security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,511 Commits 1 Branch 57 Tags
e91fc4486e57fc40e30d12253694de4c80a9e4ea
Commit Graph

7964 Commits

Author SHA1 Message Date
frack113 41c4f1d157 add powershell_powercat.yml 2021-07-21 13:04:27 +02:00
frack113 1b537cac5d add sysmon_netcat_execution.yml 2021-07-21 10:55:54 +02:00
Florian Roth 0930a933c3 Merge pull request #1713 from frack113/redcanary_t1552_004 
[OSCD] process_creation_discover_private_keys.yml T1552.004
 2021-07-21 10:43:45 +02:00
Florian Roth 78f903a2cc Merge pull request #1714 from frack113/redcanary_t1074_001 
[OSCD] win_susp_zip_compress.yml T1074.001
 2021-07-21 10:43:32 +02:00
frack113 44254038d3 fix human error : test-sigmac Error 4 2021-07-21 10:01:46 +02:00
frack113 b9b0ef2066 convert keywords to correct field name Payload 2021-07-21 09:44:26 +02:00
Florian Roth ddb4744613 regsvr32 anomaly rule update 
https://twitter.com/BlackMatter23/status/1417545425297580045
 2021-07-20 21:14:48 +02:00
frack113 ba50a2309c fix case EventID 2021-07-20 16:26:13 +02:00
frack113 42005a07b7 update powershell_suspicious_download.yml 2021-07-20 16:12:24 +02:00
frack113 b031a1b4b7 add win_susp_zip_compress.yml 2021-07-20 13:13:53 +02:00
frack113 cf8904b560 fix files_with_incorrect_mitre_tags 2021-07-20 12:22:31 +02:00
Florian Roth 66aaa2210c refactor: widened PS1 Empire cmdlines rule 2021-07-20 11:26:22 +02:00
frack113 da6135ccb3 add process_creation_discover_private_keys.yml 2021-07-20 11:20:30 +02:00
Florian Roth 6fbce11094 Merge pull request #1712 from SigmaHQ/rule-devel 
fix: bug in regsvr anomaly rule
 2021-07-18 13:00:19 +02:00
Florian Roth b7b4c4555f fix: bug in regsvr anomaly rule 2021-07-18 12:59:31 +02:00
Florian Roth 7eb873e48b Merge pull request #1710 from SigmaHQ/rule-devel 
added more legitimate extensions to regsvr32 rule
 2021-07-17 13:46:21 +02:00
Florian Roth 53c25969ab added more legitimate extensions to regsvr32 rule 2021-07-17 11:20:05 +02:00
Florian Roth 8a75890b51 Merge pull request #1702 from d4rk-d4nph3/master 
Added rule for ADRecon execution
 2021-07-17 09:50:29 +02:00
Florian Roth e838a1acc4 increased level 2021-07-17 09:50:11 +02:00
Florian Roth 715bca0fd2 Merge pull request #1704 from frack113/redcanary_t1216 
Redcanary t1216
 2021-07-17 09:48:43 +02:00
Florian Roth 56ae1938af Merge pull request #1706 from BlackB0lt/patch-12 
Create sysmon_cve_2021_31979_cve_2021_33771_exploits.yml
 2021-07-17 09:46:35 +02:00
Florian Roth b1a00152bc Merge pull request #1698 from SigmaHQ/rule-devel 
several new rules and fixes
 2021-07-17 09:39:47 +02:00
Florian Roth b911175f28 Suspicious mshta patterns 2021-07-17 09:04:41 +02:00
Florian Roth 6c79115ce0 Regsvr32 Anomalies extended 2021-07-17 09:04:31 +02:00
Sittikorn S d3a1fb8565 Update sysmon_cve_2021_31979_cve_2021_33771_exploits.yml 2021-07-17 06:49:37 +07:00
Sittikorn S 5e84a603d0 Update sysmon_cve_2021_31979_cve_2021_33771_exploits.yml 2021-07-17 01:04:07 +07:00
