security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,175 Commits 1 Branch 57 Tags
3da07164ce0d651bf72691bac1cfcafbf20249de
Commit Graph

4252 Commits

Author SHA1 Message Date
Nasreddine Bencherchali 0fe4f16dfb fix: update filter based on ##3865 and #3866 2023-01-04 10:28:50 +01:00
Nasreddine Bencherchali a737737d92 fix: enhance filter 2023-01-04 00:46:54 +01:00
Tim Shelton 0c520dc930 FP: manage engine admanager postgres calling archive.bat 2023-01-03 22:04:52 +00:00
Nasreddine Bencherchali 343e3f0934 Merge pull request #3859 from D3F7A5105/master 
Change Evtx Location Used Wevtutil
 2023-01-03 13:23:57 +01:00
Vadim eabad66768 Delete proc_creation_win_change_evtx_location.yml 2023-01-03 15:15:52 +03:00
Vadim 4329b9ad49 Update proc_creation_win_susp_eventlog_clear.yml 2023-01-03 15:11:33 +03:00
Vadim 5dc77bad7a Update rule for detects change location evtx 2023-01-03 15:10:54 +03:00
Vadim 052cd2e967 Update proc_creation_win_change_evtx_location.yml 2023-01-03 12:11:13 +03:00
Vadim 2075962596 Update proc_creation_win_change_evtx_location.yml 2023-01-03 11:54:30 +03:00
vadim e620fcbc0b Detects change location evtx used wecutil 2023-01-03 11:36:54 +03:00
Florian Roth 2b04ae2e35 Merge branch 'master' into aurora-false-positive-fixing 2023-01-03 00:17:11 +01:00
Florian Roth fefaa57d3c fix: FPs noticed in CI testing 2023-01-03 00:16:32 +01:00
Nasreddine Bencherchali 579b450d17 fix: add missing date 2023-01-02 15:26:41 +01:00
Nasreddine Bencherchali 083d30c19d fix: title and add python filter 2023-01-02 15:02:28 +01:00
Nasreddine Bencherchali e23a63a60e fix: typo in field name 2023-01-02 14:52:35 +01:00
Nasreddine Bencherchali 3749416a30 Merge branch 'SigmaHQ:master' into nasbench-rule-devel 2023-01-02 14:50:27 +01:00
Nasreddine Bencherchali a99b5082e1 feat: updates and enhancements 2023-01-02 14:49:45 +01:00
frack113 0aad498425 Last lolbin (#3845) 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-12-31 19:53:44 +01:00
Nasreddine Bencherchali f67cd766d0 Merge pull request #3846 from fukusuket/fix-invalid-regex-escape 
fix: remove incorrect backslash escape(in `|re` block)
 2022-12-31 18:35:36 +01:00
fukusuket 04ecbbded9 fix: typo modified 2022-12-31 21:57:05 +09:00
fukusuket 9298295c15 fix: remove invalid backslash escape 2022-12-31 21:35:07 +09:00
signalblur 73f56c2f0e Hidden Linux Binary Execution (#3108) 
Co-authored-by: Florian Roth <venom14@gmail.com>
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
 2022-12-31 08:27:32 +01:00
Nasreddine Bencherchali 7dab38b19f fix: add missing modified date 2022-12-30 20:56:21 +01:00
fukusuket bd6243be7d fix: remove unneeded backslash escape in character class. 2022-12-31 00:33:00 +09:00
Nasreddine Bencherchali 261bb8758a Merge branch 'SigmaHQ:master' into nasbench-rule-devel 2022-12-30 11:49:08 +01:00
frack113 aee5ca7afc Fix invalid field cast or name (#3841) 2022-12-30 11:46:21 +01:00
Nasreddine Bencherchali d4b9df608b fix: broken selection 2022-12-30 10:30:15 +01:00
Nasreddine Bencherchali 58f47b9875 fix: add known children appvlp 2022-12-30 10:24:25 +01:00
frack113 995b5918f2 Update rules/windows/process_creation/proc_creation_win_susp_shellexec_rundll_usage.yml 2022-12-30 10:21:54 +01:00
frack113 f083c5f83f Merge branch 'master' into patch-1 2022-12-30 10:12:25 +01:00
frack113 d10ecf5527 Merge pull request #3838 from redsand/fp_sysmon_werfault_child 
FP when sysmon crashes and werfault gets launched
 2022-12-30 10:08:09 +01:00
zydyka d7bc30587f Update proc_creation_win_sysmon_exploitation.yml 2022-12-30 09:00:57 +05:00
Nasreddine Bencherchali 1e29560591 fix: duplicate title 2022-12-30 01:10:03 +01:00
Nasreddine Bencherchali 2d5231ca2c fix: broken selection 2022-12-30 00:58:17 +01:00
Nasreddine Bencherchali c6fd915619 feat: updates and enhancements 2022-12-30 00:56:40 +01:00
Tim Shelton aeab567fb9 FP when sysmon crashes and werfault gets launched 2022-12-29 21:18:26 +00:00
fukusuket 42ab7c0484 fix regex escape 2022-12-30 00:11:52 +09:00
frack113 197615345b Add missing lolbin OSBinaries (#3835) 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-12-29 14:36:33 +01:00
Nasreddine Bencherchali 19396788db Merge pull request #3831 from redsand/fp_suspicious_process_privilege 
FP: filters out erl.exe running handle.exe with elevated privileges
 2022-12-28 21:18:54 +01:00
Florian Roth f3abafed94 fix: Windows Defender detection 2022-12-28 20:52:53 +01:00
Nasreddine Bencherchali 77113a7340 fix: author ref 2022-12-28 18:42:47 +01:00
Nasreddine Bencherchali 3677b9f2e6 fix: enhance fp filter 2022-12-28 18:42:12 +01:00
Tim Shelton f5fffd8e92 FP: filters out erl.exe running handle.exe with elevated privileges 2022-12-28 16:44:25 +00:00
frack113 b3ec85b25b Merge pull request #3826 from nasbench/fix-old-sigma-link 
fix: rename links from old repo to SigmaHQ
 2022-12-28 11:11:04 +01:00
Nasreddine Bencherchali a25027fef8 fix: rename links from old repo to SigmaHQ 2022-12-27 21:05:16 +01:00
frack113 0392f92a0d PowerShell Token Obfuscation (#3825) 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-12-27 20:03:05 +01:00
frack113 e1707c8f50 rewrite issue 1555 (#3818) 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-12-27 19:28:34 +01:00
Florian Roth 3e712480c4 Merge pull request #3824 from SigmaHQ/rule-devel 
Htran/NATbypass, Greedy RAR
 2022-12-27 16:34:33 +01:00
Nasreddine Bencherchali 88e56229cf fix: indentation and selection names for clarity 2022-12-27 16:26:20 +01:00
Florian Roth 32a17342b4 Update rules/windows/process_creation/proc_creation_win_rar_susp_greedy.yml 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-12-27 15:46:37 +01:00