security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,333 Commits 1 Branch 57 Tags
cd303fa0a4fefa965c46c43a7fcff76e094ebbba
Commit Graph

11163 Commits

Author SHA1 Message Date
Nasreddine Bencherchali cd303fa0a4 Merge pull request #3877 from redsand/fp_library_alias_and_use_of_alias 
feat: add defender cmdlet alias option
 2023-01-12 17:28:39 +01:00
Nasreddine Bencherchali a3fa8e8a90 Merge pull request #3914 from redsand/fp_citrix_receiver 
FP: citrix receiver storefront
 2023-01-12 17:25:08 +01:00
Tim Shelton 09b3e43afc Removing filter specification in condition 2023-01-12 16:21:58 +00:00
redsand (Tim Shelton) 3007d98844 Merge branch 'SigmaHQ:master' into fp_library_alias_and_use_of_alias 2023-01-12 10:19:47 -06:00
redsand (Tim Shelton) 88308b713c Update rules/windows/powershell/powershell_script/posh_ps_tamper_defender.yml 
whatever you guys want, im good with. i like @neo23x0 suggestion

Co-authored-by: Florian Roth <venom14@gmail.com>
 2023-01-12 10:14:14 -06:00
Tim Shelton ae51f1c472 FP: citrix receiver storefront 2023-01-12 16:09:36 +00:00
TheLawsOfChaos 52e40d10ef feat: updates multiple mitre tech/sub-tech/tactics (#3913) 2023-01-12 17:04:38 +01:00
Nasreddine Bencherchali a5df41cf39 fix: update title and description 2023-01-12 15:49:40 +01:00
Nasreddine Bencherchali 9a671e25d9 fix: add missing eid 400 2023-01-12 15:12:20 +01:00
Nasreddine Bencherchali 90c1e45d83 feat: add new reg variant of dev mode 2023-01-12 15:05:53 +01:00
Nasreddine Bencherchali 0ccda79d4e Merge pull request #3908 from nasbench/nasbench-rule-devel 
feat: new rules and updates
 2023-01-12 11:03:33 +01:00
Nasreddine Bencherchali e7a2e1c169 fix: remove version from name 
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
 2023-01-12 10:37:34 +01:00
Nasreddine Bencherchali 0470f45246 fix: apply suggestions from code review 
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
 2023-01-12 10:36:13 +01:00
Tim Brown 4b52acd2fe feat: add rules for BGP and LDP authentication failures 2023-01-12 01:59:16 +01:00
Nasreddine Bencherchali 67ea98a6db feat: more updates and fixes 2023-01-12 01:05:48 +01:00
Nasreddine Bencherchali d0b2e2cbba fix: more fp and duplicate id 2023-01-11 23:47:12 +01:00
Nasreddine Bencherchali b6b1eba014 fix: fp and add related fields 2023-01-11 23:39:15 +01:00
Nasreddine Bencherchali debd658aac feat: new rules related to appx packages 2023-01-11 23:04:37 +01:00
Nasreddine Bencherchali f4d4526d0f fix: fp found in testing 2023-01-11 20:05:55 +01:00
Nasreddine Bencherchali e0217640e8 fix: remove duplicate entries 2023-01-11 16:34:03 +01:00
Nasreddine Bencherchali 75b6b4fa59 fix: add missing modified date 2023-01-11 16:28:45 +01:00
Nasreddine Bencherchali 7edac96e63 fix: add modified 2023-01-11 16:27:49 +01:00
pH-T 5cc5f4db6d fix: syntax error 2023-01-11 16:27:17 +01:00
Paul Hager 69ffa7f51b feat: updated rules for coverage of CVE-2015-2291 2023-01-11 16:24:05 +01:00
Nasreddine Bencherchali 93f55874cd Merge pull request #3906 from nasbench/nasbench-rule-devel 
feat: enhancements and fp fixes
 2023-01-11 11:26:05 +01:00
Nasreddine Bencherchali 8dc2418ea9 fix: some issues 2023-01-11 11:18:54 +01:00
TheLawsOfChaos 8607588a13 11 Files with updates Tactics/techniques/sub-techs (#3904) 2023-01-11 06:30:46 +01:00
Nasreddine Bencherchali 28a3413aa7 feat: updates and enhancements 2023-01-11 01:03:52 +01:00
Nasreddine Bencherchali 5bd38f8ff0 Merge branch 'SigmaHQ:master' into nasbench-rule-devel 2023-01-11 01:03:08 +01:00
frack113 0c3ba418db Merge pull request #3898 from cyb3rjy0t/patch-2 
New rule
 2023-01-10 20:47:48 +01:00
frack113 8e7187e861 Rename azure_ad_risky_sign_ins_with_singlefactorauthencation_from_unknown_devices.yml to azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml 2023-01-10 20:37:56 +01:00
Nasreddine Bencherchali 2820210945 fix: broken title 2023-01-10 19:43:19 +01:00
Nasreddine Bencherchali 15757c2b7d fix: remove tactic links 2023-01-10 19:20:31 +01:00
frack113 486ee8f435 Apply suggestions from code review 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2023-01-10 19:13:38 +01:00
frack113 49d7eb244f Remove mitre url 2023-01-10 18:24:22 +01:00
frack113 4023bf2c83 Remove mitre url 2023-01-10 18:09:04 +01:00
frack113 a6116a5fdc Merge pull request #3894 from TheLawsOfChaos/patch-5 
Update azure_device_or_configuration_modified_or_deleted.yml
 2023-01-10 17:49:12 +01:00
Nasreddine Bencherchali 9d6a41edc6 fix: fp found in testing 2023-01-10 15:11:40 +01:00
Nasreddine Bencherchali 23278ead62 Merge pull request #3893 from TheLawsOfChaos/patch-4 
Update azure_dns_zone_modified_or_deleted.yml
 2023-01-10 13:50:11 +01:00
Nasreddine Bencherchali 6025922440 Merge pull request #3899 from nasbench/nasbench-rule-devel 
feat: updates and enhancements
 2023-01-10 10:48:18 +01:00
frack113 c3fabfe2a8 Update image_load_side_load_non_existent_dlls.yml 2023-01-10 10:41:48 +01:00
frack113 d52e30fbe3 Apply suggestions from code review 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2023-01-10 10:31:44 +01:00
frack113 f9e1419760 Order file 2023-01-10 06:24:48 +01:00
Nasreddine Bencherchali 82c2b635a9 fix: yaml syntax 2023-01-10 00:49:44 +01:00
Nasreddine Bencherchali 3b149675b2 Merge pull request #3896 from TheLawsOfChaos/patch-7 
Patch 7
 2023-01-10 00:45:38 +01:00
Nasreddine Bencherchali b80b358427 fix: fp with defender 2023-01-10 00:44:52 +01:00
Nasreddine Bencherchali b0e3bb5d28 fix: broken condition 2023-01-10 00:33:38 +01:00
Nasreddine Bencherchali 81f75c1d2e feat: updates and enhancements 2023-01-10 00:13:37 +01:00
cyb3rjy0t 907252c00f New rule 
Detecting risky user sign from non AD registered device with single factor authenciation
 2023-01-09 17:07:39 -05:00
Nasreddine Bencherchali 032db9f799 Merge pull request #3897 from TheLawsOfChaos/patch-8 
Update azure_firewall_modified_or_deleted.yml
 2023-01-09 22:39:41 +01:00