security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,755 Commits 1 Branch 57 Tags
6187cfdfd6d2f7ff199beb6e08fd2234a8e8eb0e
Commit Graph

3272 Commits

Author SHA1 Message Date
Tim Shelton 6187cfdfd6 False positive when amazon workspaces is running and doing its weird little things 2022-07-14 19:41:52 +00:00
Florian Roth 98a7d2f76e Merge pull request #3216 from nasbench/master 
DFIR Report - SELECT XMRig FROM SQLServer (New Rules)
 2022-07-12 17:40:44 +02:00
Florian Roth 739a54289e Update proc_creation_win_inline_base64_mz_header.yml 2022-07-12 17:33:04 +02:00
Florian Roth 730ee2cc9b Merge pull request #3217 from phantinuss/master 
Fix FPs
 2022-07-12 17:16:04 +02:00
Florian Roth 31ee9b7104 Merge branch 'master' into aurora-false-positive-fixing 2022-07-12 16:54:10 +02:00
phantinuss b6025adaa8 fix: found on several systems in prod environment 2022-07-12 16:41:10 +02:00
Florian Roth e79e4d6c3b fix: FPs wtih csc.exe as child of sdiagnhost 2022-07-12 14:32:22 +02:00
Nasreddine Bencherchali a41a73d721 DFIR Report - SELECT XMRig FROM SQLServer 2022-07-12 01:27:51 +01:00
Nasreddine Bencherchali 614fe69363 Update proc_creation_win_susp_use_of_sqltoolsps_bin.yml 2022-07-11 18:27:06 +01:00
Nasreddine Bencherchali 3aab1cc54c Update proc_creation_win_susp_service_path_modification.yml 2022-07-11 18:25:54 +01:00
Nasreddine Bencherchali 987b694223 Update proc_creation_win_susp_runscripthelper.yml 2022-07-11 18:24:17 +01:00
Nasreddine Bencherchali 093aff99b0 Update proc_creation_win_lsass_dump.yml 2022-07-11 18:22:50 +01:00
Nasreddine Bencherchali f2d9299703 Update proc_creation_win_susp_runonce_execution.yml 2022-07-11 18:21:46 +01:00
Nasreddine Bencherchali 9feec535f6 Update proc_creation_win_base64_listing_shadowcopy.yml 2022-07-11 18:19:46 +01:00
Nasreddine Bencherchali 62574e9b0c Update Ref+Selection 3 2022-07-11 18:12:51 +01:00
Nasreddine Bencherchali 12d187bc91 Update Ref+Selection 2 2022-07-11 17:48:40 +01:00
Nasreddine Bencherchali fb73dfca88 Merge branch 'master' of https://github.com/nasbench/sigma 2022-07-11 14:11:59 +01:00
Nasreddine Bencherchali 238e0ecd7d Update Ref+Selection 2022-07-11 14:11:53 +01:00
Florian Roth e7f5b07f2d Merge pull request #3213 from SigmaHQ/rule-devel 
refactor: another Follina process pattern observed ITW
 2022-07-11 13:00:51 +02:00
Florian Roth 5b8f7d977f Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel 2022-07-11 12:52:08 +02:00
Florian Roth a17364104b refactor: Follina patterns 2022-07-11 12:52:06 +02:00
Florian Roth 9daef055ae Merge pull request #3211 from SigmaHQ/rule-devel 
fix: FPs with notepad as parent
 2022-07-08 20:40:49 +02:00
Florian Roth 0640695258 fix: FPs with notepad.exe as parent 
Closing https://github.com/SigmaHQ/sigma/issues/3208
 2022-07-08 19:28:43 +02:00
frack113 4f21febbb4 Fix detection 2022-07-08 18:20:37 +02:00
Florian Roth 578c838277 Merge pull request #3203 from nasbench/master 
Reference Update [Batch 1]
 2022-07-08 10:47:50 +02:00
Nasreddine Bencherchali 8b9307de30 Update selections 2022-07-07 20:55:19 +01:00
Nasreddine Bencherchali 68c27b56d4 Update proc_creation_win_exploit_cve_2020_1048.yml 2022-07-07 20:16:30 +01:00
Nasreddine Bencherchali aec95b6d65 Update selections and indentation 2022-07-07 20:13:45 +01:00
Florian Roth c7eb123bc3 Merge branch 'master' into aurora-false-positive-fixing 2022-07-07 18:21:16 +02:00
Florian Roth b58c797c61 fix: FPs with Visual Studio 2022-07-07 18:20:10 +02:00
Nasreddine Bencherchali 851d55a41f Update 2022-07-07 15:37:28 +01:00
Nasreddine Bencherchali d03f6df250 Reference Update [Batch 1] 2022-07-07 15:24:15 +01:00
Florian Roth beec664249 Merge pull request #3189 from redsand/fp_encoded_powershell_minor_indicator_due_to_devops 
reducing level due to low indicator, per devops processes
 2022-07-06 18:34:27 +02:00
Florian Roth d4781fa63c refactor: split up rule into one low & one medium 2022-07-06 18:24:59 +02:00
phantinuss ce1710a031 fix: FPs found in testing 2022-07-06 15:38:31 +02:00
frack113 88a6ec96e7 Update proc_creation_win_powershell_cmdline_specific_comb_methods.yml 2022-07-05 16:04:00 +02:00
frack113 b3595c2605 Update proc_creation_win_powershell_cmdline_specific_comb_methods.yml 2022-07-05 16:01:57 +02:00
frack113 44e45362d4 Update proc_creation_win_powershell_cmdline_specific_comb_methods.yml 2022-07-05 15:59:45 +02:00
frack113 46ef9e0c55 refractor condition 2022-07-05 13:51:00 +02:00
Nasreddine Bencherchali 22a17fbf64 Merge branch 'SigmaHQ:master' into master 2022-07-04 18:47:53 +01:00
Florian Roth dc16208fe3 Merge branch 'master' into rule-devel 2022-07-04 19:07:35 +02:00
Florian Roth 1694101893 fix: indentation 2022-07-04 17:09:53 +02:00
Florian Roth 86c3062b34 refactor: curl changes 2022-07-04 17:08:23 +02:00
Nasreddine Bencherchali 485bbd52a9 Update proc_creation_win_system_exe_anomaly.yml 2022-07-04 14:31:54 +01:00
Florian Roth 6238c6fd2c refactor: curl refactoring 2022-07-04 14:50:44 +02:00
Nasreddine Bencherchali f2cc5c8ce7 Add more processes 2022-07-04 13:38:18 +01:00
Florian Roth 5b2c38d05b refactor: curl rules refactored 2022-07-04 13:24:56 +02:00
Florian Roth 6fb1a22e77 regsvr rule extended 2022-07-04 12:39:31 +02:00
Nasreddine Bencherchali 75117927f0 Fix field name 2022-07-03 20:24:10 +01:00
Nasreddine Bencherchali 6eaafa7b92 Update proc_creation_win_uac_bypass_idiagnostic_profile.yml 2022-07-03 20:16:43 +01:00