Commits

Branch selector

 master

User selector

All users

Datepicker

All time

Commit History

Commits on Jan 25, 2019

• Update README.md

  ion-storm

  authored
  08ddc0c

  Copy full SHA for 08ddc0c

Commits on Dec 14, 2018

• more optimizations

  ion-storm

  committed
  18b3b45

  Copy full SHA for 18b3b45

• optimizations, stay on 8.00

  ion-storm

  committed
  af22386

  Copy full SHA for af22386

• readme update regarding Sysmon 8.02 breaking changes. This config needs 8.00

  ion-storm

  committed
  0e4d97b

  Copy full SHA for 0e4d97b

• Merge branch 'develop'

  Show description for 0f2e916
  ion-storm

  committed
  0f2e916

  Copy full SHA for 0f2e916

• merge in a few changes and cleanup

  ion-storm

  committed
  0cde79d

  Copy full SHA for 0cde79d

Commits on Aug 31, 2018

• add additional locations for file creation

  ion-storm

  committed
  984e2f5

  Copy full SHA for 984e2f5

• add some mitre references

  ion-storm

  committed
  5108626

  Copy full SHA for 5108626

Commits on Aug 24, 2018

• updates

  ion-storm

  committed
  00fc760

  Copy full SHA for 00fc760

Commits on Aug 21, 2018

• remove incorrect url not reflecting github changes

  ion-storm

  committed
  ba0d6d0

  Copy full SHA for ba0d6d0

• Big update/alerting/cleanup etc

  ion-storm

  committed
  d2f9872

  Copy full SHA for d2f9872

Commits on Aug 15, 2018

• Push updates from @olafhartong for pipe events

  ion-storm

  committed
  75d53da

  Copy full SHA for 75d53da

Commits on Aug 13, 2018

• remove space

  ion-storm

  committed
  0b33e07

  Copy full SHA for 0b33e07

• update installers

  ion-storm

  committed
  c40e20d

  Copy full SHA for c40e20d

Commits on Jul 18, 2018

• Enable Alerting on more autoruns, and add MitreRef=T1209,Technique=Time Provider Keys,Tactic=Persistence

  ion-storm

  committed
  b788031

  Copy full SHA for b788031

• add "MitreRef=T1099,Technique=Timestomp,Tactic=Defense Evasion,Alert=Timestomp/File creation time retroactively changed!"

  ion-storm

  committed
  9c263c7

  Copy full SHA for 9c263c7

• add detection for Cobalt Strike's payload using netsh.exe helper DLLs

  ion-storm

  committed
  a677e63

  Copy full SHA for a677e63

• add MitreRef=T1050,Technique=New Service,Tactic=Persistence/Privilege Escalation,Alert=Service added via Command Line

  ion-storm

  committed
  f1922b4

  Copy full SHA for f1922b4

Commits on Jul 17, 2018

• Detect Remote Desktop Shadow connection

  ion-storm

  committed
  093e84a

  Copy full SHA for 093e84a

Commits on Jul 16, 2018

• ignore chrome noise

  ion-storm

  committed
  1a9a4ba

  Copy full SHA for 1a9a4ba

• revert, ref: https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list

  ion-storm

  committed
  fe5d06e

  Copy full SHA for fe5d06e

• Update alerts

  ion-storm

  committed
  1c3a63d

  Copy full SHA for 1c3a63d

• ignore chrome noise

  ion-storm

  committed
  bac76c1

  Copy full SHA for bac76c1

Commits on Jul 15, 2018

• revert, ref: https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list

  ion-storm

  committed
  0809966

  Copy full SHA for 0809966

• Update alerts

  ion-storm

  committed
  335bf09

  Copy full SHA for 335bf09

Commits on Jul 14, 2018

• Removed Custom Exclusions for Labtech & Solarwinds N-Central for master branch, you may want to exclude this commit if you use these products.

  ion-storm

  committed
  df62533

  Copy full SHA for df62533

• Merge branch 'develop'

  ion-storm

  committed
  bcc71aa

  Copy full SHA for bcc71aa

• Update comments, remove excess comments

  ion-storm

  committed
  0eb2d75

  Copy full SHA for 0eb2d75

• add unknown process detection & updates notes/comments

  ion-storm

  committed
  535b3b4

  Copy full SHA for 535b3b4

Commits on Jul 13, 2018

• exclude domain login scripts

  ion-storm

  committed
  3311184

  Copy full SHA for 3311184

• exclusions and tweaks.

  ion-storm

  committed
  45571e5

  Copy full SHA for 45571e5

• ransomware detection false positive removal

  ion-storm

  committed
  c08faac

  Copy full SHA for c08faac

• Windows firewall modifications

  ion-storm

  committed
  64593be

  Copy full SHA for 64593be

• end with at.exe needs end with \at.exe to not flag apps like acrobat

  ion-storm

  committed
  cf08083

  Copy full SHA for cf08083

• more updates

  ion-storm

  committed
  eb1d876

  Copy full SHA for eb1d876

Pagination

Previous

Next