security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,160 Commits 1 Branch 57 Tags
c2e5ca2f128b570a7cc57524fb350f38c19fd85e
Commit Graph

11160 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
frack113 c2e5ca2f12 Merge pull request #3056 from maximelb/OriginalFilename-case 
Support alternate case for OriginalFileName.
 2022-05-30 06:51:08 +02:00
frack113 6e41ecdaaf Merge pull request #3059 from c3rb3ru5d3d53c/patch-1 
Follina — a Microsoft Office code execution vulnerability
 2022-05-30 06:50:53 +02:00
frack113 9f64bf26a9 Merge pull request #3058 from nasbench/master 
Create proc_creation_win_msdt.yml
 2022-05-30 06:48:00 +02:00
frack113 18dc60858a Fix selection1 2022-05-30 06:44:45 +02:00
c3rb3ru5 7cd648a1ed Update proc_creation_win_lolbins_by_office_applications.yml 
https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
 2022-05-29 21:28:35 -03:00
Nasreddine Bencherchali e9d18b5075 Create proc_creation_win_msdt.yml 2022-05-29 12:53:45 +01:00
Maxime Lamothe-Brassard 3fdaf8b9f1 Support alternate case for OriginalFileName. 2022-05-27 11:01:22 -07:00
frack113 ff6c54ded6 Merge pull request #3044 from redsand/fp_file_event_win_webshell_creation 
FP: System image (driver) restoring files. Valid behavior
 2022-05-27 15:11:58 +02:00
frack113 9c0e7cf3e8 Merge pull request #3049 from MarkMorow/markmorow 
Create azure_app_credential_added.yml
 2022-05-27 07:01:39 +02:00
frack113 61ee06897a Merge pull request #3054 from redsand/fp_proc_creation_ibm_desktop 
FP: IBM ClientSolutions is valid directory
 2022-05-27 07:00:01 +02:00
frack113 dc6640678a Merge pull request #3053 from redsand/fp_net_connection_from_desktop_ibm 
Fp net connection from desktop ibm
 2022-05-27 06:58:45 +02:00
frack113 b9f1b17f0c Merge pull request #3050 from redsand/fp_posh_ps_malicious_commandlets 
Fp posh ps malicious commandlets
 2022-05-27 06:58:03 +02:00
frack113 32e6a82cf2 Update azure_app_credential_added.yml 2022-05-27 06:56:07 +02:00
Mark Morowczynski 4f044ea760 Merge branch 'SigmaHQ:master' into markmorow 2022-05-26 12:38:05 -07:00
Mark Morowczynski 5229c05cab Update azure_app_credential_added.yml 
Changes based on Sigma template rules
 2022-05-26 12:36:38 -07:00
Tim Shelton b1cbac0ae3 Adjusting condition 2022-05-26 18:39:22 +00:00
Tim Shelton 5e2e776bce Adjusting condition 2022-05-26 18:38:12 +00:00
Tim Shelton b35cb0d315 Merge branch 'master' of https://github.com/redsand/sigma into fp_file_event_win_webshell_creation 2022-05-26 18:31:37 +00:00
Tim Shelton a3853ac6a7 Merge branch 'master' of https://github.com/redsand/sigma into fp_net_connection_from_desktop_ibm 2022-05-26 18:30:48 +00:00
Tim Shelton ffe059a9d5 Merge branch 'master' of https://github.com/redsand/sigma into fp_posh_ps_malicious_commandlets 2022-05-26 18:29:59 +00:00
Tim Shelton 72e090b8c1 Merge branch 'master' of https://github.com/redsand/sigma into fp_proc_creation_ibm_desktop 2022-05-26 18:28:25 +00:00
Tim Shelton 48e37241dd FP: IBM ClientSolutions is valid directory 2022-05-26 18:25:43 +00:00
Tim Shelton 8ac66efd73 updating modified 2022-05-26 18:17:40 +00:00
Tim Shelton 13d68d9671 False positive on IBM Client Solutions 2022-05-26 18:16:55 +00:00
frack113 dbcb0164ab Merge pull request #3051 from frack113/mittre 
Mitre tag change
 2022-05-26 18:52:41 +02:00
Mark Morowczynski 8f9998d804 Merge branch 'SigmaHQ:master' into markmorow 2022-05-26 09:41:17 -07:00
frack113 b9a0c7e437 Mitre Update 2022-05-26 18:39:42 +02:00
Mark Morowczynski 97efeada5f Update .gitignore 2022-05-26 09:39:00 -07:00
frack113 195be1b3d8 Merge pull request #3047 from redsand/feat_tool_to_generate_diff 
Feat. adds helper script to run sigmac against only those rules that …
 2022-05-26 18:29:15 +02:00
Tim Shelton c1ef20761a Fixing condition 2022-05-26 16:14:37 +00:00
Tim Shelton 9086efa5cd Updating meta 2022-05-26 16:13:22 +00:00
Tim Shelton 295a984d89 Fixing order of items in yaml 2022-05-26 16:12:31 +00:00
Tim Shelton 879fccd266 merging locally 2022-05-26 15:27:13 +00:00
Tim Shelton b78386d372 FP: ignore Amazon aws powershell 2022-05-26 14:45:00 +00:00
Mark Morowczynski 68836f3050 Update .gitignore 2022-05-25 19:59:00 -07:00
Mark Morowczynski 443e6e2d8e Revert "Update .gitignore" 
This reverts commit 46808867b1.
 2022-05-25 19:38:48 -07:00
Mark Morowczynski 46808867b1 Update .gitignore 2022-05-25 19:20:17 -07:00
Mark Morowczynski 34d06708e5 Create azure_app_credential_added.yml 
App Credential Add rule
 2022-05-25 19:13:26 -07:00
Tim Shelton 8ef2a37fda clean up condition 2022-05-25 20:24:47 +00:00
Tim Shelton 2317d6c146 Feat. adds helper script to run sigmac against only those rules that changed 2022-05-25 15:43:59 +00:00
phantinuss b80eb411ab Merge pull request #3032 from frack113/lolbin_20220522 
Add lolbas cl script
 2022-05-25 12:02:44 +02:00
phantinuss e475deaf4d Update proc_creation_win_lolbas_cl_mutexverifiers.yml 2022-05-25 11:56:52 +02:00
phantinuss 3bdf29033a Update proc_creation_win_lolbas_cl_loadassembly.yml 2022-05-25 11:55:37 +02:00
phantinuss 0685a71fca Merge pull request #3046 from frack113/fix_cast 
Fix duplicate cast
 2022-05-25 11:50:58 +02:00
frack113 f737ba6e95 Fix duplicate cast 2022-05-25 11:19:09 +02:00
frack113 9d5587cf65 Merge pull request #3043 from nasbench/master 
Add More Malicious PowerShell Script/Cmdlet Names
 2022-05-25 06:32:07 +02:00
Tim Shelton 7369908284 fixing yaml syntax check 2022-05-24 22:52:04 +00:00
Tim Shelton 9a3fc4f543 FP: System image (driver) restoring files. Valid behavior 2022-05-24 22:31:05 +00:00
Nasreddine Bencherchali c3d807f53a Add More Malicious PowerShell Script/Cmdlet Names 2022-05-24 22:02:08 +01:00
Florian Roth c7b90f108f Merge pull request #3039 from jstnk9/master 
New sigma rule to detect the use of Jlaive antivirus defense evasion
 2022-05-24 20:25:42 +02:00