Many errors when install#170

Open

MrAndrii wants to merge 484 commits intoSwiftOnSecurity:masterfrom

ion-storm:master

This pull request is big! We're only showing the most recent 250 commits

Commits on Mar 19, 2018

Commits on Apr 11, 2018

Commits on Apr 14, 2018

Updates from @olafhartong's config's (great work btw)
ion-storm
committed

Commits on Apr 16, 2018

change wmi monitoring to exclude
ion-storm
committed

Commits on Apr 26, 2018

complements of @subTree for noticing this mistake, reverting noise reduction commit.
ion-storm
committed

Commits on Jun 27, 2018

added samsam ransomware file names
ion-storm
committed

Commits on Jul 1, 2018

add nable exceptions
ion-storm
committed

Commits on Jul 3, 2018

add exclusions
ion-storm
committed

Commits on Jul 4, 2018

Update sysmon auto-installer for 64bit svc change
ion-storm
committed

Commits on Jul 6, 2018

New Baseline
ion-storm
committed

Commits on Jul 7, 2018

Big update, more todo, stay tuned
ion-storm
committed

Commits on Jul 10, 2018

Commits on Jul 11, 2018

Commits on Jul 12, 2018

Commits on Jul 15, 2018

Commits on Jul 17, 2018

Detect Remote Desktop Shadow connection
ion-storm
committed

Commits on Aug 13, 2018

Commits on Aug 15, 2018

Push updates from @olafhartong for pipe events
ion-storm
committed

Commits on Aug 21, 2018

Commits on Aug 24, 2018

updates
ion-storm
committed

Commits on Aug 31, 2018

Commits on Jan 25, 2019

Update README.md
ion-storm
authored

Commits on Sep 1, 2022

Merge in Sysmon ATT&CK Changes
ionstorm
committed
Add Description, Forensic, CVE & False Positive Tag Descriptions
ionstorm
committed
Update Readme
ionstorm
committed
Update Sysmon installer.
ionstorm
committed
fixed old updater, will convert to powershell in future updates.
ionstorm
committed

Commits on Sep 6, 2022

Add some missing Tactics, a few new detections.
ionstorm
committed

Commits on Sep 7, 2022

Misc Updates
ionstorm
committed

Commits on Sep 8, 2022

Improved COM Object Hijack Detection
ionstorm
committed
add a few new detections
ionstorm
committed

Commits on Sep 9, 2022

Commits on Sep 13, 2022

Add new detections, merge in some of Florian's work, added Author tag for attribution additions.
ionstorm
committed
remove testing rule
ionstorm
committed

Commits on Sep 14, 2022

Push noise reduction and additional detection rules.
ionstorm
committed
Add more Forensic monitoring rules, add rpc execution named pipes and misc fixes/tagging.
ionstorm
committed
removing services from named pipe exclusion list as this can spawn pipes that execute via rpc.
ionstorm
committed
Improve PoisonTap rule to detect rndis drivers loaded via Details.
ionstorm
committed
remove services whitelist
ionstorm
committed

Commits on Sep 15, 2022

Add UsageLog/ETW Log tampering rules
ionstorm
committed

Commits on Sep 18, 2022

Updated Level 0 background events
cyberkryption
committed

Commits on Sep 23, 2022

Commits on Sep 25, 2022

Commits on Sep 26, 2022

Commits on Sep 27, 2022

Add some qbot/qakbot detections with experimental logoncli.dll monitoring
ionstorm
committed

Commits on Sep 29, 2022

Commits on Sep 30, 2022

Commits on Oct 3, 2022

Commits on Oct 4, 2022

Re-enable explorer.exe parentimage logging
ionstorm
committed
Implement FileBlockShredding Protection for C:\Users, event log directory, Program Files, Program Data directories. Protect Pagefile, MFT and system config directory
ionstorm
committed
MITRE Tagging and SIEM Alerting of Data Destruction/File Shred protected locations.
ionstorm
committed
Tag File Shred Protection with File: File Modification datasource, as shredding is a modification.
ionstorm
committed
Fix alert text for $mft file
ionstorm
committed
Protect common Office extensions, pdf's, archive files and more.
ionstorm
committed
Protect shredding of common Disk images from Virtual infrastructure, veeam, acronis, datto, hyper-v, vmware and more.
ionstorm
committed
Sort and remove dupes
ionstorm
committed
ensure other rules fire before logging user activity launched from explorer.
ionstorm
committed
update readme
ionstorm
committed
update readme
ionstorm
committed
update readme
ionstorm
committed
update readme..
ionstorm
committed
Misc Detection additions and improvements
ionstorm
committed
Add some File Shred Exclusions
ionstorm
committed
Whitelist C:\Windows for now for file shred protection, just to prevent any weirdness.
ionstorm
committed
More white listing to be safe, in testing this appears to not cause any issues.
ionstorm
committed
Comment Out Program Files/ProgramData Directories as I am unsure how this will run with enterprise software like exchange and other servers.
ionstorm
committed
Target specific folders for powershell file block, as this will block copying of exe files as well
ionstorm
committed

Commits on Oct 5, 2022

Commits on Oct 6, 2022

Commits on Oct 7, 2022

MITRE Tagging of hardware additions
ionstorm
committed
AV Exclusions for performance, noise reduction
ionstorm
committed
MITRE Tagging and a few new detections
ionstorm
committed
Move Double Extensions under masquerading
ionstorm
committed
add additional office apps
ionstorm
committed
Some new detections to track spearphishing attachments and more
ionstorm
committed
additional mounted devices detection besides mounted devices keys to ensure logging of iso/img malware
ionstorm
committed
Add alerting in Amcache for virtual DVD-ROM Mount after iso mount for additional telemetry for iso/img malware.
ionstorm
committed
Add Bitlocker Status Monitoring for System drive with alerting enabled.
ionstorm
committed
Add Bitlocker Status Monitoring for System drive with alerting enabled.
ionstorm
committed
Push Vulnerable Driver detections from Nasreddine Bencherchali
ionstorm
committed
Add Risk Rating to vuln driver loads
ionstorm
committed

Commits on Oct 21, 2022

Removing Blocking from Config due to reports of interference of windows updates.
ionstorm
committed

Commits on Jun 27, 2023

Updates from @NerbalOne
ionstorm
committed
Sysmon v15 update schema + 1 test rule for C:\users\*\Downloads
ionstorm
committed
Added Potential Noisy Rule, exclusions need to be added under global as its an or rule.
ionstorm
committed
Unusual File extension written as PE, enabled alerting
ionstorm
committed

Commits on Jul 5, 2023

Commits on Jul 6, 2023

misc Updates
ionstorm
committed

Commits on Jul 10, 2023

Fix some inactive/broken rules and filtering
ionstorm
committed
Re-enable Browser Extension monitoring for Chrome, added MITRE Tagging
ionstorm
committed

Commits on Sep 6, 2023

Commits on Sep 8, 2023

Commits on Sep 11, 2023

Updated rules and added exclusions.
NerbalOne
committed

Commits on Sep 12, 2023

Merge pull request #26 from NerbalOne/master
NerbalOne
committed