security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,511 Commits 1 Branch 57 Tags
e91fc4486e57fc40e30d12253694de4c80a9e4ea
Commit Graph

2788 Commits

Author SHA1 Message Date
yugoslavskiy 0ed153237e Merge pull request #1226 from stvetro/oscd-winword 
[OSCD] - Force winword.exe to load DLL (LoLBin)
 2021-01-06 00:23:52 +03:00
yugoslavskiy 1d2f027035 Merge pull request #1224 from stvetro/oscd 
[OSCD] Verclsid.exe Runs COM Object (LOLBin)
 2021-01-06 00:23:45 +03:00
yugoslavskiy f4578b0698 Merge pull request #1223 from zinint/1009-23-1 
[OSCD] Detects Obfuscated Powershell via RUNDLL Launcher #23 (4104, 4103 + Services + process_creation)
 2021-01-06 00:23:33 +03:00
yugoslavskiy 23519e47cd Merge pull request #1222 from feedb/oscd 
[OSCD] zer0w
 2021-01-06 00:23:25 +03:00
yugoslavskiy 93718975fb Merge pull request #1221 from grikos/OSCD_117_128 
[OSCD] suspicious csi.exe (rcsi.exe)  LOLBAS detection rule
 2021-01-06 00:23:13 +03:00
yugoslavskiy cd62929bb0 Merge pull request #1220 from aw350m33d/PS_exec_via_redirected_input_stream 
[OSCD] LOLBIN 5 PowerShell with redirection of the input stream.
 2021-01-06 00:23:06 +03:00
yugoslavskiy a5bbccf16c Merge pull request #1214 from tas-kmanager/mt-oscd-sigma547-48-alternative 
[OSCD] Always Install Elevated Alternative
 2021-01-06 00:22:37 +03:00
yugoslavskiy 2cf1994763 Merge pull request #1206 from w0rk3r/oscd5 
[OSCD] Windows - Suspicious Service DACL Modification
 2021-01-06 00:18:53 +03:00
yugoslavskiy aad2838f58 Merge pull request #1198 from tas-kmanager/mt-oscd-sigma547-50-rule2 
[OSCD] Always Install Elevated - Slide 50 - Rule 2
 2021-01-06 00:18:44 +03:00
yugoslavskiy 0b7babaa84 Merge pull request #1196 from tas-kmanager/mt-oscd-sigma547-50-rule1 
[OSCD] Always Install Elevated - Slide 50 - Rule 1
 2021-01-06 00:18:26 +03:00
yugoslavskiy 8e50eeb4a9 Merge pull request #1187 from nsaddler/lolbas108 
[OSCD] LOLBAS Manage-bde.yml
 2021-01-06 00:18:02 +03:00
yugoslavskiy e91d48cc93 Merge pull request #1185 from nsaddler/lolbas107_1 
[OSCD] LOLBAS CL_Mutexverifiers - process_creation
 2021-01-06 00:17:46 +03:00
yugoslavskiy def4a7dbb9 Merge pull request #1183 from nsaddler/lolbas106 
[OSCD] LOLBAS CL_Invocation - process_creation
 2021-01-06 00:17:01 +03:00
yugoslavskiy e1fd69f548 Merge pull request #1179 from SanWieb/OSCD_regedit_3 
[OSCD] regedit.exe LOLbas 72 [3]
 2021-01-06 00:16:45 +03:00
yugoslavskiy 8e6b77fc4f Merge pull request #1177 from OpalSec/oscd 
[OSCD] Tasks 24, 25 & 26: Detection for Invoke-Obfuscation CLIP+, STDIN+ & VAR+ Launchers
 2021-01-06 00:16:34 +03:00
yugoslavskiy 95d8a9daf0 Merge pull request #1174 from uncleAntik/update 
[OSCD] LOLBin vsjitdebugger.exe #136
 2021-01-06 00:16:20 +03:00
yugoslavskiy 252345ca00 Merge pull request #1173 from uncleAntik/fix 
[OSCD] LOLBin te.exe #133
 2021-01-06 00:16:12 +03:00
yugoslavskiy 1fd0afc58e Merge pull request #1167 from tas-kmanager/mt-oscd-sigma547-43 
[OSCD] Add Accesschk tool usage rule
 2021-01-06 00:14:08 +03:00
yugoslavskiy 5ec4e42569 Merge pull request #1165 from w0rk3r/oscd3 
[OSCD] Updated win_etw_trace_evasion - Added new detections, Removed reference to deprecated rule and changed selections
 2021-01-06 00:12:22 +03:00
yugoslavskiy 4c8e0b201d Merge pull request #1162 from uncleAntik/131 
[OSCD] LOLBin sqltoolsps.exe #131
 2021-01-06 00:11:33 +03:00
yugoslavskiy 0bd955f097 Merge branch 'oscd' into oscd-5 2021-01-06 00:09:47 +03:00
