security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,416 Commits 1 Branch 57 Tags
61ebaf157ee3adceb4c8bd5235ed032cd461cf3c
Commit Graph

6416 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Sittikorn S 61ebaf157e Update web_cve_2021_22893_pulse_secure_rce_exploit.yml 2021-06-29 15:19:40 +07:00
Sittikorn S 14d1c68cc8 Update web_cve_2021_22893_pulse_secure_rce_exploit.yml 2021-06-29 15:19:22 +07:00
Sittikorn S 67f483e6a9 Update web_cve_2021_22893_pulse_secure_rce_exploit.yml 2021-06-29 14:17:27 +07:00
Sittikorn S c446c519cf Update web_cve_2021_22893_pulse_secure_rce_exploit.yml 2021-06-29 13:59:08 +07:00
Sittikorn S f3c1d78615 Create web_cve_2021_22893_pulse_secure_rce_exploit.yml 2021-06-29 13:56:30 +07:00
Florian Roth b02741cfe0 Merge pull request #1583 from Karneades/Karneades-patch-1 
Add Synergy as possible FP for PortProxy key
 2021-06-28 13:52:05 +02:00
Andreas Hunkeler 756b8eed26 Add Synergy as possible FP for PortProxy key 2021-06-28 12:10:16 +02:00
Florian Roth f4ac416ef4 Merge pull request #1582 from SigmaHQ/rule-devel 
Rule devel
 2021-06-28 11:36:21 +02:00
Florian Roth d1f1e8e7c4 rule: reg add run key 2021-06-28 09:39:12 +02:00
Florian Roth ab0502f893 refactor: add wscript.exe to mshta rule 2021-06-28 09:39:04 +02:00
Florian Roth d48009748f rule: mshta shell spawn 2021-06-28 09:32:28 +02:00
Florian Roth e7d9f1b427 Merge pull request #1577 from austinsonger/master 
Update win_susp_disable_eventlog.yml
 2021-06-28 08:46:17 +02:00
Florian Roth 736cd404de Merge pull request #1578 from wagga40/master 
Updated rules with modifiers instead of '*', removed trailing '\\', removed drive letter before "Users"
 2021-06-28 08:45:22 +02:00
Austin Songer 8e6ab7fd79 Update win_susp_disable_eventlog.yml 2021-06-28 00:59:53 -05:00
Austin Songer bfe969f071 Update win_susp_disable_eventlog.yml 2021-06-28 00:53:52 -05:00
Austin Songer d1fba0e1a5 Update win_susp_disable_eventlog.yml 2021-06-27 20:26:44 -05:00
wagga40 d6afa46e68 Added missing "modified" fields. Removed trailing wildcard. 2021-06-27 17:36:32 +02:00
wagga40 d6c430408f Removed duplicate field 2021-06-27 15:54:26 +02:00
wagga40 3f0dd2417b Removed Drive letter before "Users" directory 2021-06-27 15:32:46 +02:00
wagga40 11df697cdc Updated rules with modifiers instead of '*' and remove trailing '\\' 2021-06-27 14:51:29 +02:00
Austin Songer f1d937cbd6 Update win_susp_disable_eventlog.yml 2021-06-26 12:22:54 -05:00
Austin Songer de6fac1d18 Update win_susp_disable_eventlog.yml 2021-06-26 03:15:05 -05:00
Florian Roth abe353de66 Merge pull request #1561 from frack113/es_rule_add_more_tag 
add multi custom tag for issue #1560
 2021-06-25 12:25:28 +02:00
Florian Roth 2ad6401487 Merge pull request #1565 from SpeedyFireCyclone/powershell_fieldmappings 
Generic remapping for PowerShell backend
 2021-06-25 12:21:00 +02:00
Florian Roth 6c3f94fb72 Merge pull request #1572 from adeemm/ldap-recon 
Add rule to detect AD enumeration
 2021-06-25 12:18:26 +02:00
Florian Roth 685bd490f5 Merge pull request #1573 from d4rk-d4nph3/master 
Added rule for default cobalt strike certificate
 2021-06-25 12:16:31 +02:00
Florian Roth c90e31275d Merge pull request #1576 from CriimBow/patch-1 
Typo on Find-DomainObjectPropertyOutlier
 2021-06-25 12:15:59 +02:00
Florian Roth 537d89d185 Merge pull request #1575 from SigmaHQ/rule-devel 
rules: PurpleSharp, WMIC ActiveScriptEventConsumer
 2021-06-25 12:15:35 +02:00
CriimBow 188b847670 Typo on Find-DomainObjectPropertyOutlier 2021-06-25 10:35:33 +02:00
Florian Roth 7b6208c05c rules: PurpleSharp, WMIC ActiveScriptEventConsumer 2021-06-25 09:56:42 +02:00
Bhabesh Rai 91cc97d099 Fixed the taxonomy 2021-06-24 21:07:52 +05:45
Florian Roth a710041350 Merge pull request #1574 from Karneades/fpPortProxy 
Add false positive note to PortProxy rules
 2021-06-24 16:56:35 +02:00
Andreas Hunkeler 3de0679d5a Add fp note to PortProxy rules 2021-06-24 11:22:41 +02:00
Andreas Hunkeler 366d83ab44 Add fp note to PortProxy rules 2021-06-24 11:21:29 +02:00
Florian Roth d05e33eb48 Merge pull request #1571 from BlackB0lt/patch-4 
Create win_renamed_meg.yml
 2021-06-23 16:28:38 +02:00
Florian Roth 1dd557e543 fix: global action unneeded 2021-06-23 09:23:08 +02:00
Bhabesh Rai 1ebbc6c1a3 Added rule for default cobalt strike certificate 2021-06-23 10:17:27 +05:45
Sittikorn S c0724e533f Update and rename win_renamed_meg.yml to win_renamed_megasync.yml 2021-06-23 09:24:42 +07:00
Sittikorn S 16bafc835a Update win_renamed_meg.yml 2021-06-23 08:55:37 +07:00
Sittikorn S a310806dbf Update win_renamed_meg.yml 2021-06-23 08:35:12 +07:00
Adeem Mawani 8077dedbc5 Add rule to detect AD enumeration 2021-06-22 15:57:49 -04:00
Sittikorn S 10488512ae Update win_renamed_meg.yml 2021-06-22 22:27:34 +07:00
Sittikorn S 177442d6df Update win_renamed_meg.yml 2021-06-22 22:20:49 +07:00
Sittikorn S 6328ce8ef6 Update win_renamed_meg.yml 2021-06-22 22:17:51 +07:00
Sittikorn S f55cd9ed1b Update win_renamed_meg.yml 2021-06-22 22:03:56 +07:00
Sittikorn S 268a4c31e3 Update win_renamed_meg.yml 
Change mitre tags T1218.001 to T1218
 2021-06-22 22:00:35 +07:00
Sittikorn S e6d08d0ad6 Update win_renamed_meg.yml 2021-06-22 21:55:09 +07:00
Sittikorn S a08b6c4e0a Create win_renamed_meg.yml 2021-06-22 21:50:07 +07:00
Florian Roth 7e748fa91a Merge pull request #1567 from BlackB0lt/patch-2 
Create win_script_event_consumer_spawn new rule
 2021-06-22 12:43:34 +02:00
Thomas Patzke befdcda507 Merge pull request #1566 from eocete-devo/master 
New backend for Devo queries
 2021-06-22 12:23:36 +02:00