security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,089 Commits 1 Branch 57 Tags
d14e287cdf91e2a8b995de5bfbc3fa8540c1922b
Commit Graph

15089 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Tim Shelton 0d9223c45e Doesnt like single ticks around author 2022-08-03 13:36:50 +00:00
Tim Shelton 474c8d934e Ignore workstations/system execution. Normal behavior for scheduled tasks 2022-08-03 13:29:34 +00:00
Tim Shelton 74fc8903ff Reducing to a low level, as this is not a single indicator of compromise. Users and scripts from time sensitive applications such as mfa/oauth will execute net time \\host /set /y 2022-08-03 13:18:32 +00:00
Nasreddine Bencherchali 521987eaa6 Create proc_creation_win_obfuscated_ip_via_cli.yml 2022-08-03 12:16:50 +01:00
Florian Roth 3f402e3007 Merge pull request #3304 from d4rk-d4nph3/master 
Added rule for Defender DLL sideloading
 2022-08-03 10:46:37 +02:00
Florian Roth 3c67479ce2 Merge pull request #3318 from SigmaHQ/rule-devel 
rule: myjino github repo compromise
 2022-08-03 08:42:17 +02:00
Florian Roth 72dbfffc0f rule: myjino github repo compromise 2022-08-03 08:34:28 +02:00
frack113 41bbb39f99 Merge pull request #3317 from redsand/backend_hawk_http_path_resolve 
Backend: adjusting http_path to match, along with expanding event_cha…
 2022-08-03 06:30:25 +02:00
Tim Shelton 5f0347d94d Backend: adjusting http_path to match, along with expanding event_channel, since channel key has collisions 2022-08-02 23:39:49 +00:00
Tim Shelton 4d00c9a33a Adjusting the condition query 2022-08-02 23:28:42 +00:00
Tim Shelton 0c0008e8d5 Narrowing the detection due to false positive matches of webresource.axd 2022-08-02 23:18:50 +00:00
Nasreddine Bencherchali 30a43d5110 Update image_load_susp_dll_load_system_process.yml 2022-08-02 21:23:15 +01:00
Nasreddine Bencherchali d99c92b726 Update image_load_susp_dll_load_system_process.yml 2022-08-02 21:18:07 +01:00
Nasreddine Bencherchali 716ece8b4c Update proc_creation_win_exfil_data_via_cli.yml 2022-08-02 21:12:24 +01:00
Nasreddine Bencherchali d7d8a8fbc0 Fix typo 2022-08-02 21:06:52 +01:00
Nasreddine Bencherchali 37b97c4e66 New Rules 2022-08-02 21:05:07 +01:00
Nasreddine Bencherchali 5ca7846450 Renamed rule 2022-08-02 21:04:18 +01:00
Nasreddine Bencherchali 845b5c1b5d Update 2022-08-02 21:04:03 +01:00
Bhabesh 8174ca9108 Removing list with only value to pass test 2022-08-02 22:34:45 +05:45
Bhabesh 1c0c9bfbe3 Added the missing backslash 2022-08-02 22:26:32 +05:45
Bhabesh 249e20b741 Added image_load rule 2022-08-02 22:25:06 +05:45
Bhabesh 8df1415616 Removed image condition 2022-08-02 22:12:43 +05:45
Florian Roth 87a0c9e1b9 Merge branch 'master' into master 2022-08-02 18:10:24 +02:00
Florian Roth e7c57671bd reworked rule 2022-08-02 18:08:39 +02:00
Florian Roth afa0d77025 refactor: adding new channel to all backends 2022-08-02 18:08:29 +02:00
Florian Roth f0d240059e Merge pull request #3313 from isstabb/patch-1 
chore: fix case on author for consistency
 2022-08-02 17:46:47 +02:00
Florian Roth 46f47e53a3 Merge pull request #3311 from frack113/sysmon_start 
Add Filter sysmon start
 2022-08-02 16:38:48 +02:00
isstabb baac2bd1f7 chore: fix case on author for consistency 2022-08-02 08:39:57 -04:00
frack113 b897015300 Merge pull request #3312 from nasbench/nasbench-rule-devel 
Update proc_creation_win_file_permission_modifications.yml
 2022-08-02 12:50:54 +02:00
Florian Roth ff6e50bc43 Merge pull request #3306 from nasbench/nasbench-rule-devel 
Update + New Rules
 2022-08-02 12:18:47 +02:00
Nasreddine Bencherchali 87ab157844 Update proc_creation_win_file_permission_modifications.yml 2022-08-02 11:17:27 +01:00
frack113 4312151b2b Filter start 2022-08-02 10:42:03 +02:00
Bhabesh 4bbc1bc119 Support for Security-Mitigations provider 2022-08-02 13:32:22 +05:45
frack113 4ce8600749 Merge pull request #3310 from frack113/issue_3309 
Update option
 2022-08-02 09:46:46 +02:00
Florian Roth 46147bb4af Merge pull request #3303 from danielgottt/patch-3 
Create proc_creation_win_dnscmd_discovery.yml
 2022-08-02 09:35:53 +02:00
Florian Roth 54f3b95ca9 Update registry_set_disable_autologger_sessions.yml 2022-08-02 09:25:15 +02:00
Florian Roth 32ee7ead9f Update registry_set_disable_autologger_sessions.yml 2022-08-02 09:22:32 +02:00
Florian Roth abc9aeb829 Update proc_creation_win_reg_delete_services.yml 2022-08-02 09:21:56 +02:00
Florian Roth a94cdaca8b Update registry_set_policies_attachments_tamper.yml 2022-08-02 09:17:08 +02:00
Florian Roth f9716b86e4 Update registry_set_windows_defender_tamper.yml 2022-08-02 09:16:26 +02:00
Florian Roth 225932fef7 Update registry_set_policies_associations_tamper.yml 2022-08-02 09:15:57 +02:00
Florian Roth 8399760902 Merge pull request #3307 from nasbench/webshell-children 
Update Children Of Web Shell Rules
 2022-08-02 09:12:00 +02:00
frack113 211bb6a760 Update option 2022-08-02 09:06:10 +02:00
frack113 7f9561a23f Merge pull request #3308 from leegengyu/patch-1 
Update proc_creation_win_false_sysinternalsuite.yml
 2022-08-02 07:34:04 +02:00
G Y ebb753814b Update proc_creation_win_false_sysinternalsuite.yml 
Typo + grammatical correction in description field
 2022-08-02 11:19:14 +08:00
Nasreddine Bencherchali be25ff87e2 Update proc_creation_lnx_webshell_detection.yml 2022-08-01 23:40:34 +01:00
Nasreddine Bencherchali 7f1207957c Update proc_creation_win_sc_delete_av_services.yml 2022-08-01 23:39:08 +01:00
Nasreddine Bencherchali b984ee65b3 Update proc_creation_win_webshell_spawn.yml 2022-08-01 23:28:53 +01:00
Nasreddine Bencherchali f45eba2002 Update proc_creation_lnx_webshell_detection.yml 2022-08-01 23:28:49 +01:00
Nasreddine Bencherchali 921af82587 Update proc_creation_win_reg_import_from_suspicious_paths.yml 2022-08-01 20:25:29 +01:00