security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,089 Commits 1 Branch 57 Tags
d14e287cdf91e2a8b995de5bfbc3fa8540c1922b
Commit Graph

15089 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
frack113 c3f41918db Update registry_set_asep_reg_keys_modification_currentversion.yml 2022-10-21 07:00:25 +02:00
frack113 fd40c8ddce Merge pull request #3612 from qasimqlf/patch-8 
Update and rename posh_ps_copy_item_system32.yml
 2022-10-21 06:48:10 +02:00
secDre4mer 5665354ef5 Merge pull request #3614 from phantinuss/master 
fix: FPs found in testing environment
 2022-10-20 17:33:52 +02:00
phantinuss f4420ca3c3 fix: FPs found in testing environment 2022-10-20 17:25:23 +02:00
Nasreddine Bencherchali 43f6b7fd54 Update registry_set_asep_reg_keys_modification_currentversion.yml 2022-10-20 15:58:27 +02:00
Nasreddine Bencherchali 2b78d921c4 Update proc_creation_win_hack_rubeus.yml 2022-10-20 12:41:23 +02:00
Nasreddine Bencherchali b4cbd6b2ee Rework Rule Condition 2022-10-20 12:25:52 +02:00
Nasreddine Bencherchali 21f8477e43 Add missing OriginalFileName 
Add missing OriginalFileName for some rules
 2022-10-20 12:25:32 +02:00
Nasreddine Bencherchali aabd6efbc1 Create proc_creation_win_susp_service_dacl_modification_set_service.yml 
Add variation of the technique described in the rule 99cf1e02-00fb-4c0d-8375-563f978dfd37 using the "set-service" cmdlet
 2022-10-20 11:57:24 +02:00
Nasreddine Bencherchali 3cdd105355 Add SafetyKatz+Seatbelt Rules 2022-10-20 11:56:19 +02:00
Nasreddine Bencherchali 1ee657b1fc Update Hacktool Rules 2022-10-20 11:55:59 +02:00
Nasreddine Bencherchali 7621ce8899 Add New Vuln Driver 
Add new vuln driver related to CVE-2022-37969
 2022-10-20 11:55:36 +02:00
Nasreddine Bencherchali a13a5efd47 More FP tuning 2022-10-20 11:51:06 +02:00
Qasim Qlf 2c4ea3761a Update and rename posh_ps_copy_item_system32.yml to posh_ps_copy_item_system_directory.yml 2022-10-20 14:31:48 +05:00
Nasreddine Bencherchali 1512c50b4d Update proc_creation_win_lolbin_susp_wsl.yml 2022-10-20 11:19:54 +02:00
phantinuss ec3a371f51 Merge pull request #3610 from phantinuss/master 
fix: FP on test system
 2022-10-20 11:17:59 +02:00
phantinuss 09b94e2081 fix: FP on test system 2022-10-20 11:08:41 +02:00
phantinuss f976ad48c1 Merge pull request #3602 from nasbench/nasbench-rule-devel 
Rule Dev
 2022-10-20 10:28:56 +02:00
frack113 27ad27c3c0 Merge pull request #3608 from unamuno/patch-mitreid 
changed mitre id from process to user discovery
 2022-10-19 22:31:37 +02:00
Nasreddine Bencherchali 4a61f56c5f Update win_security_susp_possible_shadow_credentials_added.yml 2022-10-19 19:06:00 +02:00
Nasreddine Bencherchali 87c0788fca Update win_security_susp_possible_shadow_credentials_added.yml 2022-10-19 19:04:53 +02:00
unknown a25ac9c4d9 Fix date and modified field duplication 2022-10-19 12:04:04 -04:00
unknown 490c148bca Merge branch 'master' of https://github.com/SigmaHQ/sigma into cobalt-pipenames-redcanary 2022-10-19 11:50:00 -04:00
Merlin 575f36d8f8 changed mitre id from process to user discovery 2022-10-19 16:10:47 +02:00
Florian Roth 24b1c5fec8 Merge pull request #3606 from nasbench/add-powershell-core-logs 
