 Nasreddine Bencherchali
|
21ee673940
|
Fix Issues & Updates (#3705)
* Fix Issues and Updates
* Update add_or_set_windows_defender_exclusion.yml
* Update windows_curl_download_to_suspicious_path.yml
* Fix more issues and bugs
* Update deprecation_mapping.YML
* Update windows_application_whitelisting_bypass_attempt_via_rundll32.yml
* More updates and fixes
* update `Windows Change Default File Association For No File Ext`
* A couple more updates for ya
* rename
* add / update rules
* Update windows_symlink_evaluation_change_via_fsutil.yml
* Update windows_symlink_evaluation_change_via_fsutil.yml
* Update linux_service_started_or_enabled.yml
* Update linux_service_started_or_enabled.yml
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
|
2025-10-13 09:18:21 -07:00 |
|
|
Bhavin Patel
|
17a4e1eb63
|
updating IDs
|
2025-09-24 11:20:12 -07:00 |
|
|
Bhavin Patel
|
c31013241b
|
updatings with snort detection and lookup also contentctl
|
2025-08-21 09:43:02 -07:00 |
|
|
Bhavin Patel
|
03f37bc312
|
udpated verison
|
2025-07-31 12:01:38 -05:00 |
|
|
Teoderick Contreras
|
905a1041d2
|
interlock_ransomware
|
2025-07-29 12:31:56 +02:00 |
|
|
Teoderick Contreras
|
6c857aac76
|
interlock_ransomware
|
2025-07-28 11:13:15 +02:00 |
|
|
Teoderick Contreras
|
627e4a263f
|
quasar_and_loader
|
2025-07-17 16:09:40 +02:00 |
|
|
Teoderick Contreras
|
98a7e95306
|
quasar_and_loader
|
2025-07-16 10:23:20 +02:00 |
|
|
Nasreddine Bencherchali
|
e3bfb2da07
|
the final countdown
|
2025-07-06 02:57:39 +02:00 |
|
|
Nasreddine Bencherchali
|
544645b87b
|
Update suspicious_ports_list.csv
|
2025-07-01 23:07:46 +02:00 |
|
|
Nasreddine Bencherchali
|
75ec47e99a
|
add new detections, story and other cool things
|
2025-07-01 23:04:48 +02:00 |
|
|
Nasreddine Bencherchali
|
f49bd318d9
|
update time 🚀
|
2025-06-30 13:55:55 +02:00 |
|
|
Nasreddine Bencherchali
|
67c72b9035
|
add Cisco Secure Firewall - Remote Access Software Usage Traffic
|
2025-05-28 19:33:18 +02:00 |
|
|
Nasreddine Bencherchali
|
78b11fa6a0
|
Update threat_snort_count.yml
|
2025-05-15 11:32:13 +02:00 |
|
|
Nasreddine Bencherchali
|
559f472227
|
Rename threat_actor_snort_count.yml to threat_snort_count.yml
|
2025-05-15 11:31:59 +02:00 |
|
|
Nasreddine Bencherchali
|
42da135696
|
Rename threat_actor_snort_count.csv to threat_snort_count.csv
|
2025-05-15 11:31:40 +02:00 |
|
|
Nasreddine Bencherchali
|
8330f6bdf1
|
Apply suggestions from code review
|
2025-05-15 11:31:17 +02:00 |
|
|
Bhavin Patel
|
e95c2d480d
|
updating code to use udpated names of lookup files
|
2025-05-14 13:50:22 -07:00 |
|
|
Bhavin Patel
|
823652f4e2
|
lookup update
|
2025-05-13 17:41:13 -07:00 |
|
|
Bhavin Patel
|
8f445c574a
|
updating lookup content and query
|
2025-05-13 13:57:44 -07:00 |
|
|
Bhavin Patel
|
c1eef4cf0f
|
updating csv
|
2025-05-13 12:59:17 -07:00 |
|
|
Bhavin Patel
|
0b0e5114ab
|
adding two lookups and updating query for test
|
2025-05-13 12:44:30 -07:00 |
