security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,511 Commits 1 Branch 57 Tags
e91fc4486e57fc40e30d12253694de4c80a9e4ea
Commit Graph

6187 Commits

Author SHA1 Message Date
Florian Roth c1f9c33730 rule: SystemNightmare 2021-08-11 10:10:30 +02:00
Florian Roth d9d1e2c578 Merge pull request #1823 from SigmaHQ/rule-devel 
rule: ProxyLogon rule for MS Exchange
 2021-08-11 09:43:41 +02:00
phantinuss 62eca463ac new rule LittleCorporal generated maldoc process injection 2021-08-11 09:25:23 +02:00
frack113 63ead346e8 fix modified value 2021-08-10 19:09:34 +02:00
Florian Roth 73a4bd74dc fix: FPs script exec from temp 2021-08-10 17:10:46 +02:00
frack113 6d869feb43 update modified 2021-08-10 15:12:45 +02:00
Jon Galarneau 1544a351a3 Correcting regex in win_modif_of_services_for_via_commandline.yml 
The ^ symbol designates the beginning of the string, but in this rule it is clearly intended to be the end of the string.
 2021-08-10 08:29:39 -04:00
Florian Roth 17c6fc7038 rule: ProxyLogon rule for MS Exchange 2021-08-10 09:16:30 +02:00
Florian Roth 17fb418271 Merge pull request #1817 from SigmaHQ/rule-devel 
rules: ProxyShell refactoring and new rule
 2021-08-10 08:18:32 +02:00
frack113 78e0e570dd Split PR 1802 builtin net rules 2021-08-09 20:23:35 +02:00
Florian Roth dbf8aecd83 fix: typo in cmdlet name 2021-08-09 18:05:51 +02:00
Florian Roth a9ad4eda4a rules: ProxyShell refactoring and new rule 2021-08-09 17:57:34 +02:00
frack113 dd2aa8706d Merge pull request #1786 from j91321/anydesk 
Silent installation of AnyDesk (Conti)
 2021-08-09 08:57:32 +02:00
frack113 bacb44ab97 Merge pull request #1780 from Sam0x90/master 
Adding detection rule for esentutl utility
 2021-08-07 16:23:45 +02:00
frack113 f75f8fabab fix file name 2021-08-07 15:54:43 +02:00
frack113 07d21c58e8 Update process_susp_esentutl_params.yaml 2021-08-07 15:49:25 +02:00
frack113 89ee63f63b Merge pull request #1791 from SigmaHQ/rule-devel 
More rules - including the ones for ProxyShell
 2021-08-07 11:49:16 +02:00
Florian Roth 9be9e4a24f fix: more changes to incomplete windivert rule 2021-08-07 11:22:44 +02:00
Florian Roth 88a721a1ab docs: add space in title 2021-08-07 10:13:05 +02:00
Florian Roth 1dcf25878c Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel 2021-08-07 10:10:48 +02:00
Florian Roth 0a8904a61e fix: issues with new rule 2021-08-07 10:10:12 +02:00
frack113 5f89a29ea7 fix file name 2021-08-07 10:01:23 +02:00
Florian Roth 1ac49a2055 rule: ProxyShell patterns 2021-08-07 09:22:24 +02:00
Florian Roth c0360cd1ca change name and line breaks 2021-08-06 18:53:08 +02:00
Florian Roth 7de55075f7 fix: condition 2021-08-06 18:45:38 +02:00
Florian Roth d69e2333c8 various fixes 2021-08-06 18:44:54 +02:00
Florian Roth e02b85dc99 '--start-with-win' is pretty specific 2021-08-06 18:41:14 +02:00
Ján Trenčanský 2f3b48c347 Fix title 2021-08-06 14:18:30 +02:00
Ján Trenčanský 516e1ade6d Silent installation of AnyDesk 2021-08-06 14:06:35 +02:00
frack113 f4bef0fc39 Add Microsoft-Windows-Windows Defender/Operational 2021-08-06 11:12:34 +02:00
frack113 cf8d8d3ed4 fix TargetFilename case error 2021-08-06 08:43:05 +02:00
Sam0x90 96911e55b9 Adding detection rule for esentutl utility 
Used by Conti affiliates to target NTDS file and MSEdge info
 2021-08-06 00:55:57 +04:00
Florian Roth eb247704fe Merge pull request #1761 from d4rk-d4nph3/master 
Added rule for Cabinet file expansion and Pypykatz
 2021-08-05 15:50:12 +02:00
Florian Roth c44b22b52f Merge pull request #1762 from frack113/redcanary_collection 
[OSCD] Redcanary TA0009 collection
 2021-08-05 15:49:10 +02:00
Florian Roth 83505351bc Merge pull request #1764 from frack113/fix_product 
fix product sysmon_apt_sourgrum.yml
 2021-08-05 15:48:35 +02:00
Florian Roth 448868302d Merge pull request #1767 from frack113/redcanary_t1497_001 
[OSCD] Detect Virtualization Environment (Windows) T1497.001
 2021-08-05 15:47:37 +02:00
Florian Roth 3634901bf1 Update poweshell_detect_vm_env.yml 2021-08-05 15:47:29 +02:00
Florian Roth 6a11190e79 Merge pull request #1769 from frack113/fix_powershell_400 
Cleanup eventid 400 powershell-classic
 2021-08-05 15:47:04 +02:00
Florian Roth da6b5f8ec5 Merge pull request #1770 from frack113/redcanary_powershell_T1070.006 
[OSCD] powershell_timestomp.yml T1070.006
 2021-08-05 15:46:48 +02:00
Florian Roth b1fb462c39 Update powershell_timestomp.yml 2021-08-05 15:46:01 +02:00
Florian Roth 9b7be5985e Merge pull request #1773 from phantinuss/master 
Two CobaltStrike BOF rules and a little fix on the local rule test script usage text
 2021-08-05 15:42:47 +02:00
Florian Roth 6507e8c060 Merge pull request #1774 from frack113/fix_4104_ScriptBlockText 
Clean-up Powershell EventID 4104
 2021-08-05 15:42:35 +02:00
Florian Roth 52b41da731 Merge pull request #1775 from austinsonger/sysmon_disabled_pua_protection_on_microsoft_defender.yml 
Create sysmon_disabled_pua_protection_on_microsoft_defender.yml
 2021-08-05 15:42:17 +02:00
Florian Roth c05dacb1f0 Merge pull request #1776 from austinsonger/sysmon_disabled_tamper_protection_on_microsoft_defender.yml 
sysmon_disabled_tamper_protection_on_microsoft_defender.yml
 2021-08-05 15:41:54 +02:00
Austin Songer 483dacb209 Create sysmon_disabled_exploit_guard_network_protection_on_microsoft_defender.yml 2021-08-04 19:11:00 -05:00
Austin Songer ff7fb4e4d2 Create sysmon_disabled_tamper_protection_on_microsoft_defender.yml 2021-08-04 19:08:10 -05:00
Austin Songer 6a2663a3ae Update sysmon_disabled_pua_protection_on_microsoft_defender.yml 2021-08-04 17:00:34 -05:00
Austin Songer 8d195bf5d5 Update sysmon_disabled_pua_protection_on_microsoft_defender.yml 2021-08-04 13:11:31 -05:00
Austin Songer bae075713c Update sysmon_disabled_pua_protection_on_microsoft_defender.yml 2021-08-04 13:10:37 -05:00
Austin Songer f89ba18c5d Create sysmon_disabled_pua_protection_on_microsoft_defender.yml 2021-08-04 11:27:41 -05:00