security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,780 Commits 1 Branch 57 Tags
ced1aa3dc05bc6dca3ebac9db94a4f5ea2f06e54
Commit Graph

7780 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
frack113 ced1aa3dc0 Merge pull request #2008 from frack113/master 
Split global sysmon rules
 2021-09-10 09:18:54 +02:00
frack113 4a03ef6e0b Merge pull request #2007 from zakibro/master 
New Rule - Linux Auditd Hidden Files - Steganography
 2021-09-10 09:18:28 +02:00
zakibro a4dffc14d4 Update lnx_auditd_unzip_hidden_zip_files_steganography.yml 
Fixing formatting
 2021-09-10 07:54:56 +02:00
zakibro 0b5e8cb980 Update lnx_auditd_hidden_zip_files_steganography.yml 
Formatting changes
 2021-09-10 07:52:35 +02:00
Pawel Mazur 5a5769cce6 New Rule - Linux - Steganography Unzip Hidden Information From Picture File 2021-09-09 20:38:25 +02:00
zakibro 3fbe5478c3 Update and rename lnx_auditd_hidden_files_steganography.yml to lnx_auditd_hidden_zip_files_steganography.yml 
Splitting the rule into separate rules
 2021-09-09 20:34:20 +02:00
frack113 ffbeec134d Update image_load_wmiprvse_wbemcomn_dll_hijack.yml 2021-09-09 19:56:20 +02:00
zakibro 458973af81 Update lnx_auditd_hidden_files_steganography.yml 
Adding missing field: action
 2021-09-09 16:52:58 +02:00
zakibro 62db796fc2 Update lnx_auditd_hidden_files_steganography.yml 
Formatting changes
 2021-09-09 16:46:41 +02:00
zakibro 0971fe1d49 Update lnx_auditd_hidden_files_steganography.yml 
Fixing the listing issue
 2021-09-09 16:27:57 +02:00
Pawel Mazur 41458d8a5a New Rule - Linux Auditd Hidden Files - Steganography 2021-09-09 16:13:27 +02:00
frack113 d9cd1652f2 Split global sysmon rules 2021-09-09 16:11:41 +02:00
frack113 217be6cd8a Merge pull request #2005 from frack113/tags_end 
Add  missing tags to rule
 2021-09-09 15:04:26 +02:00
Florian Roth e8b633f54f Merge pull request #2006 from SigmaHQ/rule-devel 
docs: changed level and reference in CVE-2021-40444 rule
 2021-09-09 09:29:08 +02:00
Florian Roth 2777187fd9 docs: changed level and reference in CVE-2021-40444 rule 2021-09-09 08:46:34 +02:00
Florian Roth b1f5c22805 Merge pull request #2003 from SigmaHQ/rule-devel 
CVE-2021-40444 process pattern
 2021-09-09 08:44:52 +02:00
Florian Roth 36a5d7ec04 CVE-2021-40444 false positives 2021-09-09 08:12:36 +02:00
frack113 923be1064f Merge pull request #2004 from BlackB0lt/patch-15 
Update sysmon_dns_over_https_enabled.yml
 2021-09-09 06:25:27 +02:00
Sittikorn S 36ed5ee9d4 Update sysmon_dns_over_https_enabled.yml 2021-09-09 08:04:54 +07:00
frack113 8eb527d042 Update process_mailboxexport_share.yml 2021-09-08 20:21:02 +02:00
frack113 deb0ddfe09 fix duplicate tags 2021-09-08 20:16:53 +02:00
frack113 af8bf06b30 add missing tags 2021-09-08 20:14:49 +02:00
Florian Roth b1540d65b9 refactor: simplified rule 2021-09-08 17:35:50 +02:00
Sittikorn S c633e825e0 Update sysmon_dns_over_https_enabled.yml 2021-09-08 22:23:51 +07:00
Sittikorn S 847b8f49b4 Update sysmon_dns_over_https_enabled.yml 
Remove HKEY_LOCAL_MACHINE\ and revise Firefox object
 2021-09-08 22:22:53 +07:00
Florian Roth e388bc6bfa remove unsupported tag 2021-09-08 16:56:04 +02:00
Florian Roth c9b4f5d326 CVE-2021-40444 2021-09-08 16:49:49 +02:00
Florian Roth 72ffe99b20 Merge pull request #2001 from SigmaHQ/rule-devel 
filter: empty thumbprint, PetitPotam rule
 2021-09-08 09:09:58 +02:00
frack113 993112c7eb Merge pull request #2002 from frack113/missing_tag 
Add missing Tags #1974
 2021-09-08 06:26:55 +02:00
frack113 e712d9696b Merge pull request #2000 from frack113/split_global 
Split frack113 global rules
 2021-09-08 06:26:35 +02:00
Thomas Patzke d9edc9f0e3 Merge branch 'fix' 2021-09-08 00:19:09 +02:00
Thomas Patzke 143744bc12 Various fixes 
* Backslashes in regular expressions
* Casing of condition operators
* Further small errors
 2021-09-07 23:38:07 +02:00
frack113 439175d75d Merge pull request #1999 from rachelrice/update_aws_login_profile 
Update AWS Update Login Profile Rule fields
 2021-09-07 18:18:48 +02:00
frack113 4c3f8821c4 add missing tags 2021-09-07 18:16:46 +02:00
frack113 4e394d83a1 add missing tags 2021-09-07 17:45:41 +02:00
Rachel Rice be5351947c Unset date update 
Signed-off-by: Rachel Rice <rachel.rice@lacework.net>
 2021-09-07 16:36:59 +01:00
Florian Roth 1a55f4a294 filter: empty thumbprint, PetitPotam rule 2021-09-07 14:37:03 +02:00
Rachel Rice eef6e71e2e Update AWS Update Login Profile Rule fields 
Missed updating field from `responseElements.accessKey.userName` to `requestParameters.userName` on last update.
 2021-09-07 12:39:56 +01:00
frack113 0e5e4fa19d Split global rules 2021-09-07 13:30:32 +02:00
Florian Roth 10726bbb1f Merge pull request #1998 from SigmaHQ/rule-devel 
PRIVATELOG image load
 2021-09-07 12:08:46 +02:00
Florian Roth cfbde22d2d rule: PRIVATELOG image load 2021-09-07 10:10:14 +02:00
Florian Roth 3a305e82b9 fix: remove renamed files 2021-09-07 09:28:20 +02:00
Florian Roth a8d8d878a0 remove uppercase files 2021-09-07 09:27:11 +02:00
Florian Roth 8b4fce3473 removed unneeded upper ticks 2021-09-07 09:21:44 +02:00
Florian Roth c082ce0fe0 Merge branch 'master' into rule-devel 2021-09-07 09:20:47 +02:00
Florian Roth 57bfdc7a02 fix: more upper case chars 2021-09-07 09:19:23 +02:00
Florian Roth 0cce1c0245 fix: missing lowercase chars 2021-09-07 09:17:25 +02:00
Florian Roth 33be089ea2 fix: filename to lowercase 2021-09-07 09:16:35 +02:00
frack113 4f6b87fed5 Merge pull request #1997 from zakibro/master 
New Rule - Linux Hidden Files and Directories
 2021-09-07 09:12:04 +02:00
zakibro bba66ca762 Update lnx_auditd_hidden_files_directories.yml 
Updating arguments section
 2021-09-07 07:57:50 +02:00