security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
16,726 Commits 1 Branch 57 Tags
76f4a42ebb462a066f960d8a034a90fc7465e411
Commit Graph

12 Commits

Author SHA1 Message Date
Swachchhanda Shrawan Poudel 478120e7d2 Merge PR #5814 from @swachchhanda000 - Add New Credential Guard Tampering Rules
Goodlog Tests / check-baseline-win7 (push) Has been cancelled
Details
Goodlog Tests / check-baseline-win10 (push) Has been cancelled
Details
Goodlog Tests / check-baseline-win11 (push) Has been cancelled
Details
Goodlog Tests / check-baseline-win11-2023 (push) Has been cancelled
Details
Goodlog Tests / check-baseline-win2022 (push) Has been cancelled
Details
Goodlog Tests / check-baseline-win2022-domain-controller (push) Has been cancelled
Details
Goodlog Tests / check-baseline-win2022-0-20348-azure (push) Has been cancelled
Details
Regression Tests / true-positive-tests (push) Has been cancelled
Details
Create Release / Create Release (push) Has been cancelled
Details
Sigma Rule Tests / yamllint (push) Has been cancelled
Details
Validate Sigma rules / sigma-rules-validator (push) Has been cancelled
Details
Sigma Rule Tests / test-sigma-logsource (push) Has been cancelled
Details
Sigma Rule Tests / test-sigma-legacy (push) Has been cancelled
Details
Sigma Rule Tests / sigma-check (push) Has been cancelled
Details
Sigma Rule Tests / duplicate-id-check (push) Has been cancelled
Details 
new: Windows Credential Guard Registry Tampering Via CommandLine
new: Windows Credential Guard Related Registry Value Deleted - Registry
new: Windows Credential Guard Disabled - Registry
---------

Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
 2026-01-29 12:52:08 +01:00
Swachchhanda Shrawan Poudel c6a32d96cf Merge PR #5813 from @swachchhanda000 - Add New AMSI Tampering Rules 
new: Windows AMSI Related Registry Tampering Via CommandLine
new: AMSI Disabled via Registry Modification

---------

Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
 2026-01-29 12:38:48 +01:00
Swachchhanda Shrawan Poudel 2022e3b420 Merge PR #5802 from @swachchhanda000 - Update Bitsadmin Rules With Regresstion Data 
new: Legitimate Application Writing Files In Uncommon Location
update: Suspicious Download From File-Sharing Website Via Bitsadmin - add github URL
update: File Download Via Bitsadmin To A Suspicious Target Folder - add more susp locations
remove: File Download Via Bitsadmin To An Uncommon Target Folder - deprecate in favor of 2ddef153-167b-4e89-86b6-757a9e65dcac
chore: add regression tests for bitsadmin related rules

---------

Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
 2026-01-29 12:37:55 +01:00
Swachchhanda Shrawan Poudel e77233ab2f Merge PR #5824 from @swachchhanda000 - Update User Shell Folders Registry Modification Rules 
update: Direct Autorun Keys Modification - remove User Shell Folder registry modification
new: User Shell Folders Registry Modification via CommandLine
update: Modify User Shell Folders Startup Value - add new registry path, also add filtering of legit paths
 2026-01-29 12:23:46 +01:00
Swachchhanda Shrawan Poudel 3d8c650ba2 Merge PR #5811 from @swachchhanda000 - Add New Vulnerable Driver Blocklist and HVCI Tampering Based Rules 
new: Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine
new: Vulnerable Driver Blocklist Registry Tampering Via CommandLine
new: Windows Vulnerable Driver Blocklist Disabled
---------

Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
 2026-01-26 23:53:42 +01:00
Vladan Sekulic 092b852af3 Merge PR #5767 from @vl43den - Add Cmd Launched with Hidden Start Flags to Suspicious Targets 
new: Cmd Launched with Hidden Start Flags to Suspicious Targets

---------

Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
 2026-01-26 20:02:52 +01:00
Matt Anderson 30aebbb65c Merge PR #5834 from @MATTANDERS0N - Add Devcon and KDU Execution Rules 
new: PUA - Kernel Driver Utility (KDU) Execution
new: Devcon Execution Disabling VMware VMCI Device

---------

Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
 2026-01-24 12:36:29 +01:00
Swachchhanda Shrawan Poudel c8b1a0ff67 Merge PR #5805 from @swachchhanda000 - Add regression tests for curl-related rules 
update: Curl Web Request With Potential Custom User-Agent - add another curl supported flag for header
chore: add regression tests for curl-related rules
 2025-12-25 20:50:48 +05:45
Swachchhanda Shrawan Poudel c5b881019a Merge PR #5777 from @swachchhanda000 - feat: more edrfreeze rules 
new: WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze
new: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
new: Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
new: Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze
update: Hacktool - EDR-Freeze Execution - add more coverage
---------

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
 2025-12-10 15:29:38 +01:00
Swachchhanda Shrawan Poudel f05a8c4d94 Merge PR #5788 from @swachchhanda000 - Recon via RDP Logging Event 
update: Potentially Suspicious EventLog Recon Activity Using Log Query Utilities - add more interesting event ids

---------

Co-authored-by: Nasreddine Bencherchali <nasbench@users.noreply.github.com>
 2025-12-09 08:48:59 +05:45
Koifman 0aa29891df Merge PR #5782 from @Koifman - Add Github Self-Hosted Runner Execution 
new: Github Self-Hosted Runner Execution

---------

Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
 2025-12-04 00:55:53 +01:00
Swachchhanda Shrawan Poudel c141859b83 Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory 
chore: restructure regression testing data directory
 2025-11-26 11:08:11 +01:00