Add PowerShellCore Eventlog
 2022-10-19 15:56:43 +02:00
Florian Roth 56bab8f115 Merge pull request #3607 from phantinuss/master 
fix: FPs on test system
 2022-10-19 15:56:05 +02:00
phantinuss 7a6bb720d9 fix: FPs on test system 2022-10-19 15:44:00 +02:00
Nasreddine Bencherchali 14c08635ef Add PowerShellCore Channel 2022-10-19 00:07:09 +02:00
Nasreddine Bencherchali 21040fc106 Update posh_ps_using_set_service_to_hide_services.yml 2022-10-18 20:13:45 +02:00
Florian Roth e93b7bf571 Merge pull request #3601 from blueteam0ps/patch-9 
proxy_ua_rclone.yml
 2022-10-18 19:07:08 +02:00
Nasreddine Bencherchali a6edfd6c21 Add more details to the definition section 
Add more details to the definition section for events from the "Audit Directory Service Changes"
 2022-10-18 17:35:02 +02:00
Florian Roth eada6ed589 Update proxy_ua_rclone.yml 2022-10-18 17:21:54 +02:00
Florian Roth ff51028320 Merge pull request #3604 from phantinuss/master 
fix: FPs on test machine
 2022-10-18 17:21:34 +02:00
Nasreddine Bencherchali 2758e67185 Update win_security_susp_possible_shadow_credentials_added.yml 2022-10-18 17:08:09 +02:00
Nasreddine Bencherchali 18ed0ce02a Update win_security_susp_possible_shadow_credentials_added.yml 2022-10-18 17:07:36 +02:00
phantinuss a5b08d5b9c fix: FPs on test machine 2022-10-18 16:39:04 +02:00
Nasreddine Bencherchali 676578d2c4 Add PowerShell version of the rule + Fix rule 2022-10-18 16:03:26 +02:00
Nasreddine Bencherchali ce567a4d8d Fix wording in definition + Add FP description 2022-10-18 16:02:41 +02:00
Nasreddine Bencherchali 2a86dd3d71 Reduce to medium level due to FP 2022-10-18 14:13:43 +02:00
Nasreddine Bencherchali 0fc2e75c0d Merge branch 'SigmaHQ:master' into nasbench-rule-devel 2022-10-18 14:12:39 +02:00
frack113 ef931fe3c7 Merge pull request #3603 from phantinuss/master 
fix: FP on many systems
 2022-10-18 13:36:28 +02:00
phantinuss a1f4ef4d34 fix: FP on many systems 2022-10-18 12:49:24 +02:00
Nasreddine Bencherchali a72aedb1cc Small Update To FP 2022-10-18 11:51:37 +02:00
Nasreddine Bencherchali 01826d2a3b New File Access Rules 
Added new files access rules related to windows dpapi files/keys
 2022-10-18 11:51:24 +02:00
Florian Roth 458428bf5f Update proxy_ua_rclone.yml 2022-10-18 10:15:33 +02:00
BlueTeamOps f34c32882a proxy_ua_rclone.yml 
Adding this rule after reading https://www.kroll.com/en/insights/publications/cyber/new-m365-business-email-compromise-attacks-with-rclone. It is more relevant to O365 but it may help via proxy too if this off O365.
 2022-10-18 17:32:38 +11:00
frack113 0b84ffa517 Merge pull request #3600 from securepeacock/patch-30 
Update proc_creation_win_renamed_binary.yml
 2022-10-18 06:24:16 +02:00
frack113 9a91023163 Merge pull request #3598 from little-kawa/master 
Update driver_load_vuln_drivers_names.yml
 2022-10-18 06:24:04 +02:00
securepeacock cef6ea0b6b Update proc_creation_win_renamed_binary.yml 
Added InstallUtil
https://twitter.com/424f424f/status/1582048291294162946?s=20&t=5uYGiwA_fJP8-7pnK2yViQ
 2022-10-17 12:58:29 -04:00
Kawa 6960178d56 Update driver_load_vuln_drivers_names.yml 2022-10-17 15:23:14 +02:00