mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2024-12-27 23:37:58 +01:00
Tweaked the Link regex to allow anchor tags and the handle regex to permit blank entries.
This commit is contained in:
parent
ee68df7f26
commit
dfb30f194f
@ -74,19 +74,19 @@ mapping:
|
||||
type: str
|
||||
"Sigma":
|
||||
type: str
|
||||
pattern: '^http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+$'
|
||||
pattern: '^http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+#]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+$'
|
||||
"Analysis":
|
||||
type: str
|
||||
pattern: '^http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+$'
|
||||
pattern: '^http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+#]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+$'
|
||||
"Elastic":
|
||||
type: str
|
||||
pattern: '^http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+$'
|
||||
pattern: '^http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+#]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+$'
|
||||
"Splunk":
|
||||
type: str
|
||||
pattern: '^http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+$'
|
||||
pattern: '^http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+#]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+$'
|
||||
"BlockRule":
|
||||
type: str
|
||||
pattern: '^http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+$'
|
||||
pattern: '^http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+#]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+$'
|
||||
"Resources":
|
||||
type: seq
|
||||
required: false
|
||||
@ -95,7 +95,7 @@ mapping:
|
||||
mapping:
|
||||
"Link":
|
||||
type: str
|
||||
pattern: '^http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+$'
|
||||
pattern: '^http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+#]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+$'
|
||||
"Acknowledgement":
|
||||
type: seq
|
||||
required: false
|
||||
@ -106,4 +106,4 @@ mapping:
|
||||
type: str
|
||||
"Handle":
|
||||
type: str
|
||||
pattern: '^@(\w){1,15}$'
|
||||
pattern: '^(@(\w){1,15})?$'
|
||||
|
@ -46,7 +46,7 @@ Detection:
|
||||
- IOC: bitsadmin creates new files
|
||||
- IOC: bitsadmin adds data to alternate data stream
|
||||
Resources:
|
||||
- Link: https://www.slideshare.net/chrisgates/windows-attacks-at-is-the-new-black-26672679 - slide 53
|
||||
- Link: https://www.slideshare.net/chrisgates/windows-attacks-at-is-the-new-black-26672679
|
||||
- Link: https://www.youtube.com/watch?v=_8xJaaQlpBo
|
||||
- Link: https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
|
||||
Acknowledgement:
|
||||
|
@ -66,4 +66,4 @@ Acknowledgement:
|
||||
- Person: egre55
|
||||
Handle: '@egre55'
|
||||
- Person: Mike Cary
|
||||
Handle: 'grayfold3d'
|
||||
Handle: '@grayfold3d'
|
||||
|
@ -37,4 +37,4 @@ Acknowledgement:
|
||||
- Person: BennyHusted
|
||||
Handle: ''
|
||||
- Person: Amit Serper
|
||||
Handle: '@0xAmit '
|
||||
Handle: '@0xAmit'
|
||||
|
Loading…
Reference in New Issue
Block a user