security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,607 Commits 1 Branch 57 Tags
db8cc0ee2d64e524d4c1912f8362fce8cf9e19a7
Commit Graph

3876 Commits

Author SHA1 Message Date
Florian Roth db8cc0ee2d Merge pull request #1656 from SigmaHQ/rule-devel 
rule: suspicious vss ps load / PrinternightMare updates
 2021-07-08 15:03:28 +02:00
Florian Roth c91eda7660 Merge pull request #1610 from cianmcgovern/powershell-network-connection 
Move ipv6 check to selection fields as filter is negated
 2021-07-08 14:53:36 +02:00
Florian Roth 0518439de7 Merge pull request #1648 from frack113/fix_windows_fields 
Fix more windows fields name
 2021-07-08 14:53:14 +02:00
Florian Roth f78b353352 PrinterNightmare rule updates 2021-07-08 14:35:51 +02:00
Florian Roth 2055f78780 refactor: make the rule more usable 2021-07-08 09:05:57 +02:00
Florian Roth 79338b2dbd fix: title 2021-07-08 08:33:46 +02:00
Florian Roth 96ea35fd92 rule: suspicious vss ps load 2021-07-07 18:21:57 +02:00
Florian Roth 25dec8a17b Merge pull request #1649 from leegengyu/patch-9 
Update win_apt_apt29_thinktanks.yml - Links
 2021-07-07 18:10:27 +02:00
Florian Roth c3c152d457 Merge pull request #1652 from SigmaHQ/rule-devel 
refactor: changed cmdkey rule
 2021-07-07 18:09:44 +02:00
frack113 8a96aa7855 Add 2 defense-evasion T1562.001 rules 2021-07-07 15:43:55 +02:00
Florian Roth 0c7661e8bc refactor: changed cmdkey rule 2021-07-07 14:45:03 +02:00
G Y 1adac5b036 Update win_apt_apt29_thinktanks.yml - Links 
Reference links updated with grammar corrections.
 2021-07-07 20:21:41 +08:00
frack113 4e3b275056 Fix more windows fields name 2021-07-07 12:28:00 +02:00
Florian Roth 792f234872 Merge pull request #1636 from leegengyu/patch-6 
powershell_data_compressed.yml - Update selection
 2021-07-07 10:12:52 +02:00
Florian Roth 2e15742a37 Merge pull request #1637 from frack113/fix_win_rdp_reverse_tunnel.yml 
win_rdp_reverse_tunnel.yml  fix invalid field name
 2021-07-07 10:12:16 +02:00
Florian Roth 6e00745288 Merge pull request #1638 from frack113/fix_win_external_device.yml 
win_external_device.yml  fix invalid field name
 2021-07-07 10:12:04 +02:00
Florian Roth bd0628240c Merge pull request #1639 from frack113/fix_win_possible_dc_shadow.yml 
fix invalid field EventID 5136
 2021-07-07 10:11:51 +02:00
Florian Roth ad36a03622 Merge pull request #1640 from frack113/fix_win_susp_local_anon_logon_created.yml 
win_susp_local_anon_logon_created.yml fix invalid case SamAccountName
 2021-07-07 10:11:36 +02:00
Florian Roth dc2377be13 Merge pull request #1644 from leegengyu/patch-7 
Update win_admin_rdp_login.yml - Fix Field Name & Value
 2021-07-07 10:04:02 +02:00
Florian Roth 0573097696 Merge pull request #1645 from leegengyu/patch-8 
Update win_mal_service_installs.yml - Corrected logsource
 2021-07-07 10:03:48 +02:00
frack113 bb970de5b7 fix invalid fields name 2021-07-07 09:05:00 +02:00
G Y 6b63a309da Update win_mal_service_installs.yml - Corrected logsource 
Fix mistake (incorrect logsource for event ID 4697) in #1629.
 2021-07-07 10:33:26 +08:00
G Y eece2850a7 Update win_admin_rdp_login.yml - Fix Field Name 
1. Field name changed to `TargetUserName`.
Source: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624

