security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,528 Commits 1 Branch 57 Tags
cfccdea28ea91f0e43c6fdc1419c4e71bb21286a
Commit Graph

4732 Commits

Author SHA1 Message Date
frack113 cfccdea28e change OriginalFilename case 2021-07-06 10:09:47 +02:00
Florian Roth 4b487f49fc Merge pull request #1624 from frack113/fix_pr_869 
Fix PR 869
 2021-07-05 15:26:50 +02:00
Florian Roth 0da297dbef Merge pull request #1626 from frack113/description_is_null 
fix missing description
 2021-07-05 15:26:31 +02:00
Florian Roth 8069b53e5e Merge pull request #1625 from SigmaHQ/rule-devel 
Kaseya patterns, PrinterNightmare Mimikatz update
 2021-07-05 13:29:23 +02:00
frack113 0245d58065 fix missing description 2021-07-05 12:56:05 +02:00
Florian Roth 6c4f36c473 fix: minor typo - no \ at the end of the expression 2021-07-05 12:05:57 +02:00
Florian Roth 7e9d6600eb rule: PrinterNightmare - new mimikatz printer name 2021-07-05 12:03:56 +02:00
Florian Roth 7fab22ddc2 rule: more Kaseya patterns 2021-07-05 12:03:35 +02:00
frack113 d05f3efd1b fix pr 869 2021-07-04 19:44:50 +02:00
Florian Roth d101c9893a Merge pull request #1623 from SigmaHQ/rule-devel 
rule: mimikatz printernightmare
 2021-07-04 14:28:44 +02:00
Florian Roth 1e152bf594 Merge pull request #1615 from leegengyu/patch-1 
Update powershell_data_compressed.yml - Outdated link
 2021-07-04 14:19:55 +02:00
Florian Roth 062198550d Merge pull request #1620 from leegengyu/patch-2 
Update win_susp_sdelete.yml - Outdated Link and Typo
 2021-07-04 14:19:31 +02:00
Florian Roth fd5b7506d1 refactor: changed rule contents, removed eventIDs 2021-07-04 14:03:28 +02:00
Florian Roth 62b25cadf1 rule: mimikatz printernightmare 2021-07-04 13:47:56 +02:00
G Y a60a2feb17 Update sysmon_susp_pfx_file_creation.yml 
Fixed typo.
 2021-07-04 10:38:53 +08:00
G Y 268c97f23a Update win_susp_sdelete.yml 
Update old links and typo.
 2021-07-04 09:53:23 +08:00
G Y c63439e74d Update powershell_data_compressed.yml 
Changed reference link from `.yaml` to `.md`.
 2021-07-04 08:15:29 +08:00
Florian Roth a02b7a2390 Merge pull request #1617 from SigmaHQ/rule-devel 
rule: REvil Kaseya patterns
 2021-07-03 17:32:18 +02:00
Florian Roth d188932748 Merge pull request #1616 from frack113/update_win_renamed_powershell.yml 
Tune detection in win_renamed_powershell.yml
 2021-07-03 17:04:52 +02:00
Florian Roth 48621d68ff Merge pull request #1613 from leegengyu/powershell_powerview_malicious_commandlets_additions 
Update powershell_powerview_malicious_commandlets.yml - Addition and Miscellaneous
 2021-07-03 17:04:29 +02:00
Florian Roth 1d82ac50e4 refactor: additional pattern, extended description 2021-07-03 17:03:40 +02:00
Florian Roth 57b816f49d rule: REvil Kaseya patterns 2021-07-03 16:34:02 +02:00
frack113 02100f1a3c Tune detection in win_renamed_powershell.yml 2021-07-03 15:18:01 +02:00
G Y d247766a2e Update powershell_data_compressed.yml 
Corrected old link and formatting.
