security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,691 Commits 1 Branch 57 Tags
2055da991f99a2ee0da07da154ecd2e48795d1bb
Commit Graph

6691 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Florian Roth 2055da991f Merge pull request #1691 from SigmaHQ/rule-devel 
Rules: scripts from Temp folders, reg disable sec services
 2021-07-15 08:35:54 +02:00
Florian Roth e516aecc74 fix: error in selector 2021-07-14 15:58:55 +02:00
Florian Roth 530e04faec rule: Script Execution from Temp Folder 2021-07-14 15:52:52 +02:00
Florian Roth 0d794357e8 rule: reg disable security services 2021-07-14 15:52:35 +02:00
Florian Roth 3ff4e99d44 Merge pull request #1688 from SigmaHQ/rule-devel 
refactor: improved Raccine uninstall rule
 2021-07-14 09:57:08 +02:00
Florian Roth 04370c7e91 refactor: improved Raccine uninstall rule 2021-07-14 09:56:35 +02:00
Florian Roth 1ec9473472 Merge pull request #1687 from SigmaHQ/rule-devel 
Rule adjustments and new Serv-U exploitation rules
 2021-07-14 08:59:33 +02:00
Florian Roth 5e2e6c9b72 Merge branch 'config-adjustments' into rule-devel 2021-07-14 08:35:47 +02:00
Florian Roth e0f166aba2 rule: Serv-U exploitation 
https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
 2021-07-14 08:35:25 +02:00
Florian Roth 85d47aeabc Merge pull request #1678 from frack113/redcanary_t1228 
Some Redcanary T1228
 2021-07-14 08:18:52 +02:00
Florian Roth 9fce0fb42d Merge pull request #1680 from phantinuss/master 
medium level Rule for Windows Defender Exclusions
 2021-07-14 08:18:39 +02:00
Florian Roth 3faef2d94a Merge pull request #1681 from frack113/redcanary_t1228_v2 
Redcanary t1228 end
 2021-07-14 08:18:23 +02:00
Florian Roth f8afbf62aa Merge pull request #1682 from w0rk3r/master 
Remove Field Value Wildcard in ALA Backend
 2021-07-14 08:18:08 +02:00
Jonhnathan f6e7fc446f Remove Wildcard 2021-07-13 11:21:12 -03:00
frack113 8b14dc6c99 fix [colons] too many spaces after colon 2021-07-13 14:42:47 +02:00
frack113 c00dd0bf65 add win_susp_athremotefxvgpudisablementcommand.yml 2021-07-13 14:29:00 +02:00
frack113 6d1e8268ba update win_workflow_compiler.yml 2021-07-13 13:55:27 +02:00
phantinuss bf9b82fc45 medium level rule for Windows Defender Exclusions 2021-07-13 13:16:25 +02:00
frack113 6b9466ec20 Add process_creation_protocolhandler_suspicious_file.yml 2021-07-13 12:19:07 +02:00
frack113 33832acf5b fix Error: [colons] too many spaces before colon 2021-07-13 10:09:52 +02:00
frack113 c2d9b05191 Add process_creation_infdefaultinstall.yml 2021-07-13 09:56:34 +02:00
frack113 fd377fe163 update process_creation_syncappvpublishingserver_execute_arbitrary_powershell 2021-07-13 09:45:46 +02:00
Thomas Patzke 82b8b6890f Merge pull request #1663 from heyibrahimkhan/patch-4 
Create ala-azure-ad_auditlogs.yml
 2021-07-12 23:37:55 +02:00
Thomas Patzke 294a405481 Merge pull request #1662 from heyibrahimkhan/patch-3 
Create ala-azure-activitylogs.yml
 2021-07-12 23:37:46 +02:00
Thomas Patzke 98165cdd09 Merge pull request #1661 from heyibrahimkhan/patch-2 
Create ecs-azure-ad_auditlogs.yml
 2021-07-12 23:37:37 +02:00
Thomas Patzke a73c371c66 Merge pull request #1672 from mf1d3l:splunkdm_backend 
SplunkDM Backend: Splunk datamodels accelerated searches support
 2021-07-12 23:05:51 +02:00
Florian Roth 3761cd1b34 Merge pull request #1660 from heyibrahimkhan/patch-1 
Create ecs-azure-activitylogs.yml
 2021-07-12 17:42:49 +02:00
frack113 82f666c5da add process_creation_syncappvpublishingserver_execute_arbitrary_powershell.yml 2021-07-12 16:17:40 +02:00
frack113 d6a86a3fa0 add T1218 sysmon_creation_mavinject_dll.yml 2021-07-12 16:08:18 +02:00
Florian Roth 730e9eb883 Merge pull request #1667 from leegengyu/patch-10 
Update winlogbeat-modules-enabled.yml - Imphash Field
 2021-07-12 15:37:33 +02:00
Florian Roth ac7270ff32 Merge pull request #1669 from leegengyu/patch-11 
Update winlogbeat.yml - Imphash Field
 2021-07-12 15:37:00 +02:00
Florian Roth a16ce3b828 Merge pull request #1673 from frack113/ecs 
Add mapping for auditbeat and filebeat
 2021-07-12 15:36:07 +02:00
Florian Roth 382d5b2adb Merge pull request #1674 from frack113/fix_small_errors 
Fix some typo error
 2021-07-12 15:23:55 +02:00
Florian Roth 682e0458a3 Merge pull request #1675 from frack113/redcanary_attack.t1562.001 
Atomic Red team T1562.001
 2021-07-12 15:23:35 +02:00
Florian Roth 677c53a262 Merge pull request #1676 from d4rk-d4nph3/master 
Added latest McAfee zloader's reference for Office Security Settings …
 2021-07-12 14:02:49 +02:00
Bhabesh Rai 1fc5ec981d Added latest McAfee zloader's reference for Office Security Settings Changed 2021-07-12 16:56:21 +05:45
frack113 a96678d725 test 21 to 24 from https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md 2021-07-12 10:54:44 +02:00
Florian Roth 7f071d7851 Merge pull request #1554 from mlp1515/master 
Update win_multiple_suspicious_cli.yml
 2021-07-12 10:43:26 +02:00
Thomas Patzke 0b83c12dd1 Merge branch 'devel-tp' 2021-07-12 10:21:19 +02:00
frack113 af140ebf84 fix some typo error 2021-07-12 09:40:18 +02:00
frack113 b6d2ec33cc Add mapping for auditbeat and filebeat 2021-07-12 09:00:57 +02:00
Thomas Patzke 176514bd7a New rule: suspicious spoolsv child process 2021-07-12 08:48:59 +02:00
Thomas Patzke 0b590aba5d Adjusted Spool Service DLL load rule 2021-07-11 09:29:43 +02:00
Thomas Patzke 6d41d538b2 Title fixed 2021-07-11 09:25:33 +02:00
Florian Roth 58a634b0b6 Merge branch 'master' into master 2021-07-11 00:32:55 +02:00
mf1d3l 9005b58649 extend cim 2021-07-10 23:06:29 +02:00
mf1d3l 681accf2ba add splunkdm to Makefile 2021-07-10 22:23:15 +02:00
mf1d3l 0271bc6b13 clean 2021-07-10 22:13:09 +02:00
mf1d3l b986ed0716 extend cim 2021-07-10 19:02:24 +02:00
G Y bdb77780b3 Update winlogbeat.yml 
Change Imphash's value as current one does not exist without the Sysmon processor module under Winlogbeat.
 2021-07-10 11:37:36 +08:00