 Azure Pipeline
|
a9ff298f6d
|
Updated after successful CICD run 09/20/2023 07:33:02 UTC
|
2023-09-20 07:33:03 +00:00 |
|
|
Olaf Hartong
|
5cd2c60668
|
severe base noise reduction
|
2023-09-20 07:31:32 +00:00 |
|
|
Olaf Hartong
|
db5a12a2a5
|
Update README.md for V15
|
2023-06-27 23:42:25 +01:00 |
|
|
Azure Pipeline
|
c8fc02e5d7
|
Updated after successful CICD run 06/27/2023 22:39:06 UTC
|
2023-06-27 22:39:07 +00:00 |
|
|
Olaf Hartong
|
c171ccbd36
|
Merge pull request #175 from olafhartong/version-15
Version 15 updates
|
2023-06-27 23:37:45 +01:00 |
|
|
Olaf Hartong
|
d78d50cd4c
|
relocate misplaced file
|
2023-06-22 16:49:34 +00:00 |
|
|
Olaf Hartong
|
15dcb04d4a
|
config improvements
|
2023-06-22 16:48:52 +00:00 |
|
|
Olaf Hartong
|
0b05ee9ce1
|
FileExeDetect added
|
2023-06-22 16:48:38 +00:00 |
|
|
Olaf Hartong
|
13168af9c9
|
added extra config
|
2023-06-21 16:26:49 +02:00 |
|
|
Olaf Hartong
|
ce858558ff
|
Merge pull request #143 from alwashali/Excluding-Desktop-Central
exclude_desktop_central
|
2023-06-21 16:23:54 +02:00 |
|
|
Azure Pipeline
|
928f3dd185
|
Updated after successful CICD run 06/21/2023 14:21:16 UTC
|
2023-06-21 14:21:17 +00:00 |
|
|
Olaf Hartong
|
91f1ee878d
|
fix typo
|
2023-06-21 14:18:52 +00:00 |
|
|
Azure Pipeline
|
36dfd22060
|
Updated after successful CICD run 06/21/2023 13:48:02 UTC
|
2023-06-21 13:48:04 +00:00 |
|
|
Azure Pipeline
|
3f0dce6634
|
Updated after successful CICD run 06/21/2023 13:43:46 UTC
|
2023-06-21 13:43:47 +00:00 |
|
|
Olaf Hartong
|
d7bc0e286c
|
update files
|
2023-06-21 13:42:21 +00:00 |
|
|
Olaf Hartong
|
9db8398102
|
file_delete improvements
|
2023-06-21 13:31:43 +00:00 |
|
|
Azure Pipeline
|
7c69adc5c3
|
Updated after successful CICD run 06/21/2023 13:04:13 UTC
|
2023-06-21 13:04:14 +00:00 |
|
|
Olaf Hartong
|
d174fe8ff9
|
added xcacls
|
2023-06-21 13:02:45 +00:00 |
|
|
Azure Pipeline
|
2e449b72f3
|
Updated after successful CICD run 06/21/2023 12:57:18 UTC
|
2023-06-21 12:57:19 +00:00 |
|
|
Olaf Hartong
|
e0ce6676bf
|
add adws
|
2023-06-21 12:56:02 +00:00 |
|
|
Olaf Hartong
|
fed8170449
|
updates and restructure
|
2023-06-21 14:46:56 +02:00 |
|
|
Azure Pipeline
|
166376922d
|
Updated after successful CICD run 06/21/2023 12:41:07 UTC
|
2023-06-21 12:41:08 +00:00 |
|
|
Olaf Hartong
|
cec824854b
|
Merge pull request #171 from cnnrshd/patch01
(Updated) Workflows, priority sorting for rules, rule improvements
|
2023-06-21 14:39:41 +02:00 |
|
|
Azure Pipeline
|
52875744f3
|
Updated after successful CICD run 06/21/2023 12:00:34 UTC
|
2023-06-21 12:00:35 +00:00 |
|
|
Olaf Hartong
|
dfb0982f82
|
Merge pull request #164 from thefunch/error_handling_xmlfile
Display file name when XML load fails
|
2023-06-21 13:46:38 +02:00 |
|
|
Azure Pipeline
|
