security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
12,978 Commits 1 Branch 57 Tags
2ecf9ec7e16707513524c2f3c82fa471663cacad
Commit Graph

10065 Commits

Author SHA1 Message Date
Nasreddine Bencherchali 2ecf9ec7e1 Updates 2022-10-04 20:57:11 +02:00
Nasreddine Bencherchali 098d530577 Fix error in driver rule 2022-10-04 11:38:58 +02:00
Nasreddine Bencherchali 809f45800e Update drivers list 2022-10-03 10:46:02 +02:00
Nasreddine Bencherchali 7880e3a2b6 Fix FP 
Make the FP fix more broad to cover more future cases
 2022-09-29 22:29:47 +02:00
Nasreddine Bencherchali afb2e7567d Create web_cve_2022_36804_atlassian_bitbucket_command_injection.yml 2022-09-29 22:23:04 +02:00
Nasreddine Bencherchali 99a0c129ea Create registry_set_register_custom_protocol_handler.yml 2022-09-29 22:06:18 +02:00
Nasreddine Bencherchali bfc1d6a5b7 Create proc_creation_win_hh_chm_http.yml 2022-09-29 22:06:11 +02:00
Florian Roth f84cdd3b74 fix: filter definition 2022-09-29 14:07:38 +02:00
Florian Roth 14fdf75ab5 fix: FPs noticed with THOR 2022-09-29 13:51:09 +02:00
Florian Roth 5b5c261c98 Merge branch 'master' into aurora-false-positive-fixing 2022-09-29 13:41:25 +02:00
Florian Roth c31fe50f4d fix: FPs noticed in THOR testing 2022-09-29 13:41:20 +02:00
Nasreddine Bencherchali 47dbe6081d Update proc_creation_win_susp_conhost.yml 2022-09-29 12:15:10 +02:00
Nasreddine Bencherchali cdd9aff032 Fix FP 2022-09-29 11:20:08 +02:00
Florian Roth a888ecb8b8 Merge pull request #3535 from nasbench/nasbench-rule-devel 
New rules + update
 2022-09-29 11:01:29 +02:00
Florian Roth 5533d7367f Merge pull request #3539 from SigmaHQ/aurora-false-positive-fixing 
Aurora false positive fixing
 2022-09-29 11:01:13 +02:00
Florian Roth ec329f403a fix: Aurora FPs with Nvidia update 2022-09-28 19:31:22 +02:00
Florian Roth 428cb6ab74 Merge pull request #3538 from SigmaHQ/rule-devel 
fix: filter definition in userinit rule
 2022-09-28 17:26:34 +02:00
Florian Roth a563422c82 fix: filter definition in userinit rule 2022-09-28 17:08:23 +02:00
Nasreddine Bencherchali 4a5dcf8586 Update rules/windows/process_creation/proc_creation_win_susp_7zip_dmp.yml 
Co-authored-by: Florian Roth <venom14@gmail.com>
 2022-09-28 13:37:42 +02:00
Nasreddine Bencherchali 69b31b19b1 Update rules/windows/process_creation/proc_creation_win_renamed_rurat.yml 
Co-authored-by: Florian Roth <venom14@gmail.com>
 2022-09-28 13:37:36 +02:00
Florian Roth 5391a5cab4 changed casing, increased level 2022-09-28 13:28:53 +02:00
Florian Roth 5ee44a6992 increased level 2022-09-28 13:27:23 +02:00
Florian Roth ea25382110 increased level 2022-09-28 13:26:23 +02:00
Nasreddine Bencherchali b71644d0c8 New rules + small mitre update 2022-09-28 11:52:07 +02:00
Nasreddine Bencherchali df6c167b17 New Rules 2022-09-28 10:48:51 +02:00
Nasreddine Bencherchali e3b3265240 Update image_load_side_load_from_non_system_location.yml 2022-09-28 10:48:30 +02:00
frack113 a9dd6f7ff0 Add registry_set_change_winevt_channelaccess (#3505) 2022-09-28 09:53:46 +02:00
nasreddine.bencherchali@nextron-systems.com d262ea2df8 New rules 2022-09-28 09:51:13 +02:00
nasreddine.bencherchali@nextron-systems.com e987c669d0 Updates 2022-09-28 09:50:56 +02:00
frack113 ec6d237cd0 Merge pull request #3522 from frack113/redcannary_20220925 
Add redcannary rules
 2022-09-28 08:45:06 +02:00
Florian Roth e583d9fc39 Update proc_creation_win_w32tm.yml 2022-09-27 23:52:22 +02:00
Florian Roth 58b7c910dc Update proc_creation_win_w32tm.yml 2022-09-27 23:50:35 +02:00
Florian Roth 46ef664ec6 Merge pull request #3530 from securepeacock/patch-28 
Update proc_creation_win_susp_psexesvc_as_system.yml
 2022-09-27 23:47:45 +02:00
Yamato Security e44e01e106 update modified tag 2022-09-28 06:32:34 +09:00
Yamato Security 979502921f define security-mitigations service 2022-09-28 06:23:50 +09:00
securepeacock e90c91668d Update proc_creation_win_susp_psexesvc_as_system.yml 
Typo Fixed
 2022-09-27 13:45:53 -04:00
Qasim Qlf ec657a3118 Merge branch 'master' into master 2022-09-27 16:26:22 +05:00
nasreddine.bencherchali@nextron-systems.com 43d12249a0 Renamed create remote thread rules 2022-09-27 12:13:16 +02:00
nasreddine.bencherchali@nextron-systems.com 27d08a2eb9 Merge branch 'nasbench-rule-devel' of https://github.com/nasbench/sigma into nasbench-rule-devel 2022-09-27 12:09:37 +02:00
Florian Roth e2aacfea35 Merge pull request #3519 from SigmaHQ/rule-devel 
Rule devel
 2022-09-27 12:05:22 +02:00
Florian Roth be265d06ed fix: casing of field 2022-09-27 11:51:48 +02:00
Florian Roth 556441f4d8 Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing 2022-09-27 11:51:30 +02:00
Florian Roth 6eeee7eff4 fix: casing of field 2022-09-27 11:51:27 +02:00
Florian Roth be9fb6a6bd Merge pull request #3523 from SigmaHQ/aurora-false-positive-fixing 
Aurora false positive fixing
 2022-09-27 11:10:11 +02:00
Florian Roth d2f7ff8059 Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing 2022-09-27 10:47:21 +02:00
Florian Roth 5e6a926ac3 fix: FPs 2022-09-27 10:47:19 +02:00
Florian Roth e46d19e450 fix: condition 2022-09-27 10:30:34 +02:00
Florian Roth 43d9f3a13b Merge branch 'master' into rule-devel 2022-09-27 10:29:03 +02:00
nasreddine.bencherchali@nextron-systems.com a66ba61712 Fix small typos 2022-09-27 10:27:21 +02:00
Qasim Qlf de517ba8a2 Update proc_creation_win_uac_bypass_icmluautil.yml 2022-09-27 13:21:48 +05:00