security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,086 Commits 1 Branch 57 Tags
8d9c11b26ef6bb370cc0a262cc579dfd2945fdb2
Commit Graph

10146 Commits

Author SHA1 Message Date
Florian Roth 8d9c11b26e Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel 2022-10-11 11:40:07 +02:00
Florian Roth 5ad51c4dea refactor: additional Rubeus indicators 2022-10-11 11:40:03 +02:00
Florian Roth 0df87d76f2 fix: duplicate, list with one entry 2022-10-10 22:49:34 +02:00
Florian Roth b2c012146e rules: pchunter, process hacker 2022-10-10 17:21:17 +02:00
Florian Roth 5da911eb84 Merge branch 'master' into rule-devel 2022-10-10 14:35:37 +02:00
Florian Roth 5cbd355d95 ZINC / Lazarus UAs 2022-10-10 12:23:09 +02:00
Florian Roth cb73e9725a Merge pull request #3570 from SigmaHQ/rule-devel 
IOX and NPS tunneling tools
 2022-10-10 00:26:48 +02:00
frack113 cf7a348028 Fix related 2022-10-09 17:28:05 +02:00
frack113 931fb30853 old experimental rule promotion 2022-10-09 16:54:04 +02:00
Florian Roth e009ba937e rule: NPS tunneling tool 2022-10-08 09:49:51 +02:00
Florian Roth deb5540816 rules: refactored FRP, new IOX 2022-10-08 09:32:36 +02:00
Florian Roth e2a172e257 Merge pull request #3569 from SigmaHQ/aurora-false-positive-fixing 
Aurora false positive fixing
 2022-10-07 22:52:24 +02:00
Florian Roth ee47f14dbe fix: more changes 2022-10-07 22:36:21 +02:00
Florian Roth c76b488941 fix: FPs during os upgrade 2022-10-07 22:31:13 +02:00
Florian Roth e9746e443e fix: FPs during upgrade 2022-10-07 22:22:59 +02:00
Florian Roth f2f481deba Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing 2022-10-07 22:13:49 +02:00
Florian Roth 4a298c56ce fix: FPs during Windows upgrade 2022-10-07 22:13:47 +02:00
Nasreddine Bencherchali adae180bc2 Update image_load_uipromptforcreds_dlls.yml 2022-10-07 16:49:02 +02:00
Nasreddine Bencherchali 8dbd03ff32 Fix FP In Testing 2022-10-07 13:26:33 +02:00
Florian Roth 5710507a2a Merge pull request #3567 from SigmaHQ/rule-devel 
rule: JuicyPotatoNG brute force indicator
 2022-10-07 11:36:26 +02:00
Florian Roth d36e0dffeb docs: adding comments for the params 2022-10-07 10:56:15 +02:00
Florian Roth d76bdf71df Update win_lpe_indicators_tabtip.yml 2022-10-07 10:48:52 +02:00
Florian Roth 6623778a61 fix: wrong log source 2022-10-07 10:44:35 +02:00
Florian Roth c073388472 rule: lpe - tabtip indicator 2022-10-07 10:41:04 +02:00
Florian Roth b634e1a3f9 Merge pull request #3562 from nasbench/pysigma-fix 
PySigma Issues Fix
 2022-10-07 09:21:15 +02:00
Florian Roth b75ef97876 Update web_exchange_proxyshell.yml 2022-10-07 08:48:01 +02:00
frack113 7539d29e8b Merge pull request #3559 from nasbench/nasbench-rule-devel 
Rule Dev
 2022-10-07 06:07:43 +02:00
nasreddine.bencherchali@nextron-systems.com 8f9c79b3a5 Update registry_set_powershell_in_run_keys.yml 2022-10-06 16:57:24 +02:00
Florian Roth d5e2991a4c Merge pull request #3551 from frack113/redcannary_20221002 
Redcannary rules
 2022-10-06 13:02:46 +02:00
nasreddine.bencherchali@nextron-systems.com 91cf9ce926 Fix modifier 2022-10-06 10:04:01 +02:00
Florian Roth 87b306834c Update web_cve_2022_36804_atlassian_bitbucket_command_injection.yml 2022-10-06 09:29:06 +02:00
Florian Roth 303fbd2e35 Update driver_load_vuln_drivers_names.yml 2022-10-06 09:28:43 +02:00
Florian Roth 8a0cf2e7e6 Update proc_creation_win_hh_chm_http.yml 2022-10-06 09:28:17 +02:00
Florian Roth 235b104495 Update registry_set_register_custom_protocol_handler.yml 2022-10-06 09:27:59 +02:00
Florian Roth c0ff746d99 change: make uppercase in Sysmon version 2022-10-06 09:27:26 +02:00
Florian Roth 84641cc955 Update registry_set_susp_user_shell_folders.yml 2022-10-06 09:25:13 +02:00
Florian Roth f0196039ba Update proc_creation_win_susp_logoff.yml 2022-10-06 09:24:15 +02:00
Florian Roth f1435ea16b Update proc_creation_win_susp_logoff.yml 2022-10-06 09:23:37 +02:00
Florian Roth 881dd0c6d0 Update proc_creation_win_pdq_deploy.yml 2022-10-06 09:22:44 +02:00
Florian Roth 15232621b1 refactor: another JuicyPotatoNG pattern 2022-10-06 08:47:23 +02:00
Florian Roth b6270dfcf0 Merge branch 'master' into rule-devel 2022-10-06 08:43:02 +02:00
Florian Roth d8c80d9193 docs: add ATT&CK technique id 2022-10-06 08:39:53 +02:00
Florian Roth 8419124990 docs: change modified date 2022-10-06 08:39:12 +02:00
Florian Roth a47ed32736 fix: unused selection in 23eee45e-933b-49f9-ae1b-df706d2d52ef 2022-10-06 08:38:40 +02:00
Florian Roth e92f2475b6 refactor: JuicyPotatoNG imphashes 2022-10-06 08:30:48 +02:00
frack113 32406c1915 Issue 3552 2022-10-06 06:50:54 +02:00
frack113 b1b7428a30 Merge pull request #3560 from redsand/fp_ec2_windows 
FP: ignore amazon aws ec2 scripts
 2022-10-06 06:41:22 +02:00
Nasreddine Bencherchali dadec8b9f0 Update incorrect mitre tags 2022-10-06 00:35:40 +02:00
Nasreddine Bencherchali 545d8170e6 Update proc_creation_lnx_sudo_cve_2019_14287.yml 2022-10-06 00:18:18 +02:00
Florian Roth adfb7d58e8 Merge pull request #3563 from SigmaHQ/rule-devel 
refactor: JuicyPotatoNG pattern
 2022-10-06 00:10:32 +02:00