security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,656 Commits 1 Branch 57 Tags
cb5c19d696f047bede4cfbe1ec59427b49092bbc
Commit Graph

179 Commits

Author SHA1 Message Date
frack113 a674ee246b Update Title (#3739) 2022-11-30 11:44:15 +01:00
frack113 c820216541 Update Title (#3733) 2022-11-28 06:43:17 +01:00
frack113 cd4121d966 Update Title (#3731) 
Co-authored-by: Florian Roth <venom14@gmail.com>
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-11-27 19:19:27 +01:00
Qasim Qlf ed54bf44a5 Minor Fix 2022-11-22 18:13:34 +05:00
Nasreddine Bencherchali 6603ca9202 fix: update rules to not use regex 2022-11-18 11:16:13 +01:00
Florian Roth 0fb1295157 fix: FPs noticed with Aurora 2022-11-13 20:26:03 +01:00
Yamato Security 5de1fd6f2d Rule add: windows access token abuse (#3675) 
Co-authored-by: Florian Roth <venom14@gmail.com>
 2022-11-09 09:43:15 +01:00
frack113 8b749fb126 Order yaml field 2022-10-25 11:08:51 +02:00
frack113 f78e9e9034 Add rule 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-10-24 17:52:05 +02:00
Nasreddine Bencherchali 4a61f56c5f Update win_security_susp_possible_shadow_credentials_added.yml 2022-10-19 19:06:00 +02:00
Nasreddine Bencherchali 87c0788fca Update win_security_susp_possible_shadow_credentials_added.yml 2022-10-19 19:04:53 +02:00
Nasreddine Bencherchali a6edfd6c21 Add more details to the definition section 
Add more details to the definition section for events from the "Audit Directory Service Changes"
 2022-10-18 17:35:02 +02:00
Nasreddine Bencherchali 2758e67185 Update win_security_susp_possible_shadow_credentials_added.yml 2022-10-18 17:08:09 +02:00
Nasreddine Bencherchali 18ed0ce02a Update win_security_susp_possible_shadow_credentials_added.yml 2022-10-18 17:07:36 +02:00
Nasreddine Bencherchali ce567a4d8d Fix wording in definition + Add FP description 2022-10-18 16:02:41 +02:00
Nasreddine Bencherchali 01826d2a3b New File Access Rules 
Added new files access rules related to windows dpapi files/keys
 2022-10-18 11:51:24 +02:00
Nasreddine Bencherchali e26a6e36db Add missing definitions 
Add missing definitions for Audit Directory Services Changes events
 2022-10-17 13:23:53 +02:00
Florian Roth e344b1f10f Merge pull request #3591 from frack113/yamato_security 
Windows builtin security rules
 2022-10-15 10:49:37 +02:00
Florian Roth a6e54ab023 Update win_security_user_logoff.yml 2022-10-14 18:03:40 +02:00
frack113 81ec573424 Update rules/windows/builtin/security/win_security_user_logoff.yml 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-10-14 12:37:51 +02:00
frack113 d010fedb2c Update rules/windows/builtin/security/win_security_replay_attack_detected.yml 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-10-14 12:37:41 +02:00
frack113 2e14174911 Update rules/windows/builtin/security/win_security_device_installation_blocked.yml 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-10-14 12:37:27 +02:00
frack113 0042e2c8f0 Update rules/windows/builtin/security/win_security_add_remove_computer.yml 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-10-14 12:37:20 +02:00
frack113 0eda26397f Set to low 2022-10-14 10:33:34 +02:00
frack113 35e1660479 Fix LF 2022-10-14 10:22:58 +02:00
frack113 6a69608b44 Add security rules 2022-10-14 10:13:32 +02:00
frack113 8b7280e8fa Fix file name lenght 2022-10-14 09:11:19 +02:00
frack113 05d9ee85ed Rename security rules 2022-10-14 08:53:50 +02:00
Gude5 2d5939e33b Merge branch 'SigmaHQ:master' into master 2022-10-11 11:29:48 +02:00
Gude5 7a347cf8eb Update rules/windows/builtin/security/win_security_service_installation_by_unusal_client.yml 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-10-10 17:01:45 +02:00
Gude5 a984351d25 Update rules/windows/builtin/security/win_security_service_installation_by_unusal_client.yml 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-10-10 17:01:35 +02:00
Nasreddine Bencherchali be0a3ad863 Add missing definition section for EID 4697 2022-10-10 10:22:46 +02:00
Florian Roth 83f93bc32c Merge branch 'master' into master 2022-10-10 00:27:48 +02:00
frack113 cf7a348028 Fix related 2022-10-09 17:28:05 +02:00
frack113 931fb30853 old experimental rule promotion 2022-10-09 16:54:04 +02:00
Florian Roth d8890295fe Merge branch 'master' into master 2022-10-07 16:24:30 +02:00
nasreddine.bencherchali@nextron-systems.com 91cf9ce926 Fix modifier 2022-10-06 10:04:01 +02:00
Nasreddine Bencherchali 2c26614ce4 Update Wildcard + Int to Str fields 2022-10-05 23:15:20 +02:00
Tim Rauch b6046803a0 fix: fixed rules after review 2022-10-04 10:06:15 +02:00
Gude5 f692271c0a Merge branch 'SigmaHQ:master' into master 2022-10-04 09:33:51 +02:00
Florian Roth cd8ed9870c fix: FPs noticed with Aurora 2022-09-30 20:01:07 +02:00
Florian Roth 14fdf75ab5 fix: FPs noticed with THOR 2022-09-29 13:51:09 +02:00
Tim Rauch 119c9f5275 fix: fixed rules after failed Sigma Rule Tests 2022-09-29 11:30:45 +02:00
Tim Rauch 58e5b9f419 fix: removed ' from references 2022-09-29 10:21:01 +02:00
Tim Rauch 81a112e35b Fixed merge conflicts 2022-09-29 10:05:49 +02:00
Tim Rauch d35ea51136 Merge branch 'master' of https://github.com/Gude5/sigma 2022-09-29 09:57:29 +02:00
Florian Roth ec329f403a fix: Aurora FPs with Nvidia update 2022-09-28 19:31:22 +02:00
Tim Rauch be1f1a4505 New Rules: transformed elastic to sigma rules 2022-09-28 16:45:22 +02:00
Florian Roth d2f7ff8059 Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing 2022-09-27 10:47:21 +02:00
Florian Roth 5e6a926ac3 fix: FPs 2022-09-27 10:47:19 +02:00