security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
10,511 Commits 1 Branch 57 Tags
e91fc4486e57fc40e30d12253694de4c80a9e4ea
Commit Graph

582 Commits

Author SHA1 Message Date
Roberto Rodriguez 7618cf4672 Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell 2021-09-17 04:23:11 -04:00
frack113 33a51df46a Update lnx_system_info_discovery.yml 2021-09-14 21:03:46 +02:00
frack113 a6da209507 Update lnx_auditd_system_info_discovery2.yml 2021-09-14 21:02:51 +02:00
frack113 a3477893de Update lnx_auditd_network_service_scanning.yml 2021-09-14 21:02:13 +02:00
frack113 83531bb2ff split global lnx_system_info_discovery.yml 2021-09-14 20:13:57 +02:00
frack113 38c0f83eaf split global lnx_sudo_cve_2019_14287.yml 2021-09-14 20:07:13 +02:00
frack113 87e5fc48fa split global lnx_security_tools_disabling.yml 2021-09-14 19:32:58 +02:00
frack113 ecefc6e913 add missing product 2021-09-14 19:29:49 +02:00
frack113 bc69900335 split global lnx_network_service_scanning.yml 2021-09-14 19:27:28 +02:00
frack113 30955c4884 split global lnx_auditd_cve_2021_3156_sudo_buffer_overflow.yml 2021-09-14 19:24:11 +02:00
frack113 1e4484bffb split lnx_auditd_cve_2021_3156_sudo_buffer_overflow 2021-09-14 19:22:56 +02:00
frack113 7298225cbe Merge pull request #2028 from zakibro/master 
New Rule - Linux - Auditd - Screen Capture with xwd
 2021-09-14 09:58:11 +02:00
zakibro e47a7d9826 Update lnx_auditd_screencaputre_xwd.yml 2021-09-13 19:08:23 +02:00
Pawel Mazur a8f9617ccd New Rule - Linux - Auditd - Screen Capture with xwd 2021-09-13 18:56:33 +02:00
frack113 dc5c26ad2d Merge pull request #2018 from zakibro/master 
New Linux Auditd Rules - Steghide Steganography
 2021-09-12 08:29:56 +02:00
zakibro 6412ddaaee Update lnx_auditd_steghide_extract_steganography.yml 2021-09-11 11:19:21 +02:00
zakibro d0741f9f3a Update lnx_auditd_steghide_embed_steganography.yml 
Formatting and detection changes
 2021-09-11 11:18:08 +02:00
Pawel Mazur 89f15c01f9 New Linux Auditd Rules - Steghide Steganography 2021-09-11 10:56:17 +02:00
frack113 4a03ef6e0b Merge pull request #2007 from zakibro/master 
New Rule - Linux Auditd Hidden Files - Steganography
 2021-09-10 09:18:28 +02:00
zakibro a4dffc14d4 Update lnx_auditd_unzip_hidden_zip_files_steganography.yml 
Fixing formatting
 2021-09-10 07:54:56 +02:00
zakibro 0b5e8cb980 Update lnx_auditd_hidden_zip_files_steganography.yml 
Formatting changes
 2021-09-10 07:52:35 +02:00
Pawel Mazur 5a5769cce6 New Rule - Linux - Steganography Unzip Hidden Information From Picture File 2021-09-09 20:38:25 +02:00
zakibro 3fbe5478c3 Update and rename lnx_auditd_hidden_files_steganography.yml to lnx_auditd_hidden_zip_files_steganography.yml 
Splitting the rule into separate rules
 2021-09-09 20:34:20 +02:00
zakibro 458973af81 Update lnx_auditd_hidden_files_steganography.yml 
Adding missing field: action
 2021-09-09 16:52:58 +02:00
zakibro 62db796fc2 Update lnx_auditd_hidden_files_steganography.yml 
Formatting changes
 2021-09-09 16:46:41 +02:00
zakibro 0971fe1d49 Update lnx_auditd_hidden_files_steganography.yml 
Fixing the listing issue
 2021-09-09 16:27:57 +02:00
Pawel Mazur 41458d8a5a New Rule - Linux Auditd Hidden Files - Steganography 2021-09-09 16:13:27 +02:00
frack113 4c3f8821c4 add missing tags 2021-09-07 18:16:46 +02:00
zakibro bba66ca762 Update lnx_auditd_hidden_files_directories.yml 
Updating arguments section
 2021-09-07 07:57:50 +02:00
zakibro e9fa5bde2b Update lnx_auditd_hidden_files_directories.yml 
Correction of tag
 2021-09-06 18:55:58 +02:00
Pawel Mazur 7c2895c73f New Rule - Linux Hidden Files and Directories 2021-09-06 18:43:49 +02:00
Pawel Mazur 59eb7ce032 Merge branch 'master' of https://github.com/zakibro/sigma 2021-09-06 18:41:19 +02:00
Pawel Mazur 9f5f25e480 New Rule - Linux Hidden Files and Directories 2021-09-06 18:40:39 +02:00
zakibro f52860d6ab Merge branch 'SigmaHQ:master' into master 2021-09-06 18:40:02 +02:00
Pawel Mazur 3eb354e34c Merge branch 'master' of https://github.com/zakibro/sigma 2021-09-06 18:37:45 +02:00
Pawel Mazur ef3efd8fd3 New Rule Linux - Hidden Files and Directories 2021-09-06 18:37:02 +02:00
Florian Roth 6b2bacd2cc Merge pull request #1979 from frack113/test_global 
Change ID in global action rule
 2021-09-06 08:44:14 +02:00
zakibro 5042ba65ac Update lnx_auditd_audio_capture.yml 
Added more references about arecord.
 2021-09-05 09:28:53 +02:00
Pawel Mazur caf78b5ea1 New Rule - Linux-Audio-Capture 2021-09-04 22:10:34 +02:00
frack113 769451dc03 Add missing id 2021-09-03 13:42:15 +02:00
frack113 815134df7f Cleanup 2021-09-03 13:30:10 +02:00
zakibro 8bd859f550 Update lnx_auditd_system_info_discovery.yml 2021-09-03 13:07:42 +02:00
Pawel Mazur 864286e206 New Rule - Linux-Auditd-System Information Discovery 2021-09-03 11:33:18 +02:00
frack113 086a15fc45 Update global ID 2021-09-02 20:07:03 +02:00
f.hubaut e66007a43d fix file name case 2021-08-26 11:15:33 +02:00
frack113 5b869a3f42 Update cve tags 2021-08-24 10:50:01 +02:00
SomeOne 295054dcbe Replace old mitre techniques by new one 2021-08-22 13:57:56 +02:00
frack113 eb406ba36f Merge pull request #1844 from frack113/cleanup 
Add more compliance test
 2021-08-16 17:17:25 +02:00
frack113 e45557316e Fix selection with only 1 element 2021-08-14 09:54:27 +02:00
Max Altgelt ce326cb903 fix: Correct broken rules, add documentation 2021-08-13 15:46:30 +02:00