security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,702 Commits 1 Branch 57 Tags
7b3d2d4313b5615edd9000b7dfd5a531eee2c0bf
Commit Graph

7294 Commits

Author SHA1 Message Date
frack113 7b3d2d4313 Fix space 2022-01-16 15:12:50 +01:00
frack113 12f0d6dfab Windows Redcannary 2022-01-16 14:47:56 +01:00
frack113 2a6609a71d Merge pull request #2568 from frack113/windows_config 
Add windows-services.yml
 2022-01-16 14:44:42 +01:00
frack113 5890c1bb20 Fix logsource 2022-01-16 08:56:51 +01:00
frack113 65a268b0b3 Rename powershell_script 2022-01-15 10:54:21 +01:00
frack113 6badb13114 Rename powershell_module 2022-01-15 10:38:27 +01:00
frack113 5fd339858a Rename powershell_classic 2022-01-15 10:30:03 +01:00
SimoneCagol 2c964503e9 Update sysmon_raw_disk_access_using_illegitimate_tools.yml 2022-01-14 13:05:45 +01:00
Florian Roth 8608ce6396 Merge pull request #2559 from redsand/executable_invalid_extension 
Detects executable running with non executable extension
 2022-01-14 12:33:33 +01:00
Florian Roth 4d5e87258d Update win_run_executable_invalid_extension.yml 2022-01-14 11:47:46 +01:00
Florian Roth cb73718684 Merge branch 'master' into rule-devel 2022-01-14 10:16:56 +01:00
Florian Roth 14ccd6ca8c fix: FPs with rule that looks for executions of files other than .exe 
https://github.com/SigmaHQ/sigma/issues/2560
 2022-01-14 10:15:03 +01:00
frack113 f4c6871b50 Merge pull request #2554 from frack113/red_2022012 
Windows Redcannary
 2022-01-13 22:26:48 +01:00
Tim Shelton 4f6d433c2d Detects executable running with non executable extension, used for av bypass 2022-01-13 21:09:26 +00:00
Florian Roth 21b3e5c6fd Update win_pc_uninstall_sysmon.yml 2022-01-13 21:07:59 +01:00
Florian Roth c0bd1ef9bc Update sysmon_config_modification.yml 2022-01-13 21:07:11 +01:00
Florian Roth 5e20552e4e Merge pull request #2550 from phantinuss/master 
feat: check for the existence of a description field
 2022-01-13 21:05:16 +01:00
Florian Roth f27a8c96d1 Merge pull request #2556 from SigmaHQ/aurora-false-positive-fixing 
Aurora false positive fixing
 2022-01-13 21:04:22 +01:00
Florian Roth 61df73028b Merge pull request #2557 from frack113/registry_details 
Add setvalue for Details
 2022-01-13 21:04:00 +01:00
Florian Roth f9f5b1fe45 Merge pull request #2558 from SigmaHQ/rule-devel 
A few more rules
 2022-01-13 21:01:37 +01:00
Florian Roth 82f88f194f fix: FPs noticed with Aurora 2022-01-13 18:20:24 +01:00
frack113 943a89c265 Add setvalue for Details 2022-01-13 16:28:29 +01:00
Florian Roth 7f357c963b refactor: slightly improved rule 2022-01-13 13:09:08 +01:00
Florian Roth c4b370e528 Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing 2022-01-13 09:17:44 +01:00
Florian Roth 56097703f1 fix: FP detected with Aurora 2022-01-13 09:17:42 +01:00
frack113 baaef207cb Add filter help 2022-01-13 06:38:43 +01:00
Florian Roth 41f0ccbca5 fix: filter in rule 2022-01-12 22:28:21 +01:00
frack113 592485fac5 Windows Redcannary 2022-01-12 20:27:56 +01:00
Florian Roth 22338b762a fix: FPs with Java shell spawn rule 2022-01-12 16:35:24 +01:00
nwh2 460ed23249 Fix incorrectly formatted Winget LOLbin date 2022-01-12 14:44:55 +01:00
Florian Roth 11325856bf Merge pull request #2549 from d4rk-d4nph3/master 
Added two filters in Credentials Dumping Tools Accessing LSASS Memory
 2022-01-12 13:49:23 +01:00
phantinuss b6d4e39538 feat: check for the existence of a description field 
it is not mandatory in the sigma standard but
mandatory for this repository
 2022-01-12 12:55:49 +01:00
Florian Roth f77da595c4 fix: FPs noticed with Aurora 2022-01-12 11:32:34 +01:00
Florian Roth 09aaec8ed2 rules: ntds.dit write, minimized msedge 2022-01-12 11:32:12 +01:00
Bhabesh 6554556c14 Added two filters to reduce FP 2022-01-12 12:55:07 +05:45
frack113 d2dc2e3f27 Merge pull request #2545 from frack113/quote 
Simple Quote in detection
 2022-01-12 06:40:28 +01:00
frack113 b89fe3d0a6 Merge pull request #2548 from frack113/fix_selection 
Fix condition
 2022-01-11 21:46:16 +01:00
frack113 69297b5a28 Merge pull request #2547 from asalih/patch-2 
Update powershell_suspicious_invocation_specific_in_contextinfo.yml
 2022-01-11 21:42:54 +01:00
frack113 7b77be3453 Fix condition 2022-01-11 20:51:57 +01:00
Florian Roth 430f561321 Merge pull request #2542 from redsand/new_cscript_wscript_dropper_using_file_event 
New signature to detect cscript/wscript dropper using the sysmon file event
 2022-01-11 17:59:48 +01:00
Ahmet Salih 9b261a5cb7 Update powershell_suspicious_invocation_specific_in_contextinfo.yml 
close #2546
 2022-01-11 18:23:30 +03:00
Tim Shelton 0d553a832b updating condition per @frack113 preference 2022-01-11 14:59:47 +00:00
frack113 f7e670d55e Simple Quote 2022-01-11 13:40:53 +01:00
Florian Roth 11164849b3 Merge pull request #2543 from SigmaHQ/rule-devel 
Several new rules and some fixes
 2022-01-11 12:44:03 +01:00
Florian Roth e055ec1d52 refactor: change all " of them" expressions 2022-01-11 10:59:57 +01:00
Florian Roth fe754d1937 rule: regsvr32 pattern 2022-01-11 10:46:48 +01:00
Florian Roth 2d50f8d28a rule: several lolbins 2022-01-11 10:46:39 +01:00
Florian Roth de6a153e81 refactor: improved rule 2022-01-11 09:27:22 +01:00
Florian Roth 7eaa3f8d3f refactor: rewrite re rule to contains 2022-01-11 09:19:55 +01:00
Florian Roth 1fad4edfcb refactor: minor changes to procdump rule 2022-01-11 09:10:05 +01:00