Achievements
Achievements
Highlights
- 1 discussion answered
Pinned
2,702 contributions in the last year
Less
More
Contribution activity
March 2022
Created a pull request in SigmaHQ/sigma that received 2 comments
Opened 27 other pull requests in 2 repositories
SigmaHQ/sigma
26
merged
- Aurora false positive fixing
- PowerShell IEX rules
- PowerShell Downloads
- fix: FP, refactor: scheduled task rule
- rule: new reg add tampering rules; some fixes
- Log source cleanup
- fix: Service Installation 7045 field confusion
- Aurora false positive fixing
- Update registry_event_powershell_in_run_keys.yml
- fix: FPs noticed with EdgeTransport sub processes
- Webshell detection rule refactoring
- rule: remote thread creation, rule: get-addbaccount
- fix: sadly still too many fps with this rule
- CrackMapExec patterns, minor addition to ncat rule, rar rule adjusted
- Aurora false positive fixing
- Linux process pattern rules
- LSASS access rule split up
- refactor: lsass dump files names, new: NTDS.dit exfiltration activity
- docs: changed UltraVNC flags rule < Gamaredon
- fix: unused filter
- fix: adjusted rules that use utf16le, extended others
- Imphash rule adjustments
- fix: missing escaped backslashes, rule: ntdll redirect
- Multiple adjustments in different rules
- refactor: PowerShell Defender modifications
- Some pull requests not shown.
telekom-security/malware_analysis
1
open
Reviewed 3 pull requests in 1 repository
SigmaHQ/sigma
3 pull requests
Created an issue in SigmaHQ/sigma that received 1 comment
Splunk Backend Prefix
@frack113 : I think you've added this line recently. Shouldn't this have a WinEventLog: prefix like the others?
sigma/tools/config/splunk-window…
1
comment
Started 1 discussion in 1 repository
SigmaHQ/sigma
SigmaHQ/sigma
1
contribution
in private repositories
Mar 28