security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,995 Commits 1 Branch 57 Tags
b19abdaeda7669c379bca72fa7ca8eada4677c5b
Commit Graph

8685 Commits

Author SHA1 Message Date
Nasreddine Bencherchali b19abdaeda fix: date position 2022-12-23 20:02:54 +01:00
Nasreddine Bencherchali 1f38e15bb4 fix: fp section 2022-12-23 19:24:08 +01:00
Nasreddine Bencherchali 28664d5bb3 feat: new aadinternals related rules 2022-12-23 19:16:17 +01:00
frack113 df015e555c Add more ref 2022-12-23 13:22:50 +01:00
frack113 546e53fb35 Apply suggestions from code review 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-12-23 12:34:56 +01:00
frack113 bee5b2f252 Issue 575 page 43 2022-12-23 11:10:17 +01:00
frack113 b200b5dedb Fix title 2022-12-23 10:58:11 +01:00
frack113 9617cdd4ea Issue 575 page 42 2022-12-23 10:50:34 +01:00
Nasreddine Bencherchali 03cc78e916 feat: filename test enhancements (#3812) 2022-12-23 09:25:16 +01:00
Nasreddine Bencherchali 3fc4390767 Merge pull request #3809 from qasimqlf/patch-18 
fix: updated targetUserName and ipAddress
 2022-12-22 15:16:52 +01:00
Florian Roth 9aa823fe3b Merge pull request #3810 from nasbench/nasbench-rule-devel 
feat: rule dev and updates
 2022-12-22 15:04:08 +01:00
Nasreddine Bencherchali e61795a1ea feat: proxynotshell owa variant rules 2022-12-22 12:10:29 +01:00
frack113 a9a0d6217d Merge pull request #3808 from veramine/patch-11 
Remove Logitech auto-updater false positive
 2022-12-22 10:37:45 +01:00
Nasreddine Bencherchali 653b498315 fix: update modified field 2022-12-22 10:31:25 +01:00
Qasim Qlf 29377ddfff fix: updated targetUserName and ipAddress 2022-12-22 14:16:25 +05:00
Veramine 5bdf52beae Remove Logitech auto-updater false positive 2022-12-21 23:49:14 -08:00
Veramine 3bb741af66 Remove Windows 10 volume control false positive 
https://superuser.com/questions/1175267/what-is-this-rundll32-instance-running
 2022-12-21 23:41:39 -08:00
sai prashanth pulisetti 3b6100ccd9 Create Possible Manipulation Of Tokens on a Windows computers remotely Detected via impersonate (#3803) 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-12-21 13:27:22 +01:00
Florian Roth f9d1eb1f2d Update proc_creation_win_renamed_office_processes.yml 2022-12-21 09:18:06 +01:00
Florian Roth 9372987801 fix: missing upper tick 
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
 2022-12-21 08:57:37 +01:00
Florian Roth 7e7cbe41c3 docs: change modified date 2022-12-21 08:57:05 +01:00
Nasreddine Bencherchali 4b6f5f143d feat: add more suspicious cases 
Co-authored-by: Florian Roth <venom14@gmail.com>
 2022-12-21 00:18:44 +01:00
Nasreddine Bencherchali 7c46e4c3c0 fix: fix #2479 2022-12-21 00:11:04 +01:00
Florian Roth 2580b84de3 fix: typo 2022-12-21 00:07:51 +01:00
Nasreddine Bencherchali beccf416da feat: add two new rules 2022-12-20 23:44:44 +01:00
Nasreddine Bencherchali 6679347fe3 fix: rename files to follow convention 2022-12-20 22:25:49 +01:00
Nasreddine Bencherchali 68f1ce8b9e Merge branch 'SigmaHQ:master' into nasbench-rule-devel 2022-12-20 22:24:56 +01:00
Nasreddine Bencherchali 7679d05706 fix: fp found in testing exchange server 2022-12-20 13:23:32 +01:00
Nasreddine Bencherchali 3f48eb4963 fix: selection name and add old path 2022-12-20 10:42:21 +01:00
Nasreddine Bencherchali de5345cfd2 fix: add permalink instead of master 2022-12-20 10:25:52 +01:00
Nasreddine Bencherchali 22761ec2c3 fix: add missing id 2022-12-20 10:25:03 +01:00
MetaOSINT ba52dc2aa8 T1539 Steal Web Session Cookie rules 
Update existing rule and add one new rule related to Steal Web Session Cookie technique (T1539)
 2022-12-19 23:20:13 -05:00
Nasreddine Bencherchali 05bdb9af74 fix: rename files to fit logic 2022-12-19 19:28:23 +01:00
Nasreddine Bencherchali ff94bfee2b fix: update description to fit logic 2022-12-19 19:23:11 +01:00
Nasreddine Bencherchali 9c308642c7 fix: apply suggestions from code review 
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
 2022-12-19 19:21:55 +01:00
Nasreddine Bencherchali c374413664 fix: change to permalink 2022-12-19 18:15:57 +01:00
Nasreddine Bencherchali 060174e2dd fix: small fixes 
- Added modified date
- Updated DLL sideload version
 2022-12-19 18:14:01 +01:00
pbssubhash 8a9f1ee273 Update file_event_win_wermgr_local_privilege_escalation.yml 2022-12-19 22:39:05 +05:30
pbssubhash ae974d8f15 Modifying existing rule instead of a new one 2022-12-19 22:35:36 +05:30
pbssubhash b763ddd7c7 Update file_event_win_dircreate2system_privesc.yml 2022-12-19 22:21:37 +05:30
pbssubhash 8d617d2587 Create file_event_win_dircreate2system_privesc.yml 2022-12-19 22:14:25 +05:30
Nasreddine Bencherchali ba3e985bed feat: multiple update and enhancements 2022-12-19 17:41:40 +01:00
Nasreddine Bencherchali 025c1a4aae fix: enhance logic and severity 2022-12-19 11:21:24 +01:00
Qasim Qlf 9318c05751 fix: modify the detection and condtion 2022-12-19 15:00:00 +05:00
frack113 646351808e Refractor (#3794) 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-12-18 21:00:14 +01:00
frack113 41d841ada2 Merge pull request #3793 from nasbench/nasbench-rule-devel 
feat: updates and enhancements
 2022-12-18 18:48:06 +01:00
Nasreddine Bencherchali 1882a4a0c2 fix: remove unnecessary definition 2022-12-18 15:24:58 +01:00
Nasreddine Bencherchali 3f6bcb6cee fix: fp found in testing 2022-12-18 15:07:47 +01:00
orenebahar 021499e6ef Update net_connection_win_malware_backconnect_ports.yml 
Add description about the right event ID in sysmon configuration
 2022-12-18 12:13:29 +00:00
Nasreddine Bencherchali a606223568 fix: add missing filename to the logic 2022-12-16 19:47:13 +01:00