security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Change double quote to quote

Browse Source
This commit is contained in:
frack113
2022-01-06 14:02:35 +01:00
parent c5b38290b8
commit 73f258e2d1
69 changed files with 474 additions and 466 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/powershell/powershell_script/powershell_malicious_commandlets.yml
+95 -95
View File
@@ -18,101 +18,101 @@ logsource:
detection:
select_Malicious:
ScriptBlockText|contains:
- "Invoke-DllInjection"
- "Invoke-Shellcode"
- "Invoke-WmiCommand"
- "Get-GPPPassword"
- "Get-Keystrokes"
- "Get-TimedScreenshot"
- "Get-VaultCredential"
- "Invoke-CredentialInjection"
- "Invoke-Mimikatz"
- "Invoke-NinjaCopy"
- "Invoke-TokenManipulation"
- "Out-Minidump"
- "VolumeShadowCopyTools"
- "Invoke-ReflectivePEInjection"
- "Invoke-UserHunter"
- "Find-GPOLocation"
- "Invoke-ACLScanner"
- "Invoke-DowngradeAccount"
- "Get-ServiceUnquoted"
- "Get-ServiceFilePermission"
- "Get-ServicePermission"
- "Invoke-ServiceAbuse"
- "Install-ServiceBinary"
- "Get-RegAutoLogon"
- "Get-VulnAutoRun"
- "Get-VulnSchTask"
- "Get-UnattendedInstallFile"
- "Get-ApplicationHost"
- "Get-RegAlwaysInstallElevated"
- "Get-Unconstrained"
- "Add-RegBackdoor"
- "Add-ScrnSaveBackdoor"
- "Gupt-Backdoor"
- "Invoke-ADSBackdoor"
- "Enabled-DuplicateToken"
- "Invoke-PsUaCme"
- "Remove-Update"
- "Check-VM"
- "Get-LSASecret"
- "Get-PassHashes"
- "Show-TargetScreen"
- "Port-Scan"
- "Invoke-PoshRatHttp"
- "Invoke-PowerShellTCP"
- "Invoke-PowerShellWMI"
- "Add-Exfiltration"
- "Add-Persistence"
- "Do-Exfiltration"
- "Start-CaptureServer"
- "Get-ChromeDump"
- "Get-ClipboardContents"
- "Get-FoxDump"
- "Get-IndexedItem"
- "Get-Screenshot"
- "Invoke-Inveigh"
- "Invoke-NetRipper"
- "Invoke-EgressCheck"
- "Invoke-PostExfil"
- "Invoke-PSInject"
- "Invoke-RunAs"
- "MailRaider"
- "New-HoneyHash"
- "Set-MacAttribute"
- "Invoke-DCSync"
- "Invoke-PowerDump"
- "Exploit-Jboss"
- "Invoke-ThunderStruck"
- "Invoke-VoiceTroll"
- "Set-Wallpaper"
- "Invoke-InveighRelay"
- "Invoke-PsExec"
- "Invoke-SSHCommand"
- "Get-SecurityPackages"
- "Install-SSP"
- "Invoke-BackdoorLNK"
- "PowerBreach"
- "Get-SiteListPassword"
- "Get-System"
- "Invoke-BypassUAC"
- "Invoke-Tater"
- "Invoke-WScriptBypassUAC"
- "PowerUp"
- "PowerView"
- "Get-RickAstley"
- "Find-Fruit"
- "HTTP-Login"
- "Find-TrustedDocuments"
- "Invoke-Paranoia"
- "Invoke-WinEnum"
- "Invoke-ARPScan"
- "Invoke-PortScan"
- "Invoke-ReverseDNSLookup"
- "Invoke-SMBScanner"
- "Invoke-Mimikittenz"
- "Invoke-AllChecks"
- 'Invoke-DllInjection'
- 'Invoke-Shellcode'
- 'Invoke-WmiCommand'
- 'Get-GPPPassword'
- 'Get-Keystrokes'
- 'Get-TimedScreenshot'
- 'Get-VaultCredential'
- 'Invoke-CredentialInjection'
- 'Invoke-Mimikatz'
- 'Invoke-NinjaCopy'
- 'Invoke-TokenManipulation'
- 'Out-Minidump'
- 'VolumeShadowCopyTools'
- 'Invoke-ReflectivePEInjection'
- 'Invoke-UserHunter'
- 'Find-GPOLocation'
- 'Invoke-ACLScanner'
- 'Invoke-DowngradeAccount'
- 'Get-ServiceUnquoted'
- 'Get-ServiceFilePermission'
- 'Get-ServicePermission'
- 'Invoke-ServiceAbuse'
- 'Install-ServiceBinary'
- 'Get-RegAutoLogon'
- 'Get-VulnAutoRun'
- 'Get-VulnSchTask'
- 'Get-UnattendedInstallFile'
- 'Get-ApplicationHost'
- 'Get-RegAlwaysInstallElevated'
- 'Get-Unconstrained'
- 'Add-RegBackdoor'
- 'Add-ScrnSaveBackdoor'
- 'Gupt-Backdoor'
- 'Invoke-ADSBackdoor'
- 'Enabled-DuplicateToken'
- 'Invoke-PsUaCme'
- 'Remove-Update'
- 'Check-VM'
- 'Get-LSASecret'
- 'Get-PassHashes'
- 'Show-TargetScreen'
- 'Port-Scan'
- 'Invoke-PoshRatHttp'
- 'Invoke-PowerShellTCP'
- 'Invoke-PowerShellWMI'
- 'Add-Exfiltration'
- 'Add-Persistence'
- 'Do-Exfiltration'
- 'Start-CaptureServer'
- 'Get-ChromeDump'
- 'Get-ClipboardContents'
- 'Get-FoxDump'
- 'Get-IndexedItem'
- 'Get-Screenshot'
- 'Invoke-Inveigh'
- 'Invoke-NetRipper'
- 'Invoke-EgressCheck'
- 'Invoke-PostExfil'
- 'Invoke-PSInject'
- 'Invoke-RunAs'
- 'MailRaider'
- 'New-HoneyHash'
- 'Set-MacAttribute'
- 'Invoke-DCSync'
- 'Invoke-PowerDump'
- 'Exploit-Jboss'
- 'Invoke-ThunderStruck'
- 'Invoke-VoiceTroll'
- 'Set-Wallpaper'
- 'Invoke-InveighRelay'
- 'Invoke-PsExec'
- 'Invoke-SSHCommand'
- 'Get-SecurityPackages'
- 'Install-SSP'
- 'Invoke-BackdoorLNK'
- 'PowerBreach'
- 'Get-SiteListPassword'
- 'Get-System'
- 'Invoke-BypassUAC'
- 'Invoke-Tater'
- 'Invoke-WScriptBypassUAC'
- 'PowerUp'
- 'PowerView'
- 'Get-RickAstley'
- 'Find-Fruit'
- 'HTTP-Login'
- 'Find-TrustedDocuments'
- 'Invoke-Paranoia'
- 'Invoke-WinEnum'
- 'Invoke-ARPScan'
- 'Invoke-PortScan'
- 'Invoke-ReverseDNSLookup'
- 'Invoke-SMBScanner'
- 'Invoke-Mimikittenz'
- 'Invoke-AllChecks'
false_positives:
ScriptBlockText|contains:
- Get-SystemDriveInfo # http://bheltborg.dk/Windows/WinSxS/amd64_microsoft-windows-maintenancediagnostic_31bf3856ad364e35_10.0.10240.16384_none_91ef7543a4514b5e/CL_Utility.ps1