security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,709 Commits 1 Branch 57 Tags
1fbd2bba4dcddfa0223a1d34dea893be6d3f9913
Commit Graph

3652 Commits

Author SHA1 Message Date
Florian Roth 358e8a567e Merge pull request #3474 from SigmaHQ/aurora-false-positive-fixing 
fix: schtasks in suspicious parents rule
 2022-09-08 09:09:26 +02:00
Florian Roth de68bf5559 fix: schtasks in suspicious parents rule 2022-09-08 09:00:58 +02:00
frack113 6813043323 Merge pull request #3468 from nasbench/nasbench-rule-devel 
Rule Devel
 2022-09-08 06:29:36 +02:00
frack113 6fea0e2c79 Merge pull request #3471 from qasimqlf/patch-5 
Update proc_creation_win_bad_opsec_sacrificial_processes.yml
 2022-09-08 06:28:25 +02:00
Nasreddine Bencherchali b70ac17676 Fix 2022-09-07 21:58:22 +02:00
Florian Roth 43b56fed23 Merge pull request #3472 from SigmaHQ/rule-devel 
rules: SysmonEnte, SharpEvtMute, sdelete rework
 2022-09-07 21:06:03 +02:00
Florian Roth a69d256367 rule: SharpEvtMute 2022-09-07 16:33:52 +02:00
Florian Roth 2ac92283e6 indentation and new hashes 2022-09-07 16:05:48 +02:00
Nasreddine Bencherchali 88e9794a74 Update proc_creation_win_system_exe_anomaly.yml 2022-09-07 14:15:10 +02:00
Qasim Qlf bdccc5440a Update proc_creation_win_bad_opsec_sacrificial_processes.yml 2022-09-07 15:28:06 +05:00
Nasreddine Bencherchali dc90e08f3e More updates 2022-09-07 12:02:09 +02:00
Nasreddine Bencherchali 62f5b327fa Update proc_creation_win_inline_win_api_access.yml 2022-09-06 23:04:48 +02:00
Nasreddine Bencherchali f952c02a5f Update after review 2022-09-06 22:59:24 +02:00
Nasreddine Bencherchali 4f69b7058f Update proc_creation_win_inline_win_api_access.yml 2022-09-06 16:57:55 +02:00
Nasreddine Bencherchali 7abe4a7c50 Update proc_creation_win_nslookup_poweshell_download.yml 2022-09-06 16:42:53 +02:00
Florian Roth 5de8a1b2f6 Merge pull request #3464 from YamatoSecurity/rule--nslookup-pwsh-download-cradle 
rule add: nslookup pwsh download cradle
 2022-09-06 11:21:15 +02:00
Florian Roth 4cdd5a5fec Update proc_creation_win_nslookup_pwsh_download_cradle.yml 2022-09-06 10:53:10 +02:00
Florian Roth 1fff6c3bb6 Merge branch 'master' into rule-devel 2022-09-06 09:40:07 +02:00
Florian Roth c81f87c333 refactor: renamed sdelete and increased level 2022-09-06 09:39:45 +02:00
Nasreddine Bencherchali b70e42b206 Create proc_creation_win_inline_win_api_access.yml 2022-09-06 09:14:03 +02:00
Nasreddine Bencherchali e7c53dafa1 New rules 2022-09-06 08:05:02 +02:00
Yamato Security 9abdc5ab38 update 2022-09-06 09:12:40 +09:00
Yamato Security b90b4ad3a6 update 2022-09-06 09:03:43 +09:00
Yamato Security a5f5992dcb update 2022-09-06 08:59:20 +09:00
Yamato Security 7c0c8996c6 update 2022-09-06 08:56:39 +09:00
Yamato Security ad6e085124 rule add: nslookup pwsh download cradle 2022-09-06 08:49:45 +09:00
Florian Roth ab6e9551d9 Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing 2022-09-05 23:01:43 +02:00
Florian Roth f188b9abfd fix: FPs with crypto miner cmdlines 2022-09-05 23:01:42 +02:00
Florian Roth cab6ccc18a Merge branch 'master' into aurora-false-positive-fixing 2022-09-05 16:57:10 +02:00
David André 8a595cd3fd Merge branch 'SigmaHQ:master' into add_quotes_to_strings 2022-09-04 10:10:14 +02:00
frack113 92f694a013 Merge pull request #3461 from danielgottt/patch-8 
Create proc_creation_win_ldifde_file_load.yml
 2022-09-04 08:17:43 +02:00
Gott 38d6a52e4d Update proc_creation_win_ldifde_file_load.yml 
Implemented suggestions
 2022-09-03 10:02:51 -04:00
Florian Roth 1af75b397d fix: VSCode file permissions changes 2022-09-03 09:48:36 +02:00
frack113 8162792c11 Merge pull request #3458 from frack113/frp 
Add proc_creation_win_frp
 2022-09-03 08:18:28 +02:00
Gott 7530008f26 Create proc_creation_win_ldifde_file_load.yml 2022-09-02 19:18:52 -04:00
Nasreddine Bencherchali 1adbd8f0b3 Fix after review 2022-09-02 17:44:53 +02:00
frack113 99e3b5d440 Update proc_creation_win_frp.yml 2022-09-02 17:43:19 +02:00
Florian Roth 19d8cdbaed Update proc_creation_win_susp_powershell_download_iex.yml 2022-09-02 17:36:54 +02:00
Florian Roth 168df94b73 Update proc_creation_win_susp_clsid_foldername.yml 2022-09-02 17:36:10 +02:00
Florian Roth da6ca9ece7 Update proc_creation_win_certutil_ntlm_coercion.yml 2022-09-02 17:27:15 +02:00
Florian Roth b33b2317c8 Update proc_creation_win_frp.yml 2022-09-02 17:22:23 +02:00
Florian Roth 3e1116bbfb Update proc_creation_win_frp.yml 2022-09-02 17:19:27 +02:00
Nasreddine Bencherchali f6026b6972 Update proc_creation_win_susp_schtasks_disable.yml 2022-09-02 14:39:52 +02:00
Nasreddine Bencherchali 927b29e85a Update proc_creation_win_susp_powershell_download_iex.yml 2022-09-02 14:28:47 +02:00
Nasreddine Bencherchali e0a74d6238 Update proc_creation_win_net_default_accounts_manipulation.yml 2022-09-02 14:17:17 +02:00
Nasreddine Bencherchali 884891746b Update proc_creation_win_powershell_amsi_bypass.yml 2022-09-02 12:02:18 +02:00
Nasreddine Bencherchali 37f08c4cbb More updates 2022-09-02 11:52:13 +02:00
frack113 8bb29b0e66 Add proc_creation_win_frp 2022-09-02 10:29:40 +02:00
Nasreddine Bencherchali b02a2ff2dc Update proc_creation_win_net_default_accounts_manipulation.yml 2022-09-02 09:49:14 +02:00
Nasreddine Bencherchali 5f03a73dd2 Update proc_creation_win_susp_clsid_foldername.yml 2022-09-02 09:33:13 +02:00