862697f74b
|
Updated after successful CICD run 06/21/2023 11:39:26 UTC
|
2023-06-21 11:39:27 +00:00 |
|
|
Olaf Hartong
|
b76dfcf555
|
Merge pull request #174 from zbalkan/master
Add WMI-based Sysmon file archive quota generation
|
2023-06-21 13:37:43 +02:00 |
|
|
Olaf Hartong
|
5aee922d95
|
Merge pull request #165 from benmontour/fixDetectedTypo
Fixing a Typo in the Event ID 26 Folder Name
|
2023-06-21 13:36:33 +02:00 |
|
|
Olaf Hartong
|
d439f1760c
|
Merge pull request #169 from jaybirnuw/master
Create 23 exclusion for Sophos Endpoint journalling temporary files
|
2023-06-21 13:35:32 +02:00 |
|
|
Zafer Balkan
|
0a128b7aeb
|
Update interesting_files.xml
|
2023-06-04 14:35:13 +03:00 |
|
|
Connor Shade
|
768cd83d8b
|
fix 1_lol and update xml
|
2023-04-13 14:32:10 -04:00 |
|
|
Connor Shade
|
48b810c034
|
Fix technique ids
|
2023-04-13 14:22:25 -04:00 |
|
|
Connor Shade
|
f4600eb71a
|
include all wmi and remake config
|
2023-04-13 13:53:50 -04:00 |
|
|
Connor Shade
|
d5af3c2f3a
|
several changes to reg events, improve signals
|
2023-04-13 13:50:23 -04:00 |
|
|
Connor Shade
|
d5f83e8b2d
|
exclude powershell loading dotnet
|
2023-04-13 13:44:17 -04:00 |
|
|
Connor Shade
|
23fed68cb5
|
add common callback port filters
|
2023-04-13 12:49:18 -04:00 |
|
|
Connor Shade
|
e593dca3c2
|
merge and organize 3_lol
|
2023-04-13 12:47:01 -04:00 |
|
|
Connor Shade
|
83311344bc
|
Add rpcping detection to 1_lol
|
2023-04-13 12:46:47 -04:00 |
|
|
Connor Shade
|
5ecab710e0
|
11 taskmanager lsass works now
|
2023-04-13 11:50:47 -04:00 |
|
|
Connor Shade
|
bfa7ad51e2
|
merge script now forces top level grouprelation=or
|
2023-04-13 11:45:02 -04:00 |
|
|
Connor Shade
|
d643a3a225
|
add rules to 11_file_create
|
2023-04-13 10:35:05 -04:00 |
|
|
Connor Shade
|
a12b0f1821
|
improve 1_lol atbroker
|
2023-04-13 10:34:39 -04:00 |
|
|
Connor Shade
|
7614d0e87c
|
add exclude for chrome software reporter
|
2023-04-13 09:22:23 -04:00 |
|
|
Connor Shade
|
1c97028b19
|
add filters to 2 - exe, vsc, remove nvidia
|
2023-04-13 07:42:02 -04:00 |
|
|
Connor Shade
|
cb72ba2fb0
|
add 1_include_all rule
|
2023-04-13 07:39:06 -04:00 |
|
|
Connor Shade
|
ddc829d993
|
extract shells to separate section for prio
|
2023-04-13 07:07:48 -04:00 |
|
|
Connor Shade
|
14806a6aa9
|
sorted and organized 1_lol
|
2023-04-13 07:06:24 -04:00 |
|
|
Connor Shade
|
04b23880fa
|
Add sample data for merge script
|
2023-04-13 06:03:12 -04:00 |
|
|
Connor Shade
|
4790ccfa6f
|
add template, update merge python script
|
2023-04-13 06:02:51 -04:00 |
|
|
cws4197
|
16b1ca42cf
|
Create merge_sysmon_configs.py
Script allows for assigning priority to different rules to change their layering in the config.
Script is currently untested.
|
2023-04-06 10:23:59 -04:00 |
|