security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,134 Commits 1 Branch 57 Tags
bde259619ec784bf2db2fdffc4b32495baae9c2c
Commit Graph

3409 Commits

Author SHA1 Message Date
frack113 f1eba85780 Add short name path 2022-08-07 08:37:58 +02:00
frack113 c38bfe86da Add short path and Image 2022-08-06 11:25:44 +02:00
frack113 7553a98be0 Merge pull request #3328 from frack113/legacy_short_name 
Add proc_creation_win_shortname_use.yml
 2022-08-06 07:41:12 +02:00
Florian Roth 8041ab5130 Merge pull request #3325 from nasbench/nasbench-rule-devel 
Update+New Rules
 2022-08-05 23:42:09 +02:00
Nasreddine Bencherchali b4472132a4 Fix after review 2022-08-05 18:40:12 +01:00
Nasreddine Bencherchali f704feaf69 New Rules 2022-08-05 17:11:42 +01:00
Nasreddine Bencherchali 9ef9103368 Update PowerShell + other rules 2022-08-05 17:10:41 +01:00
frack113 cb5c245a3a Add proc_creation_win_shortname_use.yml 2022-08-05 12:04:00 +02:00
Nasreddine Bencherchali d259f9400e Update 2022-08-05 10:18:07 +01:00
Florian Roth d5f7de1314 Merge pull request #3324 from SigmaHQ/rule-devel 
Suspicious IIS Registration, Plink refactoring, remove Github compromise rules
 2022-08-05 09:39:41 +02:00
Nasreddine Bencherchali 07e55593c3 Update some registry rules 2022-08-05 00:39:32 +01:00
Nasreddine Bencherchali 23052b8b19 Update proc_creation_win_susp_copy_system32.yml 2022-08-04 19:43:36 +01:00
Nasreddine Bencherchali 751fbd7a2e Update proc_creation_win_susp_calc.yml 2022-08-04 19:36:07 +01:00
Nasreddine Bencherchali be40827c9b Update proc_creation_win_susp_calc.yml 2022-08-04 19:28:28 +01:00
Nasreddine Bencherchali 307f9c6a35 New rules 2022-08-04 19:11:16 +01:00
Nasreddine Bencherchali d6a2c13738 Update rules (desc, selection, logic) 2022-08-04 18:08:08 +01:00
Florian Roth 7b6e92afca fix: attack tag 2022-08-04 18:51:44 +02:00
Nasreddine Bencherchali fe2e279cfa Add more comsvcs variations 
Based on this https://twitter.com/Wietze/status/1542107456507203586
 2022-08-04 16:18:51 +01:00
Nasreddine Bencherchali 6d66ed6267 Update description + Missing related field 2022-08-04 15:57:18 +01:00
Florian Roth 14dba5ba8b refactor: plink usage / tunneling 2022-08-04 16:54:15 +02:00
Florian Roth d535ff34b9 rule: Suspicious IIS module installation 2022-08-04 15:27:47 +02:00
Florian Roth d46d89e403 Merge pull request #3315 from nasbench/nasbench-rule-devel 
New Rules + Update
 2022-08-04 13:34:26 +02:00
Nasreddine Bencherchali 0e133f7d58 Additional updates 2022-08-04 11:53:09 +01:00
Nasreddine Bencherchali 83451b3e6d Update proc_creation_win_exfil_data_via_cli.yml 2022-08-04 10:58:56 +01:00
Nasreddine Bencherchali 8e08ff3060 Fix 2022-08-04 10:58:34 +01:00
Florian Roth 636602cf7c rule: additional rule using the obfuscated IPs 2022-08-04 08:59:04 +02:00
Nasreddine Bencherchali 521987eaa6 Create proc_creation_win_obfuscated_ip_via_cli.yml 2022-08-03 12:16:50 +01:00
Nasreddine Bencherchali 716ece8b4c Update proc_creation_win_exfil_data_via_cli.yml 2022-08-02 21:12:24 +01:00
Nasreddine Bencherchali d7d8a8fbc0 Fix typo 2022-08-02 21:06:52 +01:00
Nasreddine Bencherchali 37b97c4e66 New Rules 2022-08-02 21:05:07 +01:00
Nasreddine Bencherchali 845b5c1b5d Update 2022-08-02 21:04:03 +01:00
Florian Roth 87a0c9e1b9 Merge branch 'master' into master 2022-08-02 18:10:24 +02:00
isstabb baac2bd1f7 chore: fix case on author for consistency 2022-08-02 08:39:57 -04:00
frack113 b897015300 Merge pull request #3312 from nasbench/nasbench-rule-devel 
Update proc_creation_win_file_permission_modifications.yml
 2022-08-02 12:50:54 +02:00
Florian Roth ff6e50bc43 Merge pull request #3306 from nasbench/nasbench-rule-devel 
Update + New Rules
 2022-08-02 12:18:47 +02:00
Nasreddine Bencherchali 87ab157844 Update proc_creation_win_file_permission_modifications.yml 2022-08-02 11:17:27 +01:00
frack113 4ce8600749 Merge pull request #3310 from frack113/issue_3309 
Update option
 2022-08-02 09:46:46 +02:00
Florian Roth 46147bb4af Merge pull request #3303 from danielgottt/patch-3 
Create proc_creation_win_dnscmd_discovery.yml
 2022-08-02 09:35:53 +02:00
Florian Roth abc9aeb829 Update proc_creation_win_reg_delete_services.yml 2022-08-02 09:21:56 +02:00
Florian Roth 8399760902 Merge pull request #3307 from nasbench/webshell-children 
Update Children Of Web Shell Rules
 2022-08-02 09:12:00 +02:00
frack113 211bb6a760 Update option 2022-08-02 09:06:10 +02:00
G Y ebb753814b Update proc_creation_win_false_sysinternalsuite.yml 
Typo + grammatical correction in description field
 2022-08-02 11:19:14 +08:00
Nasreddine Bencherchali 7f1207957c Update proc_creation_win_sc_delete_av_services.yml 2022-08-01 23:39:08 +01:00
Nasreddine Bencherchali b984ee65b3 Update proc_creation_win_webshell_spawn.yml 2022-08-01 23:28:53 +01:00
Nasreddine Bencherchali 921af82587 Update proc_creation_win_reg_import_from_suspicious_paths.yml 2022-08-01 20:25:29 +01:00
Nasreddine Bencherchali 7a326e9b32 Create proc_creation_win_reg_import_from_suspicious_paths.yml 2022-08-01 20:12:40 +01:00
Nasreddine Bencherchali d62d3cc4e0 Update proc_creation_win_sc_delete_av_services.yml 2022-08-01 19:39:58 +01:00
Nasreddine Bencherchali cd7539d7e6 Create proc_creation_win_sc_delete_av_services.yml 2022-08-01 17:52:09 +01:00
Nasreddine Bencherchali 1764b51c0b Update + New Rules 2022-08-01 17:37:16 +01:00
Nasreddine Bencherchali 8d615c9d78 Update rules 2022-08-01 16:02:07 +01:00