security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,432 Commits 1 Branch 57 Tags
be43ecd70db63098b7209f2e596ef68c4978ca74
Commit Graph

7432 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
frack113 be43ecd70d Remove empty element in list 
Otherwise get a `null` when convert to some backend (es-rule,...)
 2021-08-24 07:57:16 +02:00
neu5ron 9e588fdcf6 Zeek dce_rpc.log Detection of print driver installs over RPC (ie: possible PrintNightmare) using the three existing known RPC functions, as well as few others "discussed" but not directly related to PrintNightmare PoC or public post-compromise write-ups. 2021-08-24 00:58:36 -04:00
frack113 c6d55a3e13 Merge pull request #1909 from neu5ron/patch-8 
condition fix and add fields
 2021-08-23 21:31:06 +02:00
Nate Guagenti b255586117 condition fix and add fields 
should be `operation` not `endpoint` for the detection logic.
added various fields useful for investigation
 2021-08-23 14:59:06 -04:00
frack113 d89cebab55 Merge pull request #1907 from neu5ron/patch-6 
correct fields for zeek_rdp_public_listener.yml
 2021-08-23 20:58:01 +02:00
Nate Guagenti cfc32e5950 correct fields for zeek_rdp_public_listener.yml 
correct zeek fields for `fields` section.
improve false positives information
 2021-08-23 14:16:55 -04:00
frack113 a04fbe2a99 Merge pull request #1901 from frack113/redcanary 
Redcanary Powershell Suspicious Win32_PnPEntity T1120
 2021-08-23 19:44:16 +02:00
frack113 07c808d35c Merge pull request #1902 from neu5ron/patch-2 
Create zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml
 2021-08-23 19:43:58 +02:00
frack113 9d3a13b13e cleanup 2021-08-23 19:04:01 +02:00
frack113 be316db84d Merge pull request #1899 from secDre4mer/master 
feat: Add rule for malicious CSR export on Exchange
 2021-08-23 17:26:16 +02:00
Nate Guagenti 4f8bd4a5a2 Update zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml 
try new uuid to pass check...
 2021-08-23 11:24:22 -04:00
Nate Guagenti 6aea58b4d2 Update zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml 2021-08-23 11:18:51 -04:00
frack113 cac40065b0 Merge pull request #1900 from ZikyHD/add_fields 
Add fields to event log cleared
 2021-08-23 17:15:32 +02:00
Nate Guagenti 78c667fda1 Update zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml 
shorten title
 2021-08-23 11:15:30 -04:00
Nate Guagenti 96e77eb8db Create zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml 2021-08-23 11:06:44 -04:00
SomeOne 037f33b5e2 Replace by default windows fieldnames 2021-08-23 15:24:48 +02:00
SomeOne 45f30cb2b4 Add fields to event log cleared 2021-08-23 15:00:07 +02:00
frack113 25072e37b3 update references 2021-08-23 13:30:46 +02:00
frack113 33c6ff6b5f add powershell_suspicious_win32_pnpentity 2021-08-23 13:17:35 +02:00
Max Altgelt 82dde594d1 feat: Add rule for malicious CSR export on Exchange 2021-08-23 11:20:30 +02:00
frack113 52595de85e Merge pull request #1889 from rachelrice/update_aws_rules 
Update AWS CloudTrail rules
 2021-08-23 11:14:31 +02:00
frack113 8f29075129 Merge pull request #1897 from yugoslavskiy/master 
add ATC to the "Projects or Products that use Sigma" section
 2021-08-23 06:30:16 +02:00
Yugoslavskiy Daniil 9b30b487c3 add ATC to the Projects or Products that use Sigma section 2021-08-23 04:25:29 +02:00
frack113 fc9666fb4e Merge pull request #1896 from ZikyHD/fix_old_technics 
Replace old mitre techniques by new one
 2021-08-22 18:56:08 +02:00
frack113 0a410010a2 Merge pull request #1877 from frack113/red_back 
Add t1546 redcanary rules
 2021-08-22 18:50:58 +02:00
SomeOne 295054dcbe Replace old mitre techniques by new one 2021-08-22 13:57:56 +02:00
Thomas Patzke 3396d72d81 Merge pull request #1887 from frack113/fix_NodeSubexpression_len 
fix sigmac error "has no len()"
 2021-08-22 12:11:16 +02:00
Thomas Patzke cbf1fd213b Merge pull request #1856 from theoguidoux/sql-sqlite-fields-selection 
[Ready] SQL & SQLite rule fields selection
 2021-08-22 12:09:07 +02:00
Thomas Patzke b97a47c32a Merge pull request #1895 from frack113/fix_sigma2attack.py 
sigma2attack.py fix yaml error
 2021-08-22 12:05:54 +02:00
Thomas Patzke ac8cf2b2c7 Merge pull request #1783 from iChenLei/update-ci-badge 
chore: update sigma ci badge
 2021-08-22 12:05:23 +02:00
frack113 7cd71b2240 fix yaml error 2021-08-22 08:57:07 +02:00
frack113 b84b301add Merge pull request #1894 from austinsonger/master 
Update m365.yml
 2021-08-22 07:52:58 +02:00
Austin Songer 579a80411d Update m365.yml 2021-08-21 15:03:31 -05:00
Austin Songer 645492cef5 Update m365.yml 
just working on expanding this.
 2021-08-21 14:57:38 -05:00
frack113 064c65cb1f Merge pull request #1892 from frack113/clean_PS 
Powershell Cleanup
 2021-08-21 18:04:52 +02:00
frack113 07a87aa7f8 Merge pull request #1858 from frack113/fix_pr718 
Replace pr718
 2021-08-21 18:02:30 +02:00
frack113 16347e77e4 Merge pull request #1893 from pbssubhash/master 
Adding a rule to detect WriteHijack DLL exploitation by PowerUp
 2021-08-21 18:00:40 +02:00
frack113 a44206bfa0 Some cleanup 2021-08-21 17:33:39 +02:00
pbssubhash 7bcb6494b7 Merge branch 'master' of https://github.com/pbssubhash/sigma 2021-08-21 20:04:15 +05:30
pbssubhash eee497f656 Title modification 2021-08-21 20:04:03 +05:30
frack113 73c953d633 Fix title 2021-08-21 16:18:16 +02:00
pbssubhash a415463f5b Modified rule 2021-08-21 19:37:28 +05:30
pbssubhash fba54b8d69 First Rule commit 2021-08-21 17:47:56 +05:30
frack113 42c90b9d20 fix powershell_psattack error 2021-08-21 10:05:47 +02:00
frack113 2f683b9ab7 fix powershell_clear_powershell_history error 2021-08-21 10:00:48 +02:00
frack113 0fb6c35b1f Cleanup PS rules 2021-08-21 09:58:58 +02:00
frack113 da839775fe Update PS rules 2021-08-21 09:50:59 +02:00
frack113 6c529f7ab2 Update PS rules 2021-08-21 09:33:52 +02:00
frack113 cb95582077 Update PowerShell rule 2021-08-21 09:08:38 +02:00
frack113 dbbb422a42 Merge pull request #1885 from austinsonger/microsoft365_unusual_volume_of_file_deletion.yml 
microsoft365_unusual_volume_of_file_deletion.yml
 2021-08-20 17:20:43 +02:00