security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
8,623 Commits 1 Branch 57 Tags
c8f488eabf94271e79ac874099464a18246675f6
Commit Graph

524 Commits

Author SHA1 Message Date
frack113 c8f488eabf move to builtin 2021-11-09 13:27:20 +01:00
zakibro 30f13d41f5 Update lnx_auditd_load_module_insmod.yml 
fixing missing date
 2021-11-02 17:16:59 +01:00
Pawel Mazur dd7817917c Linux - Auditd - Loading of Kernel Module via Insmod rule 2021-11-02 17:04:39 +01:00
frack113 c228cde0cb Move to correct directory 2021-10-27 14:38:51 +02:00
Florian Roth fcecb951d5 Merge branch 'master' into rule-devel 2021-10-26 22:03:55 +02:00
Florian Roth 1983cba1f3 refactor: xmrig sub process indicator 2021-10-26 13:24:01 +02:00
Florian Roth ab499c9c21 rules: crypto coin mining 2021-10-26 08:52:07 +02:00
Florian Roth 0b46180cd2 fix: moved back connect bash to correct folder 2021-10-26 08:51:54 +02:00
frack113 f8574fcd81 Add cve tags 2021-10-25 18:40:50 +02:00
frack113 8595478b36 Merge pull request #2149 from OTRF/feature/Sysmon-For-Linux-Rules 
OTR - Migrating rules to Sysmon for Linux schema :)
 2021-10-21 19:10:32 +02:00
frack113 963f32063f Merge pull request #2148 from SigmaHQ/rule-devel 
First Linux Process Creation and Network Connection rules (Sysmon for Linux)
 2021-10-21 19:10:08 +02:00
Florian Roth ae22f2ae7e rule: Linux Bash reverse shell indicators 2021-10-16 14:21:55 +02:00
frack113 114e44ce6b move file 2021-10-16 11:11:19 +02:00
Roberto Rodriguez 2b3e40e721 Rule for Cron activity - file creation 2021-10-16 02:33:01 -04:00
Roberto Rodriguez 2c0e89ccc8 added indentation to lists per request 2021-10-15 16:24:26 -04:00
Roberto Rodriguez 7b11987155 Fixed format indentation to fix block error 2021-10-15 16:12:51 -04:00
Roberto Rodriguez d391eccd32 split commandline arguments in a few rules 2021-10-15 16:10:42 -04:00
Roberto Rodriguez eed86077ab updated rules schema and added Clipboard Collection with Xclip Tool 2021-10-15 15:59:11 -04:00
Roberto Rodriguez 04ff9ae692 Updated at command rule to use Image field 2021-10-15 15:46:59 -04:00
Roberto Rodriguez aa0a5b8204 commands to clear or remove the syslog rule 2021-10-15 15:43:42 -04:00
Roberto Rodriguez f8cb0883d5 OMI SCX Execute RunAsProvider rules 2021-10-15 15:38:09 -04:00
Roberto Rodriguez ca99394e46 detect overwriting and deletion of files via dd 2021-10-15 15:28:15 -04:00
Florian Roth 8ee9d2f5b4 docs: changes in description 2021-10-15 15:12:44 +02:00
Florian Roth 231b54e526 rule: first Linux process_creation rule 2021-10-15 14:39:32 +02:00
Florian Roth 6c4e24d0de rule: coin miner param --cpu-priority 2021-10-09 10:28:16 +02:00
frack113 e666b7e1db Merge pull request #2116 from zakibro/master 
New Rule - Linux - Auditd - Clipboard Collection of Image Data with X…
 2021-10-02 11:06:24 +02:00
zakibro c2a26923c6 Update lnx_auditd_clipboard_image_collection.yml 2021-10-02 09:59:37 +02:00
zakibro d40b42fc2c Update lnx_auditd_clipboard_image_collection.yml 
fixing a typo
 2021-10-01 18:54:12 +02:00
Pawel Mazur e67770d7ea New Rule - Linux - Auditd - Clipboard Collection of Image Data with Xclip Tool 2021-10-01 18:43:03 +02:00
Austin Songer 00513ff2c5 Create macos_suspicious_macos_firmware_activity.yml 2021-09-30 18:47:15 -05:00
frack113 6bce0f967a Merge pull request #2079 from zakibro/master 
New Rule - Linux - Auditd - Clipboard Collection
 2021-09-27 08:34:30 +02:00
zakibro 6a2785492d Update lnx_auditd_clipboard_collection.yml 
Changes after suggestion.
 2021-09-27 07:59:43 +02:00
Pawel Mazur 4bbe4962b0 New Rule - Linux - Auditd - Clipboard Collection 2021-09-24 18:40:10 +02:00
Florian Roth b7b0bd4275 Update lnx_clear_syslog.yml 2021-09-22 09:46:05 +02:00
frack113 7b995f2d99 Merge pull request #2057 from secDre4mer/master 
Add two rules
 2021-09-22 09:15:32 +02:00
frack113 ac639bb9ec Merge pull request #2060 from zakibro/master 
New Rule - Linux - Auditd - Screencapture with Import Tool
 2021-09-22 08:41:50 +02:00
Pawel Mazur e20e5033e7 New Rule - Linux - Auditd - Screencapture with Import Tool 2021-09-21 18:55:48 +02:00
Max Altgelt bf9bc03258 chore: properly name and describe rules 2021-09-21 15:59:01 +02:00
Max Altgelt 346ff26809 feat: Add rule for syslog removal 2021-09-21 14:56:12 +02:00
Roberto Rodriguez 407289d300 Rule to detect the execution of a script via SCX RunAsprovider ExecuteScript 2021-09-18 03:50:37 -04:00
Florian Roth 260578dceb fix: wrong modified field 2021-09-17 14:29:19 +02:00
Roberto Rodriguez c17104b2eb updated level to high 2021-09-17 04:30:17 -04:00
Roberto Rodriguez 7618cf4672 Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell 2021-09-17 04:23:11 -04:00
frack113 33a51df46a Update lnx_system_info_discovery.yml 2021-09-14 21:03:46 +02:00
frack113 a6da209507 Update lnx_auditd_system_info_discovery2.yml 2021-09-14 21:02:51 +02:00
frack113 a3477893de Update lnx_auditd_network_service_scanning.yml 2021-09-14 21:02:13 +02:00
frack113 83531bb2ff split global lnx_system_info_discovery.yml 2021-09-14 20:13:57 +02:00
frack113 38c0f83eaf split global lnx_sudo_cve_2019_14287.yml 2021-09-14 20:07:13 +02:00
frack113 87e5fc48fa split global lnx_security_tools_disabling.yml 2021-09-14 19:32:58 +02:00
frack113 ecefc6e913 add missing product 2021-09-14 19:29:49 +02:00