security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,511 Commits 1 Branch 57 Tags
e91fc4486e57fc40e30d12253694de4c80a9e4ea
Commit Graph

6187 Commits

Author SHA1 Message Date
Bhabesh Rai 6859b6c38f Added rule for detection of Atera RMM Agent installation 2021-09-01 15:24:47 +05:45
frack113 af599e4877 Merge pull request #1958 from phantinuss/master 
Bulk of new rules, mainly UAC Bypasses
 2021-09-01 10:53:02 +02:00
frack113 892c58270a Update tags 2021-09-01 10:33:57 +02:00
frack113 4b8ffbc183 Update tags 2021-09-01 10:30:43 +02:00
phantinuss 9ffdced740 fix: implement suggestions from PR discussion 2021-09-01 10:21:37 +02:00
frack113 240c5584ff update tags 2021-09-01 09:56:46 +02:00
frack113 6f3fc7036e Update tags 2021-09-01 09:45:31 +02:00
frack113 3ed7d6e330 Merge pull request #1959 from frack113/update_ps 
Update PowerShell rules
 2021-09-01 08:06:31 +02:00
Cyb3rEng 470d64e66c Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:28:34 -06:00
Cyb3rEng e0e1396dff Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:26:44 -06:00
Cyb3rEng e7c7e4c061 Updated Rule 
Detection changed to #useful_information
 2021-08-31 22:24:28 -06:00
Cyb3rEng f2b8b83fe3 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:23:45 -06:00
Cyb3rEng 0d2257fb19 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:22:01 -06:00
Cyb3rEng 1b9a0c4a01 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:20:17 -06:00
Cyb3rEng c5507658c0 Updated Rule 
updated title
 2021-08-31 22:13:31 -06:00
Cyb3rEng d309784e58 Updated Rule 
Modified Title
 2021-08-31 22:12:34 -06:00
Cyb3rEng 93334878f5 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:09:57 -06:00
Cyb3rEng 785fc98ee3 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 22:05:10 -06:00
Cyb3rEng d5f73a8910 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 22:03:31 -06:00
Cyb3rEng fa3b882fdc Updated Rule 
Removed " " from falsepositives section
 2021-08-31 21:58:50 -06:00
Cyb3rEng c7c49c55d2 Updated Rule 
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 21:58:09 -06:00
Cyb3rEng d5fa226180 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 21:54:32 -06:00
Cyb3rEng 900f71e6b2 Rule Update Review 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 21:50:44 -06:00
frack113 cff572b752 Update sysmon_dns_over_https_enabled.yml 2021-08-31 17:11:04 +02:00
phantinuss add1ad40f8 additional UAC bypass rule 2021-08-31 16:23:32 +02:00
phantinuss 59d8e0b866 add System IntegrityLevel to uac bypass rules, the level is not used most of the time, but might 2021-08-31 16:18:05 +02:00
Austin Songer 9dc8d38565 Create sysmon_dns_over_https_enabled.yml 2021-08-31 09:14:14 -05:00
phantinuss 6eb7245673 fix: remove user sid, match any sid instead 2021-08-31 15:58:57 +02:00
frack113 eb434732a7 move rule not only powershell 2021-08-31 13:48:07 +02:00
frack113 18cdc36d73 Fix EventID 4103 detection 2021-08-31 13:44:54 +02:00
phantinuss 3a9e10d081 bulk of new rules to match working UACMe UAC bypasses 2021-08-31 12:51:21 +02:00
phantinuss ea77d9161e add another possible sdclt uac bypass registry path 2021-08-31 12:51:21 +02:00
phantinuss 50b8ca5110 add more COM interfaces and sharpen rule logic 2021-08-31 12:51:21 +02:00
phantinuss 3155f7172d detection for proxyshell MSF module 2021-08-31 12:51:16 +02:00
frack113 b25fbbea54 Merge pull request #1957 from d4rk-d4nph3/master 
Added new malwarebytes reference for Cab File Expansion rule
 2021-08-31 09:54:47 +02:00
Bhabesh Rai 911c45201a Added -F option support 2021-08-31 13:02:53 +05:45
frack113 89e21c69ef fix detection 2021-08-31 09:07:54 +02:00
Bhabesh Rai e2bfaea10f Added new malwarebytes reference for Cab File Expansion rule 2021-08-31 11:35:54 +05:45
Cyb3rEng e913032865 Add files via upload 2021-08-30 21:50:16 -06:00
Cyb3rEng 6c9b2a2f37 Add files via upload 2021-08-30 21:48:03 -06:00
Cyb3rEng 5508ff45b6 Add files via upload 2021-08-30 21:47:36 -06:00
frack113 acf59f9795 Fix some errors 2021-08-30 19:49:44 +02:00
Florian Roth 36a227796a Merge pull request #1945 from SigmaHQ/rule-devel 
rules: cobalt strike rules refactored
 2021-08-30 15:48:01 +02:00
Florian Roth 98de92ceaf refactor: global rule match on system and security 2021-08-30 15:17:53 +02:00
Florian Roth 1ded4eb913 rules: cobalt strike rules refactored 2021-08-30 15:10:30 +02:00
frack113 4c414b2e8b fix Base backend doesn't support multiple conditions (33) 2021-08-29 08:52:54 +02:00
frack113 970dfa2f92 Merge pull request #1938 from EvanYu0816/upstream-fixes 
Fix Pass the Hash and NotPetya Ransomware rule
 2021-08-28 21:02:04 +02:00
frack113 a7456d4d6c Merge pull request #1940 from frack113/fix_ps_fp 
Powershell correction
 2021-08-28 20:48:07 +02:00
frack113 3e355c64db Merge pull request #1939 from SigmaHQ/rule-devel 
rule: UAC bypass by mocking dirs
 2021-08-28 20:47:27 +02:00
frack113 68237dffc4 fix HostApplication 2021-08-28 08:18:47 +02:00