2. Value changed from `Admin-` to `Admin`.
 2021-07-07 09:43:55 +08:00
frack113 9cf1d3d5f3 fix invalid case SamAccountName 2021-07-06 15:43:07 +02:00
frack113 bbf908835e fix invalid field EventID 5136 2021-07-06 15:25:32 +02:00
leegengyu 3594b10d74 Insert modified date 2021-07-06 20:56:31 +08:00
G Y c5d2a55f6d powershell_data_compressed.yml - Update selection 
Changed to ScriptBlockText (due to PowerShell logging-specific context).
 2021-07-06 20:36:38 +08:00
Florian Roth bcf2bf2e4d Merge pull request #1635 from frack113/fix_win_susp_failed_logons_single_source_kerberos 
Fix invalid field name
 2021-07-06 14:35:06 +02:00
frack113 b0c9bc1d2d fix invalid field name EventID 6416 2021-07-06 14:27:29 +02:00
frack113 fca3c72087 fix invalid field name 2021-07-06 14:16:01 +02:00
Florian Roth ff0f1a0222 Merge pull request #1633 from leegengyu/art_convert_yaml_to_md 
Convert ART reference links from .yaml to .md
 2021-07-06 13:39:37 +02:00
frack113 12fb71b83b fix invalid field name 2021-07-06 12:53:38 +02:00
leegengyu 1f19f79da9 Convert ART reference links from .yaml to .md 2021-07-06 17:56:38 +08:00
Florian Roth 705415c2bd Merge pull request #1632 from frack113/process_creation_OriginalFileName 
change OriginalFilename case
 2021-07-06 11:45:21 +02:00
leegengyu 69d5d9734d Updated ART reference links from .yaml 2021-07-06 17:39:25 +08:00
leegengyu 5eb9547d5b Updated ART reference links from .yaml to .md and sub-technique links. 2021-07-06 17:30:57 +08:00
leegengyu 7557732ca2 Updated ART reference links from .yaml to .md and sub-technique links. 2021-07-06 17:21:22 +08:00
Florian Roth 8beb70e970 Merge pull request #1631 from leegengyu/patch-5 
Update mordordatasets links
 2021-07-06 10:45:15 +02:00
Florian Roth 223ae079ea Merge pull request #1627 from SigmaHQ/rule-devel 
rule: PrinterNightmare Mimikatz update
 2021-07-06 10:44:48 +02:00
Florian Roth e31f0c8f7f Merge pull request #1628 from d4rk-d4nph3/master 
Added and updated Defender's tamper related rules
 2021-07-06 10:44:33 +02:00
Florian Roth 17f7bbc063 Merge pull request #1630 from frack113/fix_childimage 
childimage do not exist in sysmon schema
 2021-07-06 10:44:00 +02:00
leegengyu 5d10cc68da Update mordordatasets references 2021-07-06 16:35:20 +08:00
G Y 7f15b0a075 Update win_smb_file_creation_admin_shares.yml - Dead link 
Updated dead link.
 2021-07-06 16:24:02 +08:00
frack113 cfccdea28e change OriginalFilename case 2021-07-06 10:09:47 +02:00
G Y aab65361da Update rules/windows/builtin/win_mal_service_installs.yml 
Add modified date.

Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
 2021-07-06 00:50:23 -07:00
frack113 9c94cf42fe childimage do not exist in sysmon schema 2021-07-06 09:26:43 +02:00
G Y a0407cf477 Update win_mal_service_installs.yml - Add new Event ID 
Added event ID 4697, which is equivalent to existing event ID 7045.
 2021-07-06 12:11:32 +08:00
G Y c01ec60e7d Update win_mal_service_installs.yml - Add new service 
Add new malicious service (javamtsup) by APT29 and add reference links.
 2021-07-06 11:03:08 +08:00
Bhabesh Rai 3bc6532049 Added and updated Defender's tamper related rules 2021-07-05 20:30:07 +05:45
Florian Roth e5849a08f1 rule: PrinterNightmare Mimikatz update 
https://github.com/gentilkiwi/mimikatz/commit/51dc7c0363d4e1e1eb2d35f5d5a25841b0801861#diff-cf4373b6c7195386ac1973681e5561bd96e1bb9e099cfd3febd1111e986bd17cL1450-R1451
 2021-07-05 15:29:52 +02:00