Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature/create detection framework#28 #66

Merged
merged 187 commits into from
Nov 2, 2021
Merged

Feature/create detection framework#28 #66

merged 187 commits into from
Nov 2, 2021

Conversation

hitenkoku
Copy link
Collaborator

以下の検知ルールを追加

  • DeepBlueCLI
  • SIGMA

結果取得後配置

@hitenkoku
create framework
b0077ea 
separate util function #28
@hitenkoku
create SIGMA Rule Read Framework #28
3f93ad5
@hitenkoku
create framework add ntlm logon sigma rule test
008dff3 
Fixes #28
@hitenkoku
fix rule stack #28
5eed43c
@hitenkoku
add detection call fix other script call #28
729d8cc
@hitenkoku
erase duplicate proceess
1d5a23a
@hitenkoku
fix add-rule template & erase debug print #28
9ac5fb2
@hitenkoku
add SIGMA Powershell Code(not adjust WELA)
2cffec8
@hitenkoku
add SIGMA rule adjust WELA Framwork #28
aa256da
@hitenkoku
add SIGMA rule translated WELA Framework #28
72038fe
@hitenkoku
add SIGMA rule translated WELA Framework #28
1bd39f0
@hitenkoku
moved categorize folder
eda7e96
@hitenkoku
adjust multi rule
d301d08
@hitenkoku
fix detected message
996ae22
@hitenkoku
checked powershell category rules #28
df5e31c
@hitenkoku
fix error
d2d8298
@hitenkoku
moved dir checked process creation category #28
3927b2c
@hitenkoku
checked rules and adjust multi rules #28
132860f
@hitenkoku
moved SIGMA rule to category directory #28
815b71c
@hitenkoku
fixed lacked rule copy #28
af0dc08
@hitenkoku
fixed lacked rule copy #28
327163e
@hitenkoku
fixed lacked rule copy #28
34be071
@hitenkoku
fixed head comment out
7859b2c
@hitenkoku
fixed head comment out
7c5d0e4
@hitenkoku
fixed lacked if case
d788714
@hitenkoku
fixed lacked rule copy #28
88b2082
@hitenkoku
fixed lacked rule copy #28
6078aab
@hitenkoku
replace sigmac powershell convert result
f5bd4a0
@hitenkoku
fixed lacked rule copy #28
8b0a9e9
@hitenkoku
fixed lackedrule copy #28
38860e9
@hitenkoku
Merge branch 'main' into hitenkoku/issue28
4333804
@hitenkoku
merge main into feature/create-detection-framework
de884ea
@hitenkoku
fixed error output condition case of logfile specified and not livean…
e85f559 
…alysys is false
@hitenkoku
fixed detection process due sorted difference from DeepBlueCLI
0dd58e9
@hitenkoku
fixed lacked argument call check-command
c45c911
@hitenkoku
adapt formatter
6dbc9cf
@hitenkoku
add DeepBlueCLI passspray detection logic
291164a
@hitenkoku
fixed passwordguess detection logic #28
45eda72
@hitenkoku
merge main into feature/create-detection-framework
5c7238b
@hitenkoku
moved show-contributors to utils.ps1
1d91f67
@hitenkoku
default servicecd value set
c4bf6aa
@hitenkoku
fixed lacked initialize
d682f30
@hitenkoku
fixed null result output
70a502c
@hitenkoku
fixed typo fixed
b14dc85
@hitenkoku
AV to read SIGMA mimikatz Rule
042439e
@hitenkoku
Merge branch 'main' into feature/create-detection-framework#28
bac71eb
@hitenkoku
add IDs
9b7d73e
@hitenkoku
fixed mimikatz detecion check script blocked by AMSI
577f37d
@hitenkoku
fixed result is null exection case
9111f3d
@hitenkoku hitenkoku added enhancement New feature or request priority:high labels Oct 21, 2021
@hitenkoku hitenkoku self-assigned this Oct 21, 2021
@hitenkoku
Copy link
Collaborator Author

DeepBlueCLIの結果が取得できたので投入をします。
SIGMAについては並行して投入をするため一旦この段階でマージを行う

DBC.zip

@hitenkoku hitenkoku merged commit a4baf1a into main Nov 2, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@hitenkoku hitenkoku

Labels
enhancement New feature or request priority:high
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@hitenkoku