security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
4,006 Commits 1 Branch 57 Tags
2e6f184370b1c08c826da66036f79014d5db122f
Commit Graph

2575 Commits

Author SHA1 Message Date
Vasiliy Burov 2e6f184370 Update powershell_cmdline_specific_comb_methods.yml 2020-10-12 14:11:10 +03:00
Vasiliy Burov 436dd4d90c Update powershell_cmdline_specific_comb_methods.yml 2020-10-12 14:04:24 +03:00
Vasiliy Burov a0ac753e32 Update powershell_cmdline_specific_comb_methods.yml 2020-10-12 00:39:36 +03:00
Vasiliy Burov 48f6fad6c3 Update powershell_cmdline_specific_comb_methods.yml 2020-10-12 00:35:59 +03:00
Vasiliy Burov 8d926dc303 Update powershell_cmdline_specific_comb_methods.yml 2020-10-12 00:27:45 +03:00
Vasiliy Burov 6f7475020a Update powershell_cmdline_specific_comb_methods.yml 2020-10-12 00:23:27 +03:00
Vasiliy Burov 26ef1da071 Update powershell_cmdline_specific_comb_methods.yml 2020-10-12 00:00:17 +03:00
Vasiliy Burov d4e1786836 Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 23:57:27 +03:00
Vasiliy Burov e2543158ce Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 23:53:00 +03:00
Vasiliy Burov 47d6122298 Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 23:46:51 +03:00
Vasiliy Burov a39d453792 Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 23:42:51 +03:00
Vasiliy Burov 2d88000fdf Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 23:38:07 +03:00
Vasiliy Burov 5c4adbb24e Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 23:33:57 +03:00
Vasiliy Burov da14df6c9f Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 23:29:37 +03:00
Vasiliy Burov b80f0f6478 Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 23:18:23 +03:00
Vasiliy Burov fb5748254e Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 22:45:32 +03:00
Vasiliy Burov ef17d168bd Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 22:34:47 +03:00
Vasiliy Burov ce2767b10e Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 21:47:07 +03:00
Vasiliy Burov 6e4f8bdd53 Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 21:35:15 +03:00
Vasiliy Burov 6cc1a5e767 Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 21:27:24 +03:00
Vasiliy Burov 03ebc36a11 Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 21:23:12 +03:00
Vasiliy Burov d16770aee4 Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 21:19:23 +03:00
Vasiliy Burov 82c7edfd68 Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 21:14:45 +03:00
Vasiliy Burov 2385d06221 Update powershell_cmdline_specific_comb_methods.yml 2020-10-11 21:09:21 +03:00
Vasiliy Burov 6094fd4e9c [OSCD] Create powershell_cmdline_specific_comb_methods.yml 2020-10-11 20:56:45 +03:00
Thomas Patzke 93616af1cb Merge pull request #1036 from svch0stz/oscd4 
[OSCD] Create win_net_use_admin_share.yml
 2020-10-10 00:05:41 +02:00
Thomas Patzke fe554a88cb Merge pull request #1035 from svch0stz/oscd3 
[OSCD] Update win_susp_copy_lateral_movement.yml
 2020-10-10 00:03:26 +02:00
svch0stz ca0f2146ab Update win_net_use_admin_share.yml 2020-10-07 08:23:31 +11:00
svch0stz 3d048ceba0 Update win_susp_copy_lateral_movement.yml 2020-10-07 08:18:09 +11:00
svch0stz ee2c79745f Update win_susp_wsl_lolbin.yml 2020-10-07 08:12:51 +11:00
svch0stz c82d5ac08e Create win_net_use_admin_share.yml 2020-10-05 14:43:45 +11:00
svch0stz 60bd6a3692 Update win_susp_copy_lateral_movement.yml 2020-10-05 14:35:20 +11:00
svch0stz dd2ab4082d Update win_susp_copy_lateral_movement.yml 2020-10-05 14:33:00 +11:00
svch0stz 641f3031bd Update win_susp_copy_lateral_movement.yml 2020-10-05 14:27:39 +11:00
svch0stz 3516819bf8 Delete win_net_use_admin_share.yml 2020-10-05 14:00:36 +11:00
svch0stz c675be41e2 Create win_net_use_admin_share.yml 2020-10-05 13:57:50 +11:00
svch0stz bc947fefc1 Create win_susp_wsl_lolbin.yml 2020-10-05 13:36:40 +11:00
Florian Roth d3ee1aba66 docs: MITRE ATT&CK(R) trademark references removed or adjusted 
https://github.com/Neo23x0/sigma/issues/1028
 2020-09-30 08:53:52 +02:00
Florian Roth c17ca6d5fe Merge pull request #1018 from savvyspoon/wcry-dns 
WannaCry Killswitch domain DNS query
 2020-09-29 09:27:21 +02:00
Florian Roth d7d9c0e772 Merge pull request #1021 from hieuttmmo/master 
Sigma rule to detect AdFind.exe execution
 2020-09-27 09:50:41 +02:00
Florian Roth 8020fe3c40 false positive condition 2020-09-26 17:03:29 +02:00
Florian Roth 60795f7050 Update win_susp_adfind.yml 
Fear that a simple adfind.exe causes too many false positives
 2020-09-26 17:02:39 +02:00
Florian Roth dbdd758365 Duplicate Rule 
we already have a rule for that
 2020-09-26 17:01:32 +02:00
Tran Trung Hieu d4dd0600ad Fix logsource service to process_creation 2020-09-26 21:45:23 +07:00
Tran Trung Hieu c756fc8576 Detect Suspicious AdFind Execution 2020-09-26 21:34:06 +07:00
Mike Wade f76f80db80 Killswitch domain 2020-09-16 20:32:31 -06:00
Mike Wade 7b1ef9ea64 fixing test runner issues 2020-09-15 15:45:33 -06:00
Mike Wade 6ed36b0e41 fixed issues with tabs and duplicate tags 2020-09-15 08:52:00 -06:00
Florian Roth 2cd9b794e6 Merge pull request #1007 from d4rk-d4nph3/master 
Windows Defender AMSI Trigger Detected
 2020-09-15 15:45:00 +02:00
Remco Hofman 6cadfa5b2b Added win_vul_cve_2020_1472 rule 2020-09-15 15:13:53 +02:00