vxcontrol/xp-rules
1
0
Fork 0
mirror of https://github.com/vxcontrol/xp-rules.git synced 2026-07-25 16:55:37 -04:00
Code Issues Packages Projects Releases Wiki Activity

[PR #3] [CLOSED] OSW#2: Task-15 #3

New Issue
Closed
opened 2026-06-06 22:11:39 -04:00 by yindo · 0 comments
yindo commented 2026-06-06 22:11:39 -04:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/vxcontrol/xp-rules/pull/3
Author: @sn1permanky
Created: 7/9/2024
Status: ❌ Closed

Base: master ← Head: feature/OSW-2-Task-15

📝 Commits (10+)

  • 7980eeb в репозитории остался только SIEM формат и добавлены примеры фильтров
  • 5ce5ac8 1. Добавил правило Schtasks_Commandline и его зависимости.
  • 81d662e sync rule filters from parent repo
  • 0f1b3cf Merge branch 'master' of github.com:Security-Experts-Community/open-xp-rules
  • 98c915c Добавлены примеры правил для выявления запуска Mimikatz и эксплуатирования ProxyNotShell.
  • b4c6d34 Правило Schtasks_Commandline переведено на использование макросов.
  • e4b8c73 fix
  • 5f5d5ef names pipe impersonation rule
  • 3c498b8 Merge pull request #1 from Vasilisa-L/feature/demo
  • 7e71ac9 Correlation name fix

📊 Changes

8821 files changed (+185031 additions, -22304 deletions)

View changed files

➕ .devcontainer/devcontainer.json (+27 -0)
➕ .github/ISSUE_TEMPLATE/config.yml (+5 -0)
➕ .github/ISSUE_TEMPLATE/form_for_duplicates.yml (+50 -0)
➕ .github/ISSUE_TEMPLATE/form_for_improvements.yml (+50 -0)
➕ .github/ISSUE_TEMPLATE/form_for_request_for_content.yml (+50 -0)
➕ .gitignore (+1 -0)
➕ NOTICE (+1 -0)
➕ README.md (+3 -0)
➕ common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/formula.xp (+109 -0)
➕ common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/i18n/i18n_en.yaml (+6 -0)
➕ common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/i18n/i18n_ru.yaml (+6 -0)
➕ common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/metainfo.yaml (+38 -0)
➕ common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/norm_1.js (+24 -0)
➕ common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/norm_2.js (+21 -0)
➕ common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/norm_3.js (+26 -0)
➕ common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/norm_4.js (+23 -0)
➕ common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/norm_5.js (+22 -0)
➕ common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/raw_1.txt (+1 -0)
➕ common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/raw_2.txt (+1 -0)
➕ common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/raw_3.txt (+1 -0)

...and 80 more files

📄 Description

Добавляю правило корреляции, к сожалению, без пройденного интеграционного теста.

Ошибка при интеграции на 8 строке, которая не меняется от содержимого строк

OSW#2: Task-15

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/vxcontrol/xp-rules/pull/3 **Author:** [@sn1permanky](https://github.com/sn1permanky) **Created:** 7/9/2024 **Status:** ❌ Closed **Base:** `master` ← **Head:** `feature/OSW-2-Task-15` --- ### 📝 Commits (10+) - [`7980eeb`](https://github.com/vxcontrol/xp-rules/commit/7980eebd725ce767095888ff22fa70647ce0c296) в репозитории остался только SIEM формат и добавлены примеры фильтров - [`5ce5ac8`](https://github.com/vxcontrol/xp-rules/commit/5ce5ac85e33bdd50143df69dc35dd2aa9b2304f7) 1. Добавил правило Schtasks_Commandline и его зависимости. - [`81d662e`](https://github.com/vxcontrol/xp-rules/commit/81d662e021004461694f326159abba47f644cebb) sync rule filters from parent repo - [`0f1b3cf`](https://github.com/vxcontrol/xp-rules/commit/0f1b3cfd3a05084f4ac843c754eababa89178c90) Merge branch 'master' of github.com:Security-Experts-Community/open-xp-rules - [`98c915c`](https://github.com/vxcontrol/xp-rules/commit/98c915c161d4f69233a38835bb3f2bf37317bbe1) Добавлены примеры правил для выявления запуска Mimikatz и эксплуатирования ProxyNotShell. - [`b4c6d34`](https://github.com/vxcontrol/xp-rules/commit/b4c6d3492140e72c2b2ab3d75cdb94c40887fa74) Правило Schtasks_Commandline переведено на использование макросов. - [`e4b8c73`](https://github.com/vxcontrol/xp-rules/commit/e4b8c732fd8da8d8cf5c91db7743c45adafe5d42) fix - [`5f5d5ef`](https://github.com/vxcontrol/xp-rules/commit/5f5d5efcb213134eac5a43bb09d882ca1afa8fe0) names pipe impersonation rule - [`3c498b8`](https://github.com/vxcontrol/xp-rules/commit/3c498b828ad1a178e48ebd78230333d587cae3d5) Merge pull request #1 from Vasilisa-L/feature/demo - [`7e71ac9`](https://github.com/vxcontrol/xp-rules/commit/7e71ac98f33f0b95e575c2bc925dc402f8301124) Correlation name fix ### 📊 Changes **8821 files changed** (+185031 additions, -22304 deletions) <details> <summary>View changed files</summary> ➕ `.devcontainer/devcontainer.json` (+27 -0) ➕ `.github/ISSUE_TEMPLATE/config.yml` (+5 -0) ➕ `.github/ISSUE_TEMPLATE/form_for_duplicates.yml` (+50 -0) ➕ `.github/ISSUE_TEMPLATE/form_for_improvements.yml` (+50 -0) ➕ `.github/ISSUE_TEMPLATE/form_for_request_for_content.yml` (+50 -0) ➕ `.gitignore` (+1 -0) ➕ `NOTICE` (+1 -0) ➕ `README.md` (+3 -0) ➕ `common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/formula.xp` (+109 -0) ➕ `common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/i18n/i18n_en.yaml` (+6 -0) ➕ `common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/i18n/i18n_ru.yaml` (+6 -0) ➕ `common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/metainfo.yaml` (+38 -0) ➕ `common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/norm_1.js` (+24 -0) ➕ `common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/norm_2.js` (+21 -0) ➕ `common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/norm_3.js` (+26 -0) ➕ `common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/norm_4.js` (+23 -0) ➕ `common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/norm_5.js` (+22 -0) ➕ `common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/raw_1.txt` (+1 -0) ➕ `common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/raw_2.txt` (+1 -0) ➕ `common/rules_filters/Contexts/JetBrains/TeamCity/syslog/Activities_User_Token_Management/tests/raw_3.txt` (+1 -0) _...and 80 more files_ </details> ### 📄 Description Добавляю правило корреляции, к сожалению, без пройденного интеграционного теста. Ошибка при интеграции на 8 строке, которая не меняется от содержимого строк OSW#2: Task-15 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-06-06 22:11:39 -04:00
yindo closed this issue 2026-06-06 22:11:39 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: vxcontrol/xp-rules#3
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?