 2021-07-03 20:48:03 +08:00
Florian Roth e7144b34ee fix: bug in syntax 2021-07-03 13:19:56 +02:00
Florian Roth 2d0cdc16fc added modified date 2021-07-03 13:19:14 +02:00
Florian Roth e41759cfb3 Merge pull request #1607 from austinsonger/printernightmare 
PrinterNightmare CVE-2021-34527 Exploit Detection- Fixed Spell Error
 2021-07-03 13:16:52 +02:00
Florian Roth 2a63927d51 Merge pull request #1612 from leegengyu/web_nginx_core_dump_typo 
Update web_nginx_core_dump.yml - Typo
 2021-07-03 13:15:50 +02:00
G Y 2e3daeac94 Update sysmon_remote_powershell_session_network.yml 
Typo fixes and grammar correction.
 2021-07-03 14:25:55 +08:00
G Y 7f067f7273 Update powershell_powerview_malicious_commandlets.yml 
Added new commandlet names based on aliases seen in https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1, fixed a typo, and improved formatting.
 2021-07-03 11:07:11 +08:00
G Y 544ec5861b Update web_nginx_core_dump.yml 
Fixed typo in description field.
 2021-07-03 10:39:37 +08:00
Florian Roth e25a9cd3b8 fix: escape character that would be interpreted as wildcard 2021-07-02 23:50:18 +02:00
Florian Roth 43735a5714 revert: change in other rule 2021-07-02 23:50:03 +02:00
Florian Roth 8b47946ad2 Merge branch 'master' into rule-devel 2021-07-02 23:47:58 +02:00
Florian Roth d3d018e600 fix: escape character that would be interpreted as wildcard 2021-07-02 22:02:46 +02:00
Florian Roth dcda583810 Merge pull request #1606 from initiate6/master 
Added new Print Spooler exploitation detection method
 2021-07-02 19:17:47 +02:00
Florian Roth e5f2b40477 Minor adjustments 2021-07-02 18:48:07 +02:00
Austin Songer a69bbf59e6 Fixed Spell Error 2021-07-02 11:47:20 -05:00
INIT_6 defcf7f808 Added new Print Spooler exploitation detection method 2021-07-02 10:58:14 -05:00
Florian Roth 0cdf0a79a8 Merge pull request #1605 from initiate6/master 
Added new possible ErrorCode
 2021-07-02 17:57:26 +02:00
Florian Roth 6d0d58dfe2 Merge pull request #1602 from BlackB0lt/patch-11 
Update and rename to av_printernightmare_cve_2021_34527.yml
 2021-07-02 17:15:10 +02:00
INIT_6 527a3cb8cd Added new possible ErrorCode 2021-07-02 07:27:00 -05:00
frack113 895a2f6154 fix 3 times the same name file 2021-07-02 11:01:07 +02:00
Sittikorn S d33da0b25c Update av_printernightmare_cve_2021_34527.yml 2021-07-02 14:42:04 +07:00
Florian Roth 203e6cf7b2 Merge pull request #1599 from d4rk-d4nph3/master 
New rule and update for PrintNightmare
 2021-07-02 09:27:30 +02:00
Sittikorn S 990699b81c Update av_printernightmare_cve_2021_34527.yml 2021-07-02 11:54:37 +07:00
Sittikorn S e94cdbbf84 Update and rename av_printernightmare_cve_2021_1675.yml to av_printernightmare_cve_2021_34527.yml 
Assign CVE-2021-34527 Windows Print Spooler Remote Code Execution Vulnerability
 2021-07-02 11:50:24 +07:00
wagga40 ae670603e8 Updated PrintNightmare Sysmon Imageload based rule with modifiers 2021-07-01 21:34:53 +02:00
Florian Roth b09efee045 Merge pull request #1600 from SigmaHQ/rule-devel 
rule: suspicious printer driver - empty manufacturer
 2021-07-01 16:46:09 +02:00
Florian Roth e97bdf36f9 rule: suspicious printer driver - empty manufacturer 2021-07-01 13:55:21 +02:00