security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,557 Commits 1 Branch 57 Tags
bcf2bf2e4db218b30b546b4e499b6cd8ea82525e
Commit Graph

4761 Commits

Author SHA1 Message Date
Florian Roth bcf2bf2e4d Merge pull request #1635 from frack113/fix_win_susp_failed_logons_single_source_kerberos 
Fix invalid field name
 2021-07-06 14:35:06 +02:00
Florian Roth ff0f1a0222 Merge pull request #1633 from leegengyu/art_convert_yaml_to_md 
Convert ART reference links from .yaml to .md
 2021-07-06 13:39:37 +02:00
frack113 12fb71b83b fix invalid field name 2021-07-06 12:53:38 +02:00
leegengyu 1f19f79da9 Convert ART reference links from .yaml to .md 2021-07-06 17:56:38 +08:00
Florian Roth 705415c2bd Merge pull request #1632 from frack113/process_creation_OriginalFileName 
change OriginalFilename case
 2021-07-06 11:45:21 +02:00
leegengyu 3791ab4b12 Updated ART reference links from .yaml to .md 2021-07-06 17:43:20 +08:00
leegengyu 69d5d9734d Updated ART reference links from .yaml 2021-07-06 17:39:25 +08:00
leegengyu 5eb9547d5b Updated ART reference links from .yaml to .md and sub-technique links. 2021-07-06 17:30:57 +08:00
leegengyu 7557732ca2 Updated ART reference links from .yaml to .md and sub-technique links. 2021-07-06 17:21:22 +08:00
Florian Roth 8beb70e970 Merge pull request #1631 from leegengyu/patch-5 
Update mordordatasets links
 2021-07-06 10:45:15 +02:00
Florian Roth 223ae079ea Merge pull request #1627 from SigmaHQ/rule-devel 
rule: PrinterNightmare Mimikatz update
 2021-07-06 10:44:48 +02:00
Florian Roth e31f0c8f7f Merge pull request #1628 from d4rk-d4nph3/master 
Added and updated Defender's tamper related rules
 2021-07-06 10:44:33 +02:00
Florian Roth 17f7bbc063 Merge pull request #1630 from frack113/fix_childimage 
childimage do not exist in sysmon schema
 2021-07-06 10:44:00 +02:00
Florian Roth 86bd175bac Merge pull request #1629 from leegengyu/patch-4 
Update win_mal_service_installs.yml - Add service & event ID
 2021-07-06 10:43:33 +02:00
Florian Roth 229f49f24a Merge pull request #1581 from BlackB0lt/patch-5 
Create aws_securityhub_disable_finding.yml
 2021-07-06 10:42:59 +02:00
leegengyu 5d10cc68da Update mordordatasets references 2021-07-06 16:35:20 +08:00
G Y 7f15b0a075 Update win_smb_file_creation_admin_shares.yml - Dead link 
Updated dead link.
 2021-07-06 16:24:02 +08:00
frack113 cfccdea28e change OriginalFilename case 2021-07-06 10:09:47 +02:00
G Y aab65361da Update rules/windows/builtin/win_mal_service_installs.yml 
Add modified date.

Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
 2021-07-06 00:50:23 -07:00
frack113 9c94cf42fe childimage do not exist in sysmon schema 2021-07-06 09:26:43 +02:00
G Y a0407cf477 Update win_mal_service_installs.yml - Add new Event ID 
Added event ID 4697, which is equivalent to existing event ID 7045.
 2021-07-06 12:11:32 +08:00
G Y c01ec60e7d Update win_mal_service_installs.yml - Add new service 
Add new malicious service (javamtsup) by APT29 and add reference links.
 2021-07-06 11:03:08 +08:00
Bhabesh Rai 3bc6532049 Added and updated Defender's tamper related rules 2021-07-05 20:30:07 +05:45
Florian Roth e5849a08f1 rule: PrinterNightmare Mimikatz update 
https://github.com/gentilkiwi/mimikatz/commit/51dc7c0363d4e1e1eb2d35f5d5a25841b0801861#diff-cf4373b6c7195386ac1973681e5561bd96e1bb9e099cfd3febd1111e986bd17cL1450-R1451
 2021-07-05 15:29:52 +02:00
Florian Roth 4b487f49fc Merge pull request #1624 from frack113/fix_pr_869 
Fix PR 869
 2021-07-05 15:26:50 +02:00
Florian Roth 0da297dbef Merge pull request #1626 from frack113/description_is_null 
fix missing description
 2021-07-05 15:26:31 +02:00
Florian Roth 8069b53e5e Merge pull request #1625 from SigmaHQ/rule-devel 
Kaseya patterns, PrinterNightmare Mimikatz update
 2021-07-05 13:29:23 +02:00
frack113 0245d58065 fix missing description 2021-07-05 12:56:05 +02:00
Florian Roth 6c4f36c473 fix: minor typo - no \ at the end of the expression 2021-07-05 12:05:57 +02:00
Florian Roth 7e9d6600eb rule: PrinterNightmare - new mimikatz printer name 2021-07-05 12:03:56 +02:00
Florian Roth 7fab22ddc2 rule: more Kaseya patterns 2021-07-05 12:03:35 +02:00
frack113 d05f3efd1b fix pr 869 2021-07-04 19:44:50 +02:00
Florian Roth d101c9893a Merge pull request #1623 from SigmaHQ/rule-devel 
rule: mimikatz printernightmare
 2021-07-04 14:28:44 +02:00
Florian Roth 1e152bf594 Merge pull request #1615 from leegengyu/patch-1 
Update powershell_data_compressed.yml - Outdated link
 2021-07-04 14:19:55 +02:00
Florian Roth 062198550d Merge pull request #1620 from leegengyu/patch-2 
Update win_susp_sdelete.yml - Outdated Link and Typo
 2021-07-04 14:19:31 +02:00
Florian Roth fd5b7506d1 refactor: changed rule contents, removed eventIDs 2021-07-04 14:03:28 +02:00
Florian Roth 62b25cadf1 rule: mimikatz printernightmare 2021-07-04 13:47:56 +02:00
G Y a60a2feb17 Update sysmon_susp_pfx_file_creation.yml 
Fixed typo.
 2021-07-04 10:38:53 +08:00
G Y 268c97f23a Update win_susp_sdelete.yml 
Update old links and typo.
 2021-07-04 09:53:23 +08:00
G Y c63439e74d Update powershell_data_compressed.yml 
Changed reference link from `.yaml` to `.md`.
 2021-07-04 08:15:29 +08:00
Florian Roth a02b7a2390 Merge pull request #1617 from SigmaHQ/rule-devel 
rule: REvil Kaseya patterns
 2021-07-03 17:32:18 +02:00
Florian Roth d188932748 Merge pull request #1616 from frack113/update_win_renamed_powershell.yml 
Tune detection in win_renamed_powershell.yml
 2021-07-03 17:04:52 +02:00
Florian Roth 48621d68ff Merge pull request #1613 from leegengyu/powershell_powerview_malicious_commandlets_additions 
Update powershell_powerview_malicious_commandlets.yml - Addition and Miscellaneous
 2021-07-03 17:04:29 +02:00
Florian Roth 1d82ac50e4 refactor: additional pattern, extended description 2021-07-03 17:03:40 +02:00
Florian Roth 57b816f49d rule: REvil Kaseya patterns 2021-07-03 16:34:02 +02:00
frack113 02100f1a3c Tune detection in win_renamed_powershell.yml 2021-07-03 15:18:01 +02:00
G Y d247766a2e Update powershell_data_compressed.yml 
Corrected old link and formatting.
 2021-07-03 20:48:03 +08:00
Florian Roth e7144b34ee fix: bug in syntax 2021-07-03 13:19:56 +02:00
Florian Roth 2d0cdc16fc added modified date 2021-07-03 13:19:14 +02:00
Florian Roth e41759cfb3 Merge pull request #1607 from austinsonger/printernightmare 
PrinterNightmare CVE-2021-34527 Exploit Detection- Fixed Spell Error
 2021-07-03 13:16:52 +02:00