security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,089 Commits 1 Branch 57 Tags
d14e287cdf91e2a8b995de5bfbc3fa8540c1922b
Commit Graph

15089 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
frack113 e4f01ca71f Merge pull request #3462 from elhoim/add_quotes_to_strings 
Add quotes to strings in multiple rules
 2022-09-05 08:43:44 +02:00
Florian Roth 7529857747 Delete script.sh 2022-09-04 10:42:39 +02:00
David André 8a595cd3fd Merge branch 'SigmaHQ:master' into add_quotes_to_strings 2022-09-04 10:10:14 +02:00
frack113 92f694a013 Merge pull request #3461 from danielgottt/patch-8 
Create proc_creation_win_ldifde_file_load.yml
 2022-09-04 08:17:43 +02:00
Gott 38d6a52e4d Update proc_creation_win_ldifde_file_load.yml 
Implemented suggestions
 2022-09-03 10:02:51 -04:00
Florian Roth 1af75b397d fix: VSCode file permissions changes 2022-09-03 09:48:36 +02:00
Florian Roth c7eddebe40 fix: Msiexec FPs noticed with Aurora 2022-09-03 09:30:24 +02:00
frack113 8162792c11 Merge pull request #3458 from frack113/frp 
Add proc_creation_win_frp
 2022-09-03 08:18:28 +02:00
frack113 fda96b4ea7 Merge pull request #3457 from nasbench/nasbench-rule-devel 
Rule Devel (New+Update)
 2022-09-03 08:18:03 +02:00
Gott 7530008f26 Create proc_creation_win_ldifde_file_load.yml 2022-09-02 19:18:52 -04:00
Nasreddine Bencherchali 1adbd8f0b3 Fix after review 2022-09-02 17:44:53 +02:00
frack113 99e3b5d440 Update proc_creation_win_frp.yml 2022-09-02 17:43:19 +02:00
Florian Roth 19d8cdbaed Update proc_creation_win_susp_powershell_download_iex.yml 2022-09-02 17:36:54 +02:00
Florian Roth 168df94b73 Update proc_creation_win_susp_clsid_foldername.yml 2022-09-02 17:36:10 +02:00
frack113 5e5f3c803e Fix tag 2022-09-02 17:32:50 +02:00
frack113 8f0ade9ad9 Fix name 2022-09-02 17:28:36 +02:00
Florian Roth da6ca9ece7 Update proc_creation_win_certutil_ntlm_coercion.yml 2022-09-02 17:27:15 +02:00
Florian Roth 3d9d90f43e Update win_susp_failed_admin_share_mount.yml 2022-09-02 17:24:28 +02:00
frack113 693b7761c1 Add net_connection_win_certutil 2022-09-02 17:23:23 +02:00
Florian Roth dee6a6a7c8 Merge pull request #3451 from SigmaHQ/rule-devel 
refactor: added extension to ransomware rule
 2022-09-02 17:22:41 +02:00
Florian Roth b33b2317c8 Update proc_creation_win_frp.yml 2022-09-02 17:22:23 +02:00
Florian Roth 3e1116bbfb Update proc_creation_win_frp.yml 2022-09-02 17:19:27 +02:00
Florian Roth 6a6454cda9 fix: Health Service filter 2022-09-02 16:59:54 +02:00
Florian Roth 3ee77e1446 fix: FPs noticed with Aurora 2022-09-02 16:57:23 +02:00
Nasreddine Bencherchali f6026b6972 Update proc_creation_win_susp_schtasks_disable.yml 2022-09-02 14:39:52 +02:00
Nasreddine Bencherchali 927b29e85a Update proc_creation_win_susp_powershell_download_iex.yml 2022-09-02 14:28:47 +02:00
Nasreddine Bencherchali e0a74d6238 Update proc_creation_win_net_default_accounts_manipulation.yml 2022-09-02 14:17:17 +02:00
Nasreddine Bencherchali 0bdd7ea35c Update registry_set_sophos_av_tamaper.yml 2022-09-02 13:53:59 +02:00
Nasreddine Bencherchali 116a72c206 Fix FP 2022-09-02 13:31:49 +02:00
Nasreddine Bencherchali 3c83e6c51b Update registry_set_sophos_av_tamaper.yml 2022-09-02 12:03:57 +02:00
Nasreddine Bencherchali 884891746b Update proc_creation_win_powershell_amsi_bypass.yml 2022-09-02 12:02:18 +02:00
Nasreddine Bencherchali 37f08c4cbb More updates 2022-09-02 11:52:13 +02:00
frack113 8bb29b0e66 Add proc_creation_win_frp 2022-09-02 10:29:40 +02:00
Nasreddine Bencherchali b02a2ff2dc Update proc_creation_win_net_default_accounts_manipulation.yml 2022-09-02 09:49:14 +02:00
Nasreddine Bencherchali 5f03a73dd2 Update proc_creation_win_susp_clsid_foldername.yml 2022-09-02 09:33:13 +02:00
frack113 9e5eefd71b Merge pull request #3456 from phantinuss/master 
fix: FP in testing environment
 2022-09-02 09:30:21 +02:00
Nasreddine Bencherchali ed88295732 Update proc_creation_win_susp_clsid_foldername.yml 2022-09-02 09:28:28 +02:00
phantinuss 48ac804c9e fix: remove part of UNC path 2022-09-02 09:21:48 +02:00
Nasreddine Bencherchali d0e7732ddd Update proc_creation_win_susp_openas_rundll_usage.yml 2022-09-02 09:19:25 +02:00
Nasreddine Bencherchali 48c1104b1a New+Update 2022-09-02 09:15:21 +02:00
frack113 fc3c5cf99a Merge pull request #3455 from pH-T/master 
new rule: susp net use combo
 2022-09-02 06:58:32 +02:00
frack113 9a1a87de18 Update proc_creation_win_susp_net_use.yml 2022-09-02 06:42:47 +02:00
frack113 367e2fd0f9 Merge pull request #3450 from nasbench/master 
Updates+New Rules
 2022-09-02 06:39:15 +02:00
phantinuss dee365f562 fix: FP in testing environment 2022-09-01 17:53:06 +02:00
FabFaeb ab9e15f456 fix title 2022-09-01 17:05:32 +02:00
frack113 493336acf3 Merge pull request #3454 from elhoim/master 
Added quotes to strings for matching
 2022-09-01 16:25:23 +02:00
David ANDRE 1e791b85c0 Removing dev rule added by mistake 2022-09-01 15:44:16 +02:00
David ANDRE 33ff230ae1 Added modified date 2022-09-01 15:27:20 +02:00
David ANDRE 0b0190ccb1 Added quotes to strings 2022-09-01 15:22:26 +02:00
Paul Hager 6b2f12cbe6 fix: proc_creation_win_susp_net_use status 2022-09-01 15:01:38 +02:00