security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,141 Commits 1 Branch 57 Tags
a2ca199e7d0e0063bccdbf5732b428aaf2bedb28
Commit Graph

1986 Commits

Author SHA1 Message Date
Trent Liffick a2ca199e7d added rules for Lazaurs and hhsgov 2020-06-03 17:38:03 -04:00
Florian Roth beb62dc163 fix: condition location 2020-05-15 12:06:34 +02:00
Florian Roth 28dc2a2267 Minor changes 
hints: 
- contains doesn't require wildcards in the strings
- we can use 'endswith' instead of wildcard at the beginning of the string (it's the new way to describe it, we have to change all old rules that contain these wildcards some day)
- we can use "1 of them" to say that 1 of the conditions has to match
 2020-05-15 11:33:36 +02:00
Trent Liffick 40ab1b7247 added 'action: global' 2020-05-14 23:33:08 -04:00
Trent Liffick 56a2747a70 Corrected missing condition 
learning! fail fast & forward
 2020-05-14 23:18:33 -04:00
Trent Liffick fb1d8d7a76 Corrected typo 2020-05-14 23:04:14 -04:00
Trent Liffick 8aff6b412e added rule for Blue Mockingbird (cryptominer) 2020-05-14 22:58:23 -04:00
Florian Roth 7652813c2c Merge pull request #752 from zaphodef/fix/win_susp_script_execution_false_negatives 
Widen the search as it gives too many false negatives
 2020-05-13 21:02:12 +02:00
zaphod 78a5c743f2 Widen the search as it gives too many false negatives 2020-05-13 16:20:23 +02:00
Florian Roth 78a8266a1b Merge pull request #749 from teddy-ROxPin/patch-6 
Create win_advanced_ip_scanner.yml
 2020-05-13 14:09:12 +02:00
Florian Roth 220a14f31c fix: typo in contains 2020-05-13 12:38:54 +02:00
Florian Roth a1856c5743 Update win_advanced_ip_scanner.yml 2020-05-13 11:56:25 +02:00
zaphod a9ef7ef382 Fix a bad CommandLine search 2020-05-13 11:32:05 +02:00
teddy_ROxPin bb17fd74ee Create win_advanced_ip_scanner.yml 
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
 2020-05-12 21:43:01 -06:00
Florian Roth 09d1b00459 Changed level to ciritcal 2020-05-11 10:40:23 +02:00
tliffick c98be55d21 Update mal_azorult_reg.yml 2020-05-08 21:31:33 -04:00
tliffick 61f061333b Registry entry for Azorult malware 
Detects registry keys used by Azorult malware
 2020-05-08 21:26:24 -04:00
Florian Roth fd7968d4f8 Merge pull request #734 from NVISO-BE/win_susp_failed_logon_source 
New rule: Failed Logon From Public IP
 2020-05-08 16:24:12 +02:00
Florian Roth 64a5ad0d07 Merge pull request #735 from nl5887/master 
fix incorrect use of action global
 2020-05-08 12:20:33 +02:00
Thomas Patzke 3b96b5e497 Merge pull request #723 from neu5ron/socprime_add_zeek_and_corelight 
sigmacs for Zeek and Corelight(Zeek)
 2020-05-06 23:22:14 +02:00
Remco Verhoef 2d38cb7b52 fix incorrect use of global 2020-05-06 23:00:45 +02:00
Remco Verhoef 40539a0c0e fix incorrect use of action global 2020-05-06 22:53:02 +02:00
Remco Hofman 123a23adae win_susp_failed_logon_source rule 2020-05-06 22:24:02 +02:00
Florian Roth 473c31232e add additional reference 2020-05-05 19:25:33 +02:00
Rettila 0e1fa5c135 Update win_possible_dc_shadow.yml 2020-05-05 18:14:32 +02:00
Rettila 55d018255c Update win_possible_dc_shadow.yml 2020-05-05 16:52:08 +02:00
Rettila 3302c63e0c Update and rename win_possible_dc_sync.yml to win_possible_dc_shadow.yml 2020-05-05 16:51:35 +02:00
Rettila f27aa4bfee Update win_possible_dc_sync.yml 2020-05-05 16:50:13 +02:00
Rettila db810b342f Delete win_possible_dc_shadow.yml 2020-05-05 16:48:39 +02:00
Rettila e3f21805f3 Update win_possible_dc_shadow.yml 2020-05-05 16:43:56 +02:00
Rettila 0f4cc9d365 Create win_possible_dc_shadow.yml 2020-05-05 16:40:52 +02:00
neu5ron a01a85cf9b CI/CD check fixes (missing ID's) 2020-05-04 15:22:18 -04:00
neu5ron a61b1da47a fixed yaml space causing condition to not be found 2020-05-04 15:17:43 -04:00
Florian Roth c71e10a7f3 Merge pull request #717 from Karneades/renamedbinary 
Add netsh to renamed binary rule
 2020-05-02 14:12:34 +02:00
Florian Roth b4b9b0155f Merge pull request #716 from Karneades/patch-1 
Add rule to detect wifi creds harvesting using netsh
 2020-05-02 14:12:10 +02:00
neu5ron d300027848 on behalf of @socprime [SOC Prime Inc.](https://my.socprime.com/en/tdm/) 
add rules for Zeek. This includes Windows Event Channel Security EventID:5145 that have same fields as Zeek SMB
Also, converted some of (MITRE ATT&CK BZAR)[https://github.com/mitre-attack/bzar] which are Zeek (sensor) scripts.
 2020-05-02 07:27:51 -04:00
neu5ron c66540c029 on behalf of @socprime [SOC Prime Inc.](https://my.socprime.com/en/tdm/) 
create `zeek` folder to store Zeek rules
 2020-05-02 07:25:21 -04:00
Maxime Thiebaut 4600bf73dc Update rules to follow the Sigma state specification 
The [Sigma specification's status component](https://github.com/Neo23x0/sigma/wiki/Specification#status-optional) states the following:

> Declares the status of the rule:
>  - stable: the rule is considered as stable and may be used in production systems or dashboards.
>  - test: an almost stable rule that possibly could require some fine tuning.
>  - experimental: an experimental rule that could lead to false results or be noisy, but could also identify interesting events.

However the Sigma Rx YAML specification states the following:

> ```yaml
> status:
>     type: //any
>     of:
>         - type: //str
>           value: stable
>         - type: //str
>           value: testing
>         - type: //str
>           value: experimental
> ```

The specification confuses the `test` and `testing` state. This commit changes the `test` state into the `testing` state which is already used in the code-base:
 - [`sigma/sigma-schema.rx.yml`](https://github.com/Neo23x0/sigma/blob/a805d18bbae60d3e4f291c8a18304104ed2e71c7/sigma-schema.rx.yml#L49)
 - [`sigma/tools/sigma/filter.py`](https://github.com/Neo23x0/sigma/blob/f3c60a63099f80296c8750aaba667e98ac71a4f7/tools/sigma/filter.py#L26)
 - [`sigma/tools/sigmac`](https://github.com/Neo23x0/sigma/blob/4e42bebb3480720966a59528cd8482c6271e603c/tools/sigmac#L98)

Although not modifyable through a PR, the specification should furthermore be updated to use the `testing` state.
 2020-04-24 20:50:31 +02:00
Andreas Hunkeler 7d437c2969 Add netsh to renamed binary rule 2020-04-20 17:12:25 +02:00
Andreas Hunkeler d4e9606266 Improve netsh wifi rule another time due to arg shortcut 2020-04-20 16:40:03 +02:00
Andreas Hunkeler af498d8a8c Improve rule to detect argument shortcut in netsh wlan rule 2020-04-20 16:32:25 +02:00
Andreas Hunkeler ba541c3952 Fix title for new netsh wifi rule 2020-04-20 16:20:45 +02:00
Andreas Hunkeler d9e5274c9e Add rule to detect wifi creds harvesting using netsh 2020-04-20 16:14:44 +02:00
Florian Roth 514bd8657b Merge pull request #704 from Iveco/master 
Detect Ghost-In-The-Logs (disabling/bypassing ETW)
 2020-04-14 14:11:27 +02:00
Florian Roth 2e0e170058 Merge pull request #708 from teddy-ROxPin/patch-4 
Create powershell_create_local_user.yml
 2020-04-14 14:11:15 +02:00
Florian Roth 3175a48bdc Casing 2020-04-14 13:40:34 +02:00
Florian Roth ecdec93800 Casing 2020-04-14 13:39:58 +02:00
Florian Roth 5cbe008350 Casing 2020-04-14 13:39:22 +02:00
Florian Roth 5ee0808619 Merge pull request #706 from vesche/update_win_susp_netsh_dll_persistence 
Update win_susp_netsh_dll_persistence.yml
 2020-04-14 13:37:53 +02:00
Florian Roth 4f469c0e39 Adjusted level 2020-04-14 13:37:10 +02:00