security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,511 Commits 1 Branch 57 Tags
e91fc4486e57fc40e30d12253694de4c80a9e4ea
Commit Graph

7964 Commits

Author SHA1 Message Date
Konstantin Klinger 457da818a4 regex optimisations 2021-09-01 17:06:55 +02:00
Konstantin Klinger e83ee55573 remove duplicate 2021-09-01 17:05:36 +02:00
Florian Roth b0c2d7b75a fix: tags for WMI / execution / persistence 2021-09-01 16:34:50 +02:00
Florian Roth 2f7f050ad8 fix: removed tags 2021-09-01 16:32:27 +02:00
phantinuss 0b38237dbf fix: add relation to now obsolete rule 2021-09-01 15:38:29 +02:00
phantinuss ae9966bdcc fix: unifying two overlapping rules 2021-09-01 14:48:32 +02:00
phantinuss deefcaa8ac fix: prevent possible FPs with the respective command only used as the last parameter 2021-09-01 14:33:46 +02:00
frack113 434c3891ff Merge pull request #1965 from frack113/add_tags 
Add tags when missing
 2021-09-01 14:07:31 +02:00
Florian Roth 1aac21ba79 fix: single list item issue 2021-09-01 14:03:42 +02:00
Florian Roth 1c4f642227 Merge pull request #1699 from matsto/patch-1 
Fixed transformation modifier for keywords
 2021-09-01 14:02:10 +02:00
frack113 2dbbaf0180 fix missing char in date 2021-09-01 14:00:55 +02:00
Florian Roth 505140d273 rule: extended WMI suspicious scripts rule 2021-09-01 13:57:48 +02:00
Florian Roth e787420be1 rule: WMI filter content encoded executable 2021-09-01 13:57:36 +02:00
Florian Roth 8761927e8c rule: susp scrcons.exe creating named pipe 2021-09-01 13:57:17 +02:00
frack113 e71fce6f11 fix errors 2021-09-01 13:55:14 +02:00
Florian Roth affc929c3b LiquidSnake named pipe 2021-09-01 13:54:47 +02:00
frack113 80dbfa7af5 add process_creation_alternate_data_streams.yml 2021-09-01 13:52:09 +02:00
Florian Roth c8b3036949 Merge pull request #1968 from SigmaHQ/rule-devel 
docs: note to improved sysmon config
 2021-09-01 13:21:28 +02:00
Florian Roth f102b2d9a1 docs: note to improved sysmon config 2021-09-01 13:07:18 +02:00
Florian Roth 8bba246205 refactor: better way to write it 2021-09-01 12:57:34 +02:00
frack113 2cb5f5e4c6 add missing tags 2021-09-01 12:54:21 +02:00
Florian Roth c146bc44c7 Merge branch 'master' into patch-1 2021-09-01 12:48:51 +02:00
Bhabesh Rai 6859b6c38f Added rule for detection of Atera RMM Agent installation 2021-09-01 15:24:47 +05:45
frack113 af599e4877 Merge pull request #1958 from phantinuss/master 
Bulk of new rules, mainly UAC Bypasses
 2021-09-01 10:53:02 +02:00
frack113 892c58270a Update tags 2021-09-01 10:33:57 +02:00
frack113 4b8ffbc183 Update tags 2021-09-01 10:30:43 +02:00
phantinuss 9ffdced740 fix: implement suggestions from PR discussion 2021-09-01 10:21:37 +02:00
frack113 240c5584ff update tags 2021-09-01 09:56:46 +02:00
frack113 6f3fc7036e Update tags 2021-09-01 09:45:31 +02:00
frack113 3ed7d6e330 Merge pull request #1959 from frack113/update_ps 
Update PowerShell rules
 2021-09-01 08:06:31 +02:00
frack113 b8a1f4c63b Merge pull request #1961 from SigmaHQ/rule-devel 
SideWalk User-Agent used by Sparkling Goblin
 2021-09-01 08:06:15 +02:00
Cyb3rEng 470d64e66c Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:28:34 -06:00
Cyb3rEng e0e1396dff Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:26:44 -06:00
Cyb3rEng e7c7e4c061 Updated Rule 
Detection changed to #useful_information
 2021-08-31 22:24:28 -06:00
Cyb3rEng f2b8b83fe3 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:23:45 -06:00
Cyb3rEng 0d2257fb19 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:22:01 -06:00
Cyb3rEng 1b9a0c4a01 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:20:17 -06:00
Cyb3rEng c5507658c0 Updated Rule 
updated title
 2021-08-31 22:13:31 -06:00
Cyb3rEng d309784e58 Updated Rule 
Modified Title
 2021-08-31 22:12:34 -06:00
Cyb3rEng 93334878f5 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:09:57 -06:00
Cyb3rEng 785fc98ee3 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 22:05:10 -06:00
Cyb3rEng d5f73a8910 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 22:03:31 -06:00
Cyb3rEng fa3b882fdc Updated Rule 
Removed " " from falsepositives section
 2021-08-31 21:58:50 -06:00
Cyb3rEng c7c49c55d2 Updated Rule 
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 21:58:09 -06:00
Cyb3rEng d5fa226180 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 21:54:32 -06:00
Cyb3rEng 900f71e6b2 Rule Update Review 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 21:50:44 -06:00
Florian Roth 9b20060275 SideWalk UA 2021-08-31 17:14:19 +02:00
frack113 cff572b752 Update sysmon_dns_over_https_enabled.yml 2021-08-31 17:11:04 +02:00
phantinuss add1ad40f8 additional UAC bypass rule 2021-08-31 16:23:32 +02:00
phantinuss 59d8e0b866 add System IntegrityLevel to uac bypass rules, the level is not used most of the time, but might 2021-08-31 16:18:05 +02:00