security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,589 Commits 1 Branch 57 Tags
87879f69cfdfa1e759c69cda797c8dfd4c8bb2dd
Commit Graph

248 Commits

Author SHA1 Message Date
Mark Morowczynski b24e6d197b Update tags for MITRE ATT&CK 
Update tags for MITRE ATT&CK
 2023-01-29 11:29:12 -08:00
Mark Morowczynski 29ca26b32c Updating MITRE Tactics & Techniques 
Updating MITRE Tactics & Techniques to align with existing classifications
 2023-01-28 13:26:15 -08:00
frack113 1033b3f404 change status to test 2023-01-27 06:48:34 +01:00
TheLawsOfChaos 8607588a13 11 Files with updates Tactics/techniques/sub-techs (#3904) 2023-01-11 06:30:46 +01:00
frack113 0c3ba418db Merge pull request #3898 from cyb3rjy0t/patch-2 
New rule
 2023-01-10 20:47:48 +01:00
frack113 8e7187e861 Rename azure_ad_risky_sign_ins_with_singlefactorauthencation_from_unknown_devices.yml to azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml 2023-01-10 20:37:56 +01:00
Nasreddine Bencherchali 2820210945 fix: broken title 2023-01-10 19:43:19 +01:00
frack113 4023bf2c83 Remove mitre url 2023-01-10 18:09:04 +01:00
frack113 a6116a5fdc Merge pull request #3894 from TheLawsOfChaos/patch-5 
Update azure_device_or_configuration_modified_or_deleted.yml
 2023-01-10 17:49:12 +01:00
Nasreddine Bencherchali 23278ead62 Merge pull request #3893 from TheLawsOfChaos/patch-4 
Update azure_dns_zone_modified_or_deleted.yml
 2023-01-10 13:50:11 +01:00
Nasreddine Bencherchali 82c2b635a9 fix: yaml syntax 2023-01-10 00:49:44 +01:00
Nasreddine Bencherchali 3b149675b2 Merge pull request #3896 from TheLawsOfChaos/patch-7 
Patch 7
 2023-01-10 00:45:38 +01:00
cyb3rjy0t 907252c00f New rule 
Detecting risky user sign from non AD registered device with single factor authenciation
 2023-01-09 17:07:39 -05:00
Nasreddine Bencherchali 032db9f799 Merge pull request #3897 from TheLawsOfChaos/patch-8 
Update azure_firewall_modified_or_deleted.yml
 2023-01-09 22:39:41 +01:00
Nasreddine Bencherchali f0505a7a22 fix: remove mitre links from ref section 2023-01-09 22:34:13 +01:00
Nasreddine Bencherchali e237aec830 Merge pull request #3895 from TheLawsOfChaos/patch-6 
Update azure_creating_number_of_resources_detection.yml
 2023-01-09 22:33:30 +01:00
Nasreddine Bencherchali 3ec4c3e98b fix: apply suggestions from code review 2023-01-09 22:23:19 +01:00
Nasreddine Bencherchali c8cbdefba5 fix: remove unnecessary spaces 2023-01-09 22:22:40 +01:00
Nasreddine Bencherchali b728332228 fix: remove mitre link from the reference section 2023-01-09 22:21:46 +01:00
Nasreddine Bencherchali 0e06d9e9b9 fix: remove mitre link from the reference section 2023-01-09 22:21:21 +01:00
Nasreddine Bencherchali a3cee700af fix: add missing "t" to mitre tag 2023-01-09 22:20:48 +01:00
Nasreddine Bencherchali 0f75a1d361 fix: remove mitre reference link 2023-01-09 22:19:57 +01:00
TheLawsOfChaos 8caf115e33 Update azure_firewall_modified_or_deleted.yml 
Added sub-tech reference, new tactic, and sub-tech.
 2023-01-09 16:09:18 -05:00
TheLawsOfChaos e97efe445c Update azure_change_to_authentication_method.yml 2023-01-09 15:46:05 -05:00
TheLawsOfChaos 42875d2bba Update azure_change_to_authentication_method.yml 
Updated description, added two tactics and one technique, and added technique reference.
 2023-01-09 15:43:07 -05:00
TheLawsOfChaos 1c0c29f45f Update azure_creating_number_of_resources_detection.yml 
Added tactic and MITRE reference for technique.
 2023-01-09 15:35:00 -05:00
TheLawsOfChaos 57a23e0b41 Update azure_device_or_configuration_modified_or_deleted.yml 
Added technique and sub-tech, along with references.
 2023-01-09 15:32:02 -05:00
TheLawsOfChaos a7208e7f69 Update azure_dns_zone_modified_or_deleted.yml 
Added sub-tech and reference to the page. Didn't modify the date per earlier discussion.
 2023-01-09 15:27:15 -05:00
Nasreddine Bencherchali 8956242b43 fix: rollback modified date 2023-01-09 21:14:42 +01:00
TheLawsOfChaos 8aac18a554 Update azure_application_deleted.yml 
Updated modified date.
 2023-01-09 15:06:39 -05:00
TheLawsOfChaos a992ed6372 Update azure_application_deleted.yml 
Added Tactic impact and t1489. 
https://attack.mitre.org/tactics/TA0040/
https://attack.mitre.org/techniques/T1489

Deleting an application absolutely is part of Impact, and Stop/Disable a service if that application was running it.
 2023-01-09 14:58:16 -05:00
TheLawsOfChaos ea26adb55a Update azure_ad_only_single_factor_auth_required.yml 
.004 is for valid cloud accounts
 2023-01-09 14:00:09 -05:00
frack113 7d5fb8db30 update logsource 2023-01-04 19:36:37 +01:00
frack113 756a248032 update logsource 2023-01-04 18:52:24 +01:00
frack113 7060db3d47 Promotion rules (#3821) 
* Promotion rules

* fix missing null

* fix: modified date

Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-12-27 12:29:10 +01:00
frack113 646351808e Refractor (#3794) 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-12-18 21:00:14 +01:00
BlueTeamOps 47b5272fcd Create azure_ad_azurehound_discovery.yml (#3762) 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-12-08 20:21:02 +01:00
frack113 556dd8f400 Order yaml field 2022-10-25 07:34:10 +02:00
frack113 931fb30853 old experimental rule promotion 2022-10-09 16:54:04 +02:00
Nasreddine Bencherchali 88f10a5d39 Fix issues 2022-10-05 17:19:48 +02:00
Nasreddine Bencherchali 18e43cff02 Fix valid accounts tag 2022-10-05 17:18:01 +02:00
David ANDRE 0b0190ccb1 Added quotes to strings 2022-09-01 15:22:26 +02:00
Wagga 4573ab0a21 Fix a lot of typos in rules text and comments #Part 3 (#3446) 2022-08-30 08:21:25 +02:00
Ben Montour 59394d2309 bad sort on subfields startswith/endswith 2022-08-23 14:35:48 -05:00
Ben Montour 6aabfaba4f added modified field with current date 2022-08-23 14:32:10 -05:00
Ben Montour f733105daa renamed properties.message to operationName 2022-08-23 14:20:26 -05:00
Tim Shelton 9ddf0ce735 spelling mistake 2022-08-18 15:51:43 +00:00
Tim Shelton 65db776a9b Fixing spelling mistake. same as found the other day 2022-08-18 15:49:23 +00:00
frack113 288461ddbe Order placerholder rules 2022-08-17 21:05:34 +02:00
Mark Morowczynski 7a5d715d83 Last remaining AAD SecOps Guide rules (#3364) 
* Last remaining AAD SecOps Guide rules
 2022-08-17 20:57:58 +02:00