security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,368 Commits 1 Branch 57 Tags
2c0e89ccc8584b59bee3ae4c8aabd2a9df87f8af
Commit Graph

508 Commits

Author SHA1 Message Date
Roberto Rodriguez 2c0e89ccc8 added indentation to lists per request 2021-10-15 16:24:26 -04:00
Roberto Rodriguez 7b11987155 Fixed format indentation to fix block error 2021-10-15 16:12:51 -04:00
Roberto Rodriguez d391eccd32 split commandline arguments in a few rules 2021-10-15 16:10:42 -04:00
Roberto Rodriguez eed86077ab updated rules schema and added Clipboard Collection with Xclip Tool 2021-10-15 15:59:11 -04:00
Roberto Rodriguez 04ff9ae692 Updated at command rule to use Image field 2021-10-15 15:46:59 -04:00
Roberto Rodriguez aa0a5b8204 commands to clear or remove the syslog rule 2021-10-15 15:43:42 -04:00
Roberto Rodriguez f8cb0883d5 OMI SCX Execute RunAsProvider rules 2021-10-15 15:38:09 -04:00
Roberto Rodriguez ca99394e46 detect overwriting and deletion of files via dd 2021-10-15 15:28:15 -04:00
Florian Roth 6c4e24d0de rule: coin miner param --cpu-priority 2021-10-09 10:28:16 +02:00
frack113 e666b7e1db Merge pull request #2116 from zakibro/master 
New Rule - Linux - Auditd - Clipboard Collection of Image Data with X…
 2021-10-02 11:06:24 +02:00
zakibro c2a26923c6 Update lnx_auditd_clipboard_image_collection.yml 2021-10-02 09:59:37 +02:00
zakibro d40b42fc2c Update lnx_auditd_clipboard_image_collection.yml 
fixing a typo
 2021-10-01 18:54:12 +02:00
Pawel Mazur e67770d7ea New Rule - Linux - Auditd - Clipboard Collection of Image Data with Xclip Tool 2021-10-01 18:43:03 +02:00
Austin Songer 00513ff2c5 Create macos_suspicious_macos_firmware_activity.yml 2021-09-30 18:47:15 -05:00
frack113 6bce0f967a Merge pull request #2079 from zakibro/master 
New Rule - Linux - Auditd - Clipboard Collection
 2021-09-27 08:34:30 +02:00
zakibro 6a2785492d Update lnx_auditd_clipboard_collection.yml 
Changes after suggestion.
 2021-09-27 07:59:43 +02:00
Pawel Mazur 4bbe4962b0 New Rule - Linux - Auditd - Clipboard Collection 2021-09-24 18:40:10 +02:00
Florian Roth b7b0bd4275 Update lnx_clear_syslog.yml 2021-09-22 09:46:05 +02:00
frack113 7b995f2d99 Merge pull request #2057 from secDre4mer/master 
Add two rules
 2021-09-22 09:15:32 +02:00
frack113 ac639bb9ec Merge pull request #2060 from zakibro/master 
New Rule - Linux - Auditd - Screencapture with Import Tool
 2021-09-22 08:41:50 +02:00
Pawel Mazur e20e5033e7 New Rule - Linux - Auditd - Screencapture with Import Tool 2021-09-21 18:55:48 +02:00
Max Altgelt bf9bc03258 chore: properly name and describe rules 2021-09-21 15:59:01 +02:00
Max Altgelt 346ff26809 feat: Add rule for syslog removal 2021-09-21 14:56:12 +02:00
Roberto Rodriguez 407289d300 Rule to detect the execution of a script via SCX RunAsprovider ExecuteScript 2021-09-18 03:50:37 -04:00
Florian Roth 260578dceb fix: wrong modified field 2021-09-17 14:29:19 +02:00
Roberto Rodriguez c17104b2eb updated level to high 2021-09-17 04:30:17 -04:00
Roberto Rodriguez 7618cf4672 Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell 2021-09-17 04:23:11 -04:00
frack113 33a51df46a Update lnx_system_info_discovery.yml 2021-09-14 21:03:46 +02:00
frack113 a6da209507 Update lnx_auditd_system_info_discovery2.yml 2021-09-14 21:02:51 +02:00
frack113 a3477893de Update lnx_auditd_network_service_scanning.yml 2021-09-14 21:02:13 +02:00
frack113 83531bb2ff split global lnx_system_info_discovery.yml 2021-09-14 20:13:57 +02:00
frack113 38c0f83eaf split global lnx_sudo_cve_2019_14287.yml 2021-09-14 20:07:13 +02:00
frack113 87e5fc48fa split global lnx_security_tools_disabling.yml 2021-09-14 19:32:58 +02:00
frack113 ecefc6e913 add missing product 2021-09-14 19:29:49 +02:00
frack113 bc69900335 split global lnx_network_service_scanning.yml 2021-09-14 19:27:28 +02:00
frack113 30955c4884 split global lnx_auditd_cve_2021_3156_sudo_buffer_overflow.yml 2021-09-14 19:24:11 +02:00
frack113 1e4484bffb split lnx_auditd_cve_2021_3156_sudo_buffer_overflow 2021-09-14 19:22:56 +02:00
frack113 7298225cbe Merge pull request #2028 from zakibro/master 
New Rule - Linux - Auditd - Screen Capture with xwd
 2021-09-14 09:58:11 +02:00
zakibro e47a7d9826 Update lnx_auditd_screencaputre_xwd.yml 2021-09-13 19:08:23 +02:00
Pawel Mazur a8f9617ccd New Rule - Linux - Auditd - Screen Capture with xwd 2021-09-13 18:56:33 +02:00
frack113 dc5c26ad2d Merge pull request #2018 from zakibro/master 
New Linux Auditd Rules - Steghide Steganography
 2021-09-12 08:29:56 +02:00
zakibro 6412ddaaee Update lnx_auditd_steghide_extract_steganography.yml 2021-09-11 11:19:21 +02:00
zakibro d0741f9f3a Update lnx_auditd_steghide_embed_steganography.yml 
Formatting and detection changes
 2021-09-11 11:18:08 +02:00
Pawel Mazur 89f15c01f9 New Linux Auditd Rules - Steghide Steganography 2021-09-11 10:56:17 +02:00
frack113 4a03ef6e0b Merge pull request #2007 from zakibro/master 
New Rule - Linux Auditd Hidden Files - Steganography
 2021-09-10 09:18:28 +02:00
zakibro a4dffc14d4 Update lnx_auditd_unzip_hidden_zip_files_steganography.yml 
Fixing formatting
 2021-09-10 07:54:56 +02:00
zakibro 0b5e8cb980 Update lnx_auditd_hidden_zip_files_steganography.yml 
Formatting changes
 2021-09-10 07:52:35 +02:00
Pawel Mazur 5a5769cce6 New Rule - Linux - Steganography Unzip Hidden Information From Picture File 2021-09-09 20:38:25 +02:00
zakibro 3fbe5478c3 Update and rename lnx_auditd_hidden_files_steganography.yml to lnx_auditd_hidden_zip_files_steganography.yml 
Splitting the rule into separate rules
 2021-09-09 20:34:20 +02:00
zakibro 458973af81 Update lnx_auditd_hidden_files_steganography.yml 
Adding missing field: action
 2021-09-09 16:52:58 +02:00