|
|
Bhavin Patel
|
29a64f2b56
|
change count to 4 based on dataset
|
2025-05-12 16:15:45 -07:00 |
|
|
Bhavin Patel
|
933ff68b40
|
Merge branch 'develop' into snort_by_threat_actor
|
2025-05-12 15:36:31 -07:00 |
|
|
Bhavin Patel
|
df33c55c9a
|
adding detection and lookup
|
2025-05-12 15:21:55 -07:00 |
|
|
Nasreddine Bencherchali
|
629bc01aae
|
update output and nirsoft tools
|
2025-04-24 18:23:55 +02:00 |
|
|
Bhavin Patel
|
614721e681
|
Merge branch 'develop' into remove_v5.4.0
|
2025-04-18 10:26:39 -07:00 |
|
|
Michael Haag
|
8ca79f3f56
|
Merge branch 'develop' into cactus
|
2025-04-18 09:33:17 -06:00 |
|
|
Bhavin Patel
|
0bdaf9647e
|
Merge branch 'develop' into remove_v5.4.0
|
2025-04-17 13:27:58 -07:00 |
|
|
Bhavin Patel
|
96f7490cde
|
Merge branch 'develop' into remove_v5.4.0
|
2025-04-17 09:15:53 -07:00 |
|
|
Nasreddine Bencherchali
|
d57b1686fd
|
Merge branch 'develop' into csftd_second_batch
|
2025-04-17 18:06:46 +02:00 |
|
|
Bhavin Patel
|
0c57994c22
|
remove static lookup file
|
2025-04-16 16:00:49 -07:00 |
|
|
Bhavin Patel
|
e1dc36ad07
|
revert wrong commit
|
2025-04-16 16:00:23 -07:00 |
|
|
Bhavin Patel
|
b154c14045
|
remove static loookup
|
2025-04-16 15:52:45 -07:00 |
|
|
Nasreddine Bencherchali
|
953c8d59da
|
Merge branch 'develop' into csftd_first_batch
|
2025-04-09 16:34:47 +02:00 |
|
|
Nasreddine Bencherchali
|
e9caa0de7c
|
cisco secure firewall detections - second batch
|
2025-04-09 12:33:51 +02:00 |
|
|
sventec
|
889c08ebbf
|
chore: update lookup date and version
|
2025-04-04 11:32:45 -04:00 |
|
|
sventec
|
5f1d8f6b3f
|
fix: addtl remote_utility typo in remote_access_software.csv
|
2025-04-04 11:32:32 -04:00 |
|
|
sventec
|
66889be8a6
|
fix: remote_utility typo in remote_access_software.csv
|
2025-04-04 11:20:21 -04:00 |
|
|
Nasreddine Bencherchali
|
53e3105db8
|
Merge branch 'develop' into csftd_first_batch
|
2025-04-03 20:59:14 +02:00 |
|
|
Nasreddine Bencherchali
|
0f084c4fb7
|
update lookup name
|
2025-04-03 14:24:53 +02:00 |
|
|
Nasreddine Bencherchali
|
f39a6d9a50
|
cisco secure firewall detections - first batch
|
2025-04-03 14:21:27 +02:00 |
|
|
Bhavin Patel
|
0d831661a6
|
updating detections with conflicts
|
2025-04-02 11:41:46 -07:00 |
|
|
Bhavin Patel
|
f8d1d71db9
|
Merge branch 'develop' into medusa_ransomware
|
2025-04-02 11:22:19 -07:00 |
|
|
Michael Haag
|
7666d3793f
|
Merge branch 'develop' into cactus
|
2025-04-01 14:56:49 -06:00 |
|
|
Teoderick Contreras
|
b31f246793
|
medusa_ransomware
|
2025-04-01 12:54:03 +02:00 |
|
|
Michael Haag
|
ada8585d6f
|
Merge branch 'develop' into rceattack
|
2025-03-31 12:05:21 -06:00 |
|
|
Bhavin Patel
|
db0455a024
|
Merge branch 'develop' into win_sus_service_fix
|
2025-03-28 12:36:36 -07:00 |
|
|
Bhavin Patel
|
7e1cc06c3c
|
Merge branch 'develop' into win_sus_service_fix
|
2025-03-28 09:50:36 -07:00 |
|
|
Bhavin Patel
|
14bf638d06
|
Merge branch 'develop' into vanhelsing
|
2025-03-28 09:48:19 -07:00 |
|