Sittikorn S a3c4aa5dad Update sysmon_cve_2021_31979_cve_2021_33771_exploits.yml 2021-07-17 01:02:14 +07:00
Sittikorn S eea3675d4e Rename sysmon_cve_2021_31979_cve-2021_33771_exploits.yml to sysmon_cve_2021_31979_cve_2021_33771_exploits.yml 2021-07-17 00:09:04 +07:00
Sittikorn S 90fc50e0a2 Update and rename sysmon_devilstongue_CVE_2021_31979_exploit.yml to sysmon_cve_2021_31979_cve-2021_33771_exploits.yml 
rename sysmon_cve_2021_31979_cve-2021_33771_exploits.yml
 2021-07-17 00:02:15 +07:00
Sittikorn S 9fb589201e Update and rename sysmon_devilstongue_exploit_0day.yml to sysmon_devilstongue_CVE_2021_31979_exploit.yml 
Change Title
 2021-07-16 23:47:14 +07:00
Sittikorn S f2187f05e6 Update and rename sysmon_devilstongue_CVE_2021_31979_CVE_2021_33771.yml to sysmon_devilstongue_exploit_0day.yml 2021-07-16 23:42:05 +07:00
Sittikorn S 91295cff21 Update sysmon_devilstongue_CVE_2021_31979_CVE_2021_33771.yml 2021-07-16 23:35:31 +07:00
Sittikorn S dac72e2750 Update and rename sysmon_exploit_CVE_2021_31979_CVE_2021_33771.yml to sysmon_devilstongue_CVE_2021_31979_CVE_2021_33771.yml 2021-07-16 23:30:05 +07:00
Sittikorn S 10b7b6d640 Update sysmon_exploit_CVE_2021_31979_CVE_2021_33771.yml 2021-07-16 23:11:14 +07:00
Sittikorn S 94ba194b42 Update sysmon_exploit_CVE_2021_31979_CVE_2021_33771.yml 2021-07-16 23:09:51 +07:00
Sittikorn S 477ec060d2 Update and rename sysmon_susp_devilstongue_CVE_2021_31979_CVE_2021_33771.yml to sysmon_exploit_CVE_2021_31979_CVE_2021_33771.yml 2021-07-16 22:47:04 +07:00
Sittikorn S 99e5990416 Update sysmon_susp_devilstongue_CVE_2021_31979_CVE_2021_33771.yml 2021-07-16 22:30:06 +07:00
Sittikorn S dc94c4e51e Update sysmon_susp_devilstongue_CVE_2021_31979_CVE_2021_33771.yml 2021-07-16 22:21:34 +07:00
Sittikorn S 0954163e9d Update sysmon_susp_devilstongue_CVE_2021_31979_CVE_2021_33771.yml 2021-07-16 22:19:07 +07:00
Sittikorn S e094c76098 Update sysmon_susp_devilstongue_CVE_2021_31979_CVE_2021_33771.yml 2021-07-16 22:14:22 +07:00
Sittikorn S 0506e10697 Create sysmon_susp_devilstongue_CVE_2021_31979_CVE_2021_33771.yml 2021-07-16 22:09:07 +07:00
Tran Trung Hieu 8effde4e1d More suspicious flag fot bitsadmin execution 2021-07-16 16:40:00 +07:00
Tran Trung Hieu 1cb631017a Suspicious behaviours related to SOURGUM 2021-07-16 14:13:48 +07:00
Bhabesh Rai be8fce8e82 Added rule for ADRecon execution 2021-07-16 12:58:47 +05:45
frack113 9a7f3036e4 update ref in win_manage-bde_lolbas.yml 2021-07-16 08:34:30 +02:00
frack113 d6dc217c6d Add process_creation_syncappvpublishingserver_vbs_execute_powershell.yml 2021-07-16 08:28:25 +02:00
matsto f9997ace53 Fixed transformation modifier for keywords 2021-07-15 16:58:09 +02:00
Florian Roth 021f211c14 fix: FP with WCE and Windows Cluster Service 2021-07-15 12:09:28 +02:00
frack113 c6cb7f1247 fix missing references and duplicate UUID 2021-07-15 11:06:54 +02:00
Florian Roth e40b859254 Merge pull request #1695 from frack113/fix_re 
escape / in regex
 2021-07-15 09:25:58 +02:00