New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[OSCD] Linux - Install Root Certificate #1044

Merged

yugoslavskiy merged 19 commits into SigmaHQ:oscd from omergunal:patch-1

Jan 5, 2021

Contributor

omergunal commented Oct 5, 2020

omkar72 and others added 9 commits

September 27, 2020 19:12


          Merge pull request #1 from Neo23x0/master

15c8721

Updating my fork


          COM hijack of shell folder to execute arbitrary application & UAC byp…

3f148e6

…ass using sdclt.


          Update sysmon_comhijack_uac_bypass.yml

ebe3dce


          Updated fields & renamed

e7c8197


          updated name

68a992d


          added event type & changed technique

4487d9c


          Merge pull request SigmaHQ#1024 from omkar72/master

c56cd2d

Com hijack shell folder


          Install Root Certificate

1e7a474


          update description

0e7eb32

yugoslavskiy changed the base branch from master to oscd

October 6, 2020 02:28

Contributor

yugoslavskiy commented Oct 6, 2020

Hello, Ömer!

Thanks for the active start of the sprint!
Could you please check the tests and fix the issues they show?


          rename filename

Contributor Author

omergunal commented Oct 6, 2020

Hello, Ömer!

Thanks for the active start of the sprint!
Could you please check the tests and fix the issues they show?

I edited filename

yugoslavskiy self-assigned this

yugoslavskiy reviewed

View reviewed changes

rules/linux/lnx_install_root_certificate.yml Outdated Show resolved Hide resolved

yugoslavskiy reviewed

View reviewed changes

rules/linux/lnx_install_root_certificate.yml Outdated Show resolved Hide resolved

yugoslavskiy reviewed

View reviewed changes

rules/linux/lnx_install_root_certificate.yml Outdated Show resolved Hide resolved

yugoslavskiy reviewed

View reviewed changes

rules/linux/lnx_install_root_certificate.yml Outdated Show resolved Hide resolved


          Update lnx_install_root_certificate.yml

7b29e3a

Contributor Author

omergunal commented Oct 7, 2020

edited

yugoslavskiy reviewed

View reviewed changes

rules/linux/lnx_install_root_certificate.yml Outdated Show resolved Hide resolved

yugoslavskiy reviewed

View reviewed changes

rules/linux/lnx_install_root_certificate.yml Outdated Show resolved Hide resolved

This was referenced Oct 8, 2020

[OSCD] T1069.001: Local Groups #1056

Closed

[OSCD] T1057: Process Discovery #1057

Merged


          Update lnx_install_root_certificate.yml

373c637

yugoslavskiy reviewed

View reviewed changes

rules/linux/lnx_install_root_certificate.yml Outdated Show resolved Hide resolved

Contributor

yugoslavskiy commented Oct 25, 2020

Hello @omergunal! Could you please finalize the rule? Thanks!


          Update lnx_install_root_certificate.yml

89a24d4

yugoslavskiy reviewed

View reviewed changes

rules/linux/lnx_install_root_certificate.yml Outdated Show resolved Hide resolved

yugoslavskiy reviewed

View reviewed changes

rules/linux/lnx_install_root_certificate.yml Outdated Show resolved Hide resolved

yugoslavskiy reviewed

View reviewed changes

rules/linux/lnx_install_root_certificate.yml Outdated Show resolved Hide resolved

yugoslavskiy reviewed

View reviewed changes

rules/linux/lnx_install_root_certificate.yml Outdated Show resolved Hide resolved

omergunal added 2 commits

November 8, 2020 11:06


          Update lnx_install_root_certificate.yml

499a8f8


          Update lnx_install_root_certificate.yml

0e4a5ba

yugoslavskiy reviewed

View reviewed changes

rules/linux/lnx_install_root_certificate.yml Outdated Show resolved Hide resolved

yugoslavskiy reviewed

View reviewed changes

rules/linux/lnx_install_root_certificate.yml Outdated Show resolved Hide resolved

omergunal added 2 commits

November 10, 2020 20:09


          Update lnx_install_root_certificate.yml

f41acca


          Update lnx_install_root_certificate.yml

ab95939

yugoslavskiy reviewed

View reviewed changes

rules/linux/lnx_install_root_certificate.yml Outdated Show resolved Hide resolved

yugoslavskiy reviewed

View reviewed changes

rules/linux/lnx_install_root_certificate.yml Show resolved Hide resolved


          Update lnx_install_root_certificate.yml

821bdf8

yugoslavskiy approved these changes

View reviewed changes

Contributor

yugoslavskiy left a comment

@thomaspatzke @Neo23x0 guys, I believe that this PR could be merged (:
please let us know what do you think about it if there is anything you would like to change.


          Removed ES query tests

a62d066

yugoslavskiy merged commit 57947fb into SigmaHQ:oscd

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment