security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,668 Commits 1 Branch 57 Tags
aacb5f767cdfd7f1fd2caa9a48ba95fc931ff1c7
Commit Graph

4832 Commits

Author SHA1 Message Date
Florian Roth 382d5b2adb Merge pull request #1674 from frack113/fix_small_errors 
Fix some typo error
 2021-07-12 15:23:55 +02:00
Florian Roth 682e0458a3 Merge pull request #1675 from frack113/redcanary_attack.t1562.001 
Atomic Red team T1562.001
 2021-07-12 15:23:35 +02:00
Florian Roth 677c53a262 Merge pull request #1676 from d4rk-d4nph3/master 
Added latest McAfee zloader's reference for Office Security Settings …
 2021-07-12 14:02:49 +02:00
Bhabesh Rai 1fc5ec981d Added latest McAfee zloader's reference for Office Security Settings Changed 2021-07-12 16:56:21 +05:45
frack113 a96678d725 test 21 to 24 from https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md 2021-07-12 10:54:44 +02:00
Florian Roth 7f071d7851 Merge pull request #1554 from mlp1515/master 
Update win_multiple_suspicious_cli.yml
 2021-07-12 10:43:26 +02:00
Thomas Patzke 0b83c12dd1 Merge branch 'devel-tp' 2021-07-12 10:21:19 +02:00
frack113 af140ebf84 fix some typo error 2021-07-12 09:40:18 +02:00
Thomas Patzke 176514bd7a New rule: suspicious spoolsv child process 2021-07-12 08:48:59 +02:00
Thomas Patzke 0b590aba5d Adjusted Spool Service DLL load rule 2021-07-11 09:29:43 +02:00
Thomas Patzke 6d41d538b2 Title fixed 2021-07-11 09:25:33 +02:00
Florian Roth 58a634b0b6 Merge branch 'master' into master 2021-07-11 00:32:55 +02:00
frack113 17edaa0950 combines 2 rules 2021-07-09 16:41:03 +02:00
Florian Roth aa0231e1f8 Merge pull request #1664 from frack113/parentofparent 
Move to rules-unsupported as use special enrichment field
 2021-07-09 10:55:22 +02:00
frack113 a53e21eb77 2 more rule with custom field 2021-07-09 10:07:41 +02:00
frack113 14322393f7 fix more invalid windows field name 2021-07-09 10:02:05 +02:00
frack113 06a05cfad9 Move to rules-unsupported as use special enrichment field 2021-07-09 07:40:57 +02:00
Florian Roth db8cc0ee2d Merge pull request #1656 from SigmaHQ/rule-devel 
rule: suspicious vss ps load / PrinternightMare updates
 2021-07-08 15:03:28 +02:00
Florian Roth ec13c691ce Merge pull request #1585 from BlackB0lt/patch-6 
Create aws_ec2_disable_encryption.yml
 2021-07-08 14:54:02 +02:00
Florian Roth c91eda7660 Merge pull request #1610 from cianmcgovern/powershell-network-connection 
Move ipv6 check to selection fields as filter is negated
 2021-07-08 14:53:36 +02:00
Florian Roth 0518439de7 Merge pull request #1648 from frack113/fix_windows_fields 
Fix more windows fields name
 2021-07-08 14:53:14 +02:00
Florian Roth f78b353352 PrinterNightmare rule updates 2021-07-08 14:35:51 +02:00
Florian Roth 2055f78780 refactor: make the rule more usable 2021-07-08 09:05:57 +02:00
Florian Roth 79338b2dbd fix: title 2021-07-08 08:33:46 +02:00
Thomas Patzke 8e010ec60c Added rule 
From https://www.binarydefense.com/analysis-of-hancitor-when-boring-begets-beacon
which weren't already covered by other rules and can be expressed
in Sigma.
 2021-07-08 07:59:40 +02:00
Thomas Patzke 103a8f8052 Removed EventID from generic DNS query rule 2021-07-08 07:41:11 +02:00
Florian Roth 96ea35fd92 rule: suspicious vss ps load 2021-07-07 18:21:57 +02:00
Florian Roth 25dec8a17b Merge pull request #1649 from leegengyu/patch-9 
Update win_apt_apt29_thinktanks.yml - Links
 2021-07-07 18:10:27 +02:00
Florian Roth 8fd5a761a2 Merge pull request #1651 from frack113/service_auditd 
Rename linux rule with service:auditd
 2021-07-07 18:10:14 +02:00
Florian Roth c3c152d457 Merge pull request #1652 from SigmaHQ/rule-devel 
refactor: changed cmdkey rule
 2021-07-07 18:09:44 +02:00
frack113 8a96aa7855 Add 2 defense-evasion T1562.001 rules 2021-07-07 15:43:55 +02:00
Florian Roth 0c7661e8bc refactor: changed cmdkey rule 2021-07-07 14:45:03 +02:00
G Y 1adac5b036 Update win_apt_apt29_thinktanks.yml - Links 
Reference links updated with grammar corrections.
 2021-07-07 20:21:41 +08:00
frack113 f2cdbb5aa7 Rename rule service:auditd 2021-07-07 13:53:51 +02:00
frack113 4e3b275056 Fix more windows fields name 2021-07-07 12:28:00 +02:00
Florian Roth 792f234872 Merge pull request #1636 from leegengyu/patch-6 
powershell_data_compressed.yml - Update selection
 2021-07-07 10:12:52 +02:00
Florian Roth 2e15742a37 Merge pull request #1637 from frack113/fix_win_rdp_reverse_tunnel.yml 
win_rdp_reverse_tunnel.yml  fix invalid field name
 2021-07-07 10:12:16 +02:00
Florian Roth 6e00745288 Merge pull request #1638 from frack113/fix_win_external_device.yml 
win_external_device.yml  fix invalid field name
 2021-07-07 10:12:04 +02:00
Florian Roth bd0628240c Merge pull request #1639 from frack113/fix_win_possible_dc_shadow.yml 
fix invalid field EventID 5136
 2021-07-07 10:11:51 +02:00
Florian Roth ad36a03622 Merge pull request #1640 from frack113/fix_win_susp_local_anon_logon_created.yml 
win_susp_local_anon_logon_created.yml fix invalid case SamAccountName
 2021-07-07 10:11:36 +02:00
Florian Roth 1c032c84be Merge pull request #1643 from austinsonger/microsoft365_impossible_travel 
Microsoft365 impossible travel
 2021-07-07 10:11:03 +02:00
Florian Roth dc2377be13 Merge pull request #1644 from leegengyu/patch-7 
Update win_admin_rdp_login.yml - Fix Field Name & Value
 2021-07-07 10:04:02 +02:00
Florian Roth 0573097696 Merge pull request #1645 from leegengyu/patch-8 
Update win_mal_service_installs.yml - Corrected logsource
 2021-07-07 10:03:48 +02:00
frack113 bb970de5b7 fix invalid fields name 2021-07-07 09:05:00 +02:00
mlp1515 aec9fac276 Update win_user_added_to_local_administrators.yml 2021-07-07 06:30:33 +00:00
mlp1515 29a6a2d5fb Merge branch 'SigmaHQ:master' into master 2021-07-07 08:25:04 +02:00
G Y 6b63a309da Update win_mal_service_installs.yml - Corrected logsource 
Fix mistake (incorrect logsource for event ID 4697) in #1629.
 2021-07-07 10:33:26 +08:00
G Y eece2850a7 Update win_admin_rdp_login.yml - Fix Field Name 
1. Field name changed to `TargetUserName`.
Source: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624

2. Value changed from `Admin-` to `Admin`.
 2021-07-07 09:43:55 +08:00
Austin Songer aac72668f4 Update microsoft365_impossible_travel_activity.yml 2021-07-06 16:59:28 -05:00
Austin Songer af3fd2fe8e Create microsoft365_impossible_travel_activity.yml 2021-07-06 16:55:54 -05:00