yugoslavskiy dd7a95ac74 Merge pull request #1081 from cy1337/patch-1 
[OSCD] Added nltest LOLBIN
 2021-01-05 23:16:14 +03:00
yugoslavskiy 1c1c38e091 Merge pull request #1119 from uncleAntik/oscd 
[OSCD] sqlps.exe LOLbin
 2021-01-05 23:14:02 +03:00
yugoslavskiy 39991a8ab6 Merge pull request #1106 from stvetro/2020 
[OSCD] Suspicious ftp.exe usage (LOLBin)
 2021-01-05 23:13:03 +03:00
yugoslavskiy 804db42b7a Merge pull request #1105 from Vasilisa-L/OSCD_rasautou 
[OSCD] Rasautou.exe LOLbin
 2021-01-05 23:12:48 +03:00
yugoslavskiy 794cd7aaeb Merge pull request #1104 from Vasilisa-L/OSCD_rpcping 
[OSCD] rpcping lolbin
 2021-01-05 23:12:35 +03:00
yugoslavskiy 05b03afddb Merge pull request #1103 from concorde18/oscd_win_susp_diskshadow 
[OSCD] win_susp_diskshadow
 2021-01-05 23:10:55 +03:00
yugoslavskiy d48bac226f Merge pull request #1099 from NikitaStormwind/regular31(2) 
[OSCD] Detects Obfuscated Powershell via use MSHTA in Scripts #31 (process_creation)
 2021-01-05 23:10:46 +03:00
yugoslavskiy ae3c0d0801 Merge pull request #1095 from esebese/task136 
[OSCD]win_pe_exec_vsjitdebugger.yml added
 2021-01-05 23:10:18 +03:00
yugoslavskiy aa9182593a Merge pull request #1087 from Vasilisa-L/OSCD_pester.bat 
[OSCD] 109: Pester.bat
 2021-01-05 23:09:47 +03:00
yugoslavskiy 1992b1ac9f Merge pull request #1074 from semanurguneysu/oscd 
[OSCD] Create sysmon_abusing_debug_privilege.yml
 2021-01-05 23:06:57 +03:00
yugoslavskiy ff373b0f33 Update win_nltest_query.yml 2021-01-05 23:03:41 +03:00
yugoslavskiy bceb3c8af0 Merge pull request #1047 from grikos/sigma/oscd 
[OSCD] Registry modify via VBoxDrvInst
 2021-01-05 23:00:20 +03:00
Florian Roth 40e0e3bc99 Merge pull request #1193 from w0rk3r/oscd_rules_improvement 
[OSCD] Windows Rules - Review for improvements on selections and logic
 2020-12-31 12:10:15 +01:00
Florian Roth ab408750ac Merge pull request #1314 from Neo23x0/rule-devel 
rule: Lazarus activity
 2020-12-30 13:27:38 +01:00
Florian Roth 9ecaeb715f Merge pull request #1317 from rtkdmasse/fix-missing-product-mouse-lock 
Fix missing product mouse lock
 2020-12-30 13:27:20 +01:00
ZikyHD 8a6b182fee Update win_susp_adfind.yml 2020-12-29 14:41:46 +01:00
ZikyHD ece829bb25 Update win_susp_adfind.yml 
Typo on field name
 2020-12-29 14:40:36 +01:00
Florian Roth 43033ab874 Update win_susp_emotet_rudll32_execution.yml 2020-12-25 09:05:55 +01:00
Tran Trung Hieu d551b88d5c Edit title convention 2020-12-25 14:21:26 +07:00
Tran Trung Hieu 4297e68704 Detect Emotet DLL loading by looking rundll32.exe 2020-12-25 14:09:40 +07:00
Daniel Masse bf539fd1fe Revert "Fix bug changing the logsource service to category" 
This reverts commit 0f51e53d0e.
 2020-12-23 15:50:49 -05:00
Daniel Masse 71ea5c7437 Add missing product in logsource 2020-12-23 15:45:00 -05:00
Daniel Masse 0f51e53d0e Fix bug changing the logsource service to category 2020-12-23 15:12:31 -05:00
Daniel Masse d2edf715f2 Split up cmstp rule into 3 separate rules and remove duplicates 2020-12-23 12:17:39 -05:00
Florian Roth dedc34e91a fix: typos and description 2020-12-23 14:46:08 +01:00
Florian Roth cdc29dfbe8 rule: Lazarus activity 2020-12-23 14:43:32 +01:00
Florian Roth 821af35557 Merge pull request #1313 from Neo23x0/rule-devel 
Rule devel
 2020-12-23 13:57:11 +01:00
Florian Roth 7286d01f78 fix: typo in rule 2020-12-23 13:26:44 +01:00
Florian Roth 80aa398392 rule: Lazarus group loaders 2020-12-23 13:25:16 +01:00