security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,362 Commits 1 Branch 57 Tags
07cf7ae5fa300bcbf7b4a61cd92f366c04d8a939
Commit Graph

10392 Commits

Author SHA1 Message Date
Florian Roth 07cf7ae5fa fix: FP with Code Integrity Attempted DLL Load 2022-10-28 16:28:49 +02:00
frack113 1f8e37351e order yaml 2022-10-28 15:06:36 +02:00
phantinuss f004d27efe fix: FP from testing environment 2022-10-28 11:39:53 +02:00
Gude5 a3e6856764 new rules: Sigma rules based on Elastic rules (#3632) 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-10-28 10:13:44 +02:00
phantinuss f7319989e4 fix: new FP with Avast 2022-10-28 08:47:09 +02:00
frack113 625f05df3c Merge pull request #3646 from nasbench/nasbench-rule-devel 
Rule Dev
 2022-10-28 06:34:48 +02:00
Nasreddine Bencherchali 8e3d1fa653 Update web_win_webshells_in_access_logs.yml 2022-10-27 14:13:12 +02:00
Nasreddine Bencherchali aeefa4c022 Merge branch 'master' into fix-false-positives 2022-10-27 11:49:52 +02:00
Nasreddine Bencherchali ca9183c1fe Update process_access_win_shellcode_inject_msf_empire.yml 2022-10-27 11:39:58 +02:00
Nasreddine Bencherchali 308ab94f88 Update process_access_win_shellcode_inject_msf_empire.yml 2022-10-27 11:39:32 +02:00
phantinuss 07faf2b50a fix: add missing \ 2022-10-27 10:22:49 +02:00
phantinuss 152f22ba01 fix: FPs in testing environment 2022-10-27 09:46:05 +02:00
Nasreddine Bencherchali 2aff1acccd Fix typo in selection 2022-10-27 00:12:58 +02:00
Nasreddine Bencherchali 4be6af3c08 Add/Update PAExec Rules 2022-10-26 23:27:17 +02:00
Nasreddine Bencherchali c2045d6a91 Update web_win_webshells_in_access_logs.yml 2022-10-26 23:18:08 +02:00
Nasreddine Bencherchali efe0cf5871 Add/Update Exchange/Mailbox Rules 2022-10-26 23:17:54 +02:00
Nasreddine Bencherchali 6f4250e434 Rename Service Install Rules 2022-10-26 23:17:02 +02:00
Nasreddine Bencherchali 388624e279 Update PsExec Rules 2022-10-26 23:15:01 +02:00
Nasreddine Bencherchali d88ae70256 Rename Rule 
Renamed the rule to follow the folder convention
 2022-10-26 18:25:12 +02:00
Nasreddine Bencherchali aa75e084e8 Fix Issue #3593 2022-10-26 18:22:26 +02:00
Nasreddine Bencherchali 8db7382bc9 Update win_codeintegrity_attempted_dll_load.yml 2022-10-26 11:15:18 +02:00
phantinuss e74592644f Merge pull request #3645 from phantinuss/master 
fix: missing beginning of SourceImage path
 2022-10-26 11:03:07 +02:00
Nasreddine Bencherchali bb84e503fa Merge branch 'master' into nasbench-rule-devel 2022-10-26 10:39:55 +02:00
Nasreddine Bencherchali c495a61692 Update proc_creation_win_susp_office_token_search.yml 2022-10-26 10:37:23 +02:00
phantinuss c24cd642fd fix: missing beginning of SourceImage path 2022-10-26 10:10:02 +02:00
frack113 1e5ae09c4b Order yaml field 2022-10-26 09:43:39 +02:00
frack113 a3eed2b760 Order yaml field 2022-10-26 09:42:26 +02:00
frack113 940f89d43d Order yaml field 2022-10-26 06:16:55 +02:00
frack113 fac6732827 Order yaml field 2022-10-26 06:16:30 +02:00
Nasreddine Bencherchali cd863c75b9 Update image_load_side_load_antivirus.yml 2022-10-25 23:52:15 +02:00
Nasreddine Bencherchali 9adbbf36c1 Rename Rule 2022-10-25 23:48:54 +02:00
Nasreddine Bencherchali 37af110aa2 Update proc_creation_win_susp_office_token_search.yml 2022-10-25 23:48:08 +02:00
Nasreddine Bencherchali 130e1af009 Change rule service 2022-10-25 20:03:11 +02:00
Nasreddine Bencherchali 9fdc08f17b Add first sshd Rule 2022-10-25 19:15:31 +02:00
frack113 d2ca4694b2 Merge pull request #3638 from frack113/issues_3634 
Add logsource definition
 2022-10-25 18:20:15 +02:00
phantinuss 176f3ab1b9 fix: FP in testing environment 2022-10-25 16:21:14 +02:00
phantinuss 80744563f8 Merge pull request #3637 from nasbench/fix-false-positives 
Fix FP in Testing
 2022-10-25 16:14:39 +02:00
Nasreddine Bencherchali 29661b98af Apply suggestions from code review 
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
 2022-10-25 15:17:50 +02:00
frack113 5bd0b33a3b Add logsource definition 2022-10-25 14:16:08 +02:00
phantinuss 353e735caa add FP filter for MS Office 2022-10-25 14:15:08 +02:00
Nasreddine Bencherchali c4a89b3b44 Update proc_creation_win_susp_squirrel_lolbin.yml 2022-10-25 13:41:49 +02:00
Nasreddine Bencherchali ef5f672a64 Update image_load_side_load_dbghelp_dll.yml 2022-10-25 12:48:52 +02:00
Nasreddine Bencherchali e14dedb3e3 Update image_load_side_load_dbghelp_dll.yml 2022-10-25 12:33:49 +02:00
Nasreddine Bencherchali 205cb7bc2e Update image_load_side_load_dbgcore_dll.yml 2022-10-25 12:30:35 +02:00
Nasreddine Bencherchali d85f085348 Update Code Integrity rule 2022-10-25 12:29:41 +02:00
Nasreddine Bencherchali 214ba4b2e2 Merge branch 'SigmaHQ:master' into nasbench-rule-devel 2022-10-25 12:27:43 +02:00
Nasreddine Bencherchali b42826bcdb Create win_codeintegrity_failed_driver_load.yml 2022-10-25 12:27:11 +02:00
Nasreddine Bencherchali 062acaad6b Add more DLLs for Sideloading 2022-10-25 12:22:29 +02:00
phantinuss c555b33314 fix: FP with new Aurora 2022-10-25 12:20:13 +02:00
frack113 dfdaecc52c Order yaml field 2022-10-25 12:00:56 +02:00