03:00