security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,511 Commits 1 Branch 57 Tags
e91fc4486e57fc40e30d12253694de4c80a9e4ea
Commit Graph

7964 Commits

Author SHA1 Message Date
Austin Songer a4969fe5d8 Update azure_kubernetes_admission_controller.yml 2021-11-25 00:12:55 -06:00
Austin Songer 55190e32ca Update azure_kubernetes_cronjob.yml 2021-11-25 00:11:07 -06:00
Austin Songer 9a5f3b415e Update gcp_kubernetes_admission_controller.yml 2021-11-25 00:06:36 -06:00
Austin Songer f54b618cd4 Update gcp_kubernetes_admission_controller.yml 2021-11-25 00:05:54 -06:00
Austin Songer fd5ad4b940 Update azure_kubernetes_admission_controller.yml 2021-11-25 00:05:43 -06:00
Austin Songer 2d58a3c8f9 Update azure_kubernetes_admission_controller.yml 2021-11-25 00:00:28 -06:00
Austin Songer 47fb21fae6 Create azure_kubernetes_admission_controller.yml 2021-11-24 23:58:33 -06:00
Austin Songer 8d50ab9e5f Create gcp_kubernetes_admission_controller.yml 2021-11-24 23:53:57 -06:00
frack113 bdb00f403f fix rule 2021-11-24 19:24:16 +01:00
frack113 960a03eaf4 add lobas Binary 2021-11-24 19:17:00 +01:00
Florian Roth 3e8b43e324 Merge pull request #2307 from SigmaHQ/aurora-false-positive-fixing 
Aurora false positive fixing
 2021-11-24 17:31:44 +01:00
Florian Roth b6bfb1074d Merge pull request #2305 from phantinuss/master 
rule: rundll calling shell32 with dll in suspicious location + Download via Certreq
 2021-11-24 17:30:56 +01:00
Florian Roth ce7d101b86 Merge branch 'master' into aurora-false-positive-fixing 2021-11-24 16:59:53 +01:00
Florian Roth f60e8e5d17 fix: more false positive filters 2021-11-24 16:58:53 +01:00
phantinuss eb8c9c046b rule: download using certreq 2021-11-24 16:39:44 +01:00
Florian Roth 3ace3808a5 refactor: Shell File Write to Suspicious Folder rule 2021-11-24 15:54:42 +01:00
Florian Roth fd6e3bb572 fix: dbghelp/dbgcore DLL load FP 2021-11-24 13:47:30 +01:00
Florian Roth 5e91d30e29 Merge pull request #2306 from SigmaHQ/rule-devel 
refactor: change rule for CVE-2021-42321 exploitation
 2021-11-24 13:42:17 +01:00
Florian Roth 88cc418b98 Merge branch 'rule-devel' into aurora-false-positive-fixing 2021-11-24 13:42:00 +01:00
Florian Roth ed021f1bd4 Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel 2021-11-24 12:37:55 +01:00
Florian Roth 236b69e6f7 Update win_exchange_cve_2021_42321.yml 2021-11-24 12:37:51 +01:00
phantinuss b807aba67a fix: key/value 2021-11-24 11:41:02 +01:00
phantinuss 30b57f33ed rule: rundll calling shell32 with dll in suspicious location 2021-11-24 10:56:58 +01:00
Florian Roth 4a69c71b2f Update lnx_shell_clear_cmd_history.yml 2021-11-24 09:31:12 +01:00
Florian Roth 94c61bf07a Update lnx_shell_clear_cmd_history.yml 2021-11-24 09:29:48 +01:00
Florian Roth 9f14e70746 Merge pull request #2303 from secjunkie/master 
Update lnx_shell_clear_cmd_history.yml
 2021-11-24 09:28:06 +01:00
Florian Roth 2c07bd562f Merge pull request #2301 from SigmaHQ/rule-devel 
refactor: reworked psexec / paexec rules
 2021-11-24 09:27:35 +01:00
frack113 a28154dba0 Merge pull request #2302 from frack113/fix_field 
fix field name
 2021-11-24 06:20:59 +01:00
frack113 a1db916851 Merge pull request #2299 from frack113/update_FP 
Update detection win_system_defender_disabled.yml
 2021-11-24 06:20:32 +01:00
frack113 bf9b3844a6 Merge pull request #2298 from austinsonger/kubernetes-cronjob 
Kubernetes cronjob
 2021-11-24 06:20:16 +01:00
Florian Roth 424bed1915 Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel 2021-11-24 00:27:45 +01:00
Florian Roth 37b445d3bb fix: FPs that only show up in Aurora 
Sysmon configs are often too restricted
 2021-11-24 00:27:43 +01:00
secjunkie b76d000f26 Update lnx_shell_clear_cmd_history.yml 
cat and ln can use zero or null
chattr does not clear but stops further logging
 2021-11-23 23:06:23 +00:00
frack113 b81b5666ce fix field name 2021-11-23 18:47:42 +01:00
Florian Roth 33c5e027d3 refactor: psexec flags 2021-11-23 18:00:48 +01:00
Florian Roth 99fc5fc3cc refactor: reworked psexec / paexec rules 2021-11-23 16:34:31 +01:00
Florian Roth f1c31bda02 fix: FPs noticed in Suspicious System.Drawing Load 2021-11-23 12:33:11 +01:00
Florian Roth 0a682f6fe0 Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing 2021-11-23 09:37:23 +01:00
Florian Roth 614046c241 fix: missing filter in condition 2021-11-23 09:37:20 +01:00
frack113 b764153d4f Update detection 2021-11-23 08:16:10 +01:00
Austin Songer 70d1e6d0f3 Update azure_kubernetes_cronjob.yml 2021-11-22 22:45:35 -06:00
Austin Songer 253ec56d1c Create azure_kubernetes_cronjob.yml 2021-11-22 22:40:06 -06:00
Austin Songer 5c118eef46 Create gcp_kubernetes_cronjob.yml 2021-11-22 22:39:39 -06:00
Florian Roth f2585f44da fix: bug in filter 2021-11-22 21:30:19 +01:00
Florian Roth 7468d495ff fix: FP with LSASS access rule 2021-11-22 21:29:21 +01:00
Florian Roth 42571791b3 Merge branch 'rule-devel' into aurora-false-positive-fixing 2021-11-22 15:24:46 +01:00
Florian Roth 2c5631f1bf Merge branch 'master' into aurora-false-positive-fixing 2021-11-22 15:23:43 +01:00
Florian Roth 68e4864069 fix: exclusions in new WinRAR rule 2021-11-22 15:23:28 +01:00
Florian Roth e778372d1f Merge pull request #2295 from SigmaHQ/aurora-false-positive-fixing 
Aurora false positive fixing
 2021-11-22 15:19:05 +01:00
Florian Roth 8fc93d3340 refactor: generic lsass access filter 2021-11-22 15:05:56 +01:00