security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
16,717 Commits 1 Branch 57 Tags
d5188c36a1c19eb101194a9c263a8e3ce285aa1e
Commit Graph

6 Commits

Author SHA1 Message Date
Matt Anderson 30aebbb65c Merge PR #5834 from @MATTANDERS0N - Add Devcon and KDU Execution Rules 
new: PUA - Kernel Driver Utility (KDU) Execution
new: Devcon Execution Disabling VMware VMCI Device

---------

Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
 2026-01-24 12:36:29 +01:00
Swachchhanda Shrawan Poudel c8b1a0ff67 Merge PR #5805 from @swachchhanda000 - Add regression tests for curl-related rules 
update: Curl Web Request With Potential Custom User-Agent - add another curl supported flag for header
chore: add regression tests for curl-related rules
 2025-12-25 20:50:48 +05:45
Swachchhanda Shrawan Poudel c5b881019a Merge PR #5777 from @swachchhanda000 - feat: more edrfreeze rules 
new: WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze
new: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
new: Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
new: Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze
update: Hacktool - EDR-Freeze Execution - add more coverage
---------

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
 2025-12-10 15:29:38 +01:00
Swachchhanda Shrawan Poudel f05a8c4d94 Merge PR #5788 from @swachchhanda000 - Recon via RDP Logging Event 
update: Potentially Suspicious EventLog Recon Activity Using Log Query Utilities - add more interesting event ids

---------

Co-authored-by: Nasreddine Bencherchali <nasbench@users.noreply.github.com>
 2025-12-09 08:48:59 +05:45
Koifman 0aa29891df Merge PR #5782 from @Koifman - Add Github Self-Hosted Runner Execution 
new: Github Self-Hosted Runner Execution

---------

Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
 2025-12-04 00:55:53 +01:00
Swachchhanda Shrawan Poudel c141859b83 Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory 
chore: restructure regression testing data directory
 2025-11-26 11:08:11 +01:00