security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,691 Commits 1 Branch 57 Tags
2055da991f99a2ee0da07da154ecd2e48795d1bb
Commit Graph

1752 Commits

Author SHA1 Message Date
Florian Roth 2055da991f Merge pull request #1691 from SigmaHQ/rule-devel 
Rules: scripts from Temp folders, reg disable sec services
 2021-07-15 08:35:54 +02:00
Florian Roth e516aecc74 fix: error in selector 2021-07-14 15:58:55 +02:00
Florian Roth 530e04faec rule: Script Execution from Temp Folder 2021-07-14 15:52:52 +02:00
Florian Roth 0d794357e8 rule: reg disable security services 2021-07-14 15:52:35 +02:00
Florian Roth 3ff4e99d44 Merge pull request #1688 from SigmaHQ/rule-devel 
refactor: improved Raccine uninstall rule
 2021-07-14 09:57:08 +02:00
Florian Roth 04370c7e91 refactor: improved Raccine uninstall rule 2021-07-14 09:56:35 +02:00
Florian Roth 1ec9473472 Merge pull request #1687 from SigmaHQ/rule-devel 
Rule adjustments and new Serv-U exploitation rules
 2021-07-14 08:59:33 +02:00
Florian Roth e0f166aba2 rule: Serv-U exploitation 
https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
 2021-07-14 08:35:25 +02:00
Florian Roth 85d47aeabc Merge pull request #1678 from frack113/redcanary_t1228 
Some Redcanary T1228
 2021-07-14 08:18:52 +02:00
frack113 6d1e8268ba update win_workflow_compiler.yml 2021-07-13 13:55:27 +02:00
frack113 6b9466ec20 Add process_creation_protocolhandler_suspicious_file.yml 2021-07-13 12:19:07 +02:00
frack113 33832acf5b fix Error: [colons] too many spaces before colon 2021-07-13 10:09:52 +02:00
frack113 c2d9b05191 Add process_creation_infdefaultinstall.yml 2021-07-13 09:56:34 +02:00
frack113 fd377fe163 update process_creation_syncappvpublishingserver_execute_arbitrary_powershell 2021-07-13 09:45:46 +02:00
frack113 82f666c5da add process_creation_syncappvpublishingserver_execute_arbitrary_powershell.yml 2021-07-12 16:17:40 +02:00
frack113 d6a86a3fa0 add T1218 sysmon_creation_mavinject_dll.yml 2021-07-12 16:08:18 +02:00
Florian Roth 382d5b2adb Merge pull request #1674 from frack113/fix_small_errors 
Fix some typo error
 2021-07-12 15:23:55 +02:00
Florian Roth 682e0458a3 Merge pull request #1675 from frack113/redcanary_attack.t1562.001 
Atomic Red team T1562.001
 2021-07-12 15:23:35 +02:00
frack113 a96678d725 test 21 to 24 from https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md 2021-07-12 10:54:44 +02:00
Florian Roth 7f071d7851 Merge pull request #1554 from mlp1515/master 
Update win_multiple_suspicious_cli.yml
 2021-07-12 10:43:26 +02:00
Thomas Patzke 0b83c12dd1 Merge branch 'devel-tp' 2021-07-12 10:21:19 +02:00
frack113 af140ebf84 fix some typo error 2021-07-12 09:40:18 +02:00
Thomas Patzke 176514bd7a New rule: suspicious spoolsv child process 2021-07-12 08:48:59 +02:00
Florian Roth 58a634b0b6 Merge branch 'master' into master 2021-07-11 00:32:55 +02:00
frack113 17edaa0950 combines 2 rules 2021-07-09 16:41:03 +02:00
frack113 a53e21eb77 2 more rule with custom field 2021-07-09 10:07:41 +02:00
frack113 06a05cfad9 Move to rules-unsupported as use special enrichment field 2021-07-09 07:40:57 +02:00
Florian Roth 0518439de7 Merge pull request #1648 from frack113/fix_windows_fields 
Fix more windows fields name
 2021-07-08 14:53:14 +02:00
Florian Roth 25dec8a17b Merge pull request #1649 from leegengyu/patch-9 
Update win_apt_apt29_thinktanks.yml - Links
 2021-07-07 18:10:27 +02:00
Florian Roth c3c152d457 Merge pull request #1652 from SigmaHQ/rule-devel 
refactor: changed cmdkey rule
 2021-07-07 18:09:44 +02:00
frack113 8a96aa7855 Add 2 defense-evasion T1562.001 rules 2021-07-07 15:43:55 +02:00
Florian Roth 0c7661e8bc refactor: changed cmdkey rule 2021-07-07 14:45:03 +02:00
G Y 1adac5b036 Update win_apt_apt29_thinktanks.yml - Links 
Reference links updated with grammar corrections.
 2021-07-07 20:21:41 +08:00
frack113 4e3b275056 Fix more windows fields name 2021-07-07 12:28:00 +02:00
frack113 bb970de5b7 fix invalid fields name 2021-07-07 09:05:00 +02:00
mlp1515 29a6a2d5fb Merge branch 'SigmaHQ:master' into master 2021-07-07 08:25:04 +02:00
Florian Roth ff0f1a0222 Merge pull request #1633 from leegengyu/art_convert_yaml_to_md 
Convert ART reference links from .yaml to .md
 2021-07-06 13:39:37 +02:00
leegengyu 1f19f79da9 Convert ART reference links from .yaml to .md 2021-07-06 17:56:38 +08:00
Florian Roth 705415c2bd Merge pull request #1632 from frack113/process_creation_OriginalFileName 
change OriginalFilename case
 2021-07-06 11:45:21 +02:00
leegengyu 69d5d9734d Updated ART reference links from .yaml 2021-07-06 17:39:25 +08:00
leegengyu 5eb9547d5b Updated ART reference links from .yaml to .md and sub-technique links. 2021-07-06 17:30:57 +08:00
leegengyu 7557732ca2 Updated ART reference links from .yaml to .md and sub-technique links. 2021-07-06 17:21:22 +08:00
frack113 cfccdea28e change OriginalFilename case 2021-07-06 10:09:47 +02:00
frack113 9c94cf42fe childimage do not exist in sysmon schema 2021-07-06 09:26:43 +02:00
Florian Roth 8069b53e5e Merge pull request #1625 from SigmaHQ/rule-devel 
Kaseya patterns, PrinterNightmare Mimikatz update
 2021-07-05 13:29:23 +02:00
Florian Roth 7fab22ddc2 rule: more Kaseya patterns 2021-07-05 12:03:35 +02:00
Florian Roth a02b7a2390 Merge pull request #1617 from SigmaHQ/rule-devel 
rule: REvil Kaseya patterns
 2021-07-03 17:32:18 +02:00
Florian Roth 1d82ac50e4 refactor: additional pattern, extended description 2021-07-03 17:03:40 +02:00
Florian Roth 57b816f49d rule: REvil Kaseya patterns 2021-07-03 16:34:02 +02:00
frack113 02100f1a3c Tune detection in win_renamed_powershell.yml 2021-07-03 15:18:01 +02:00