security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,511 Commits 1 Branch 57 Tags
e91fc4486e57fc40e30d12253694de4c80a9e4ea
Commit Graph

7964 Commits

Author SHA1 Message Date
Florian Roth f4ac416ef4 Merge pull request #1582 from SigmaHQ/rule-devel 
Rule devel
 2021-06-28 11:36:21 +02:00
Sittikorn S bfe110a2c5 Update aws_securityhub_finding_evasion.yml 2021-06-28 16:07:54 +07:00
Sittikorn S 5a61e402bf Update aws_securityhub_finding_evasion.yml 2021-06-28 15:57:21 +07:00
Sittikorn S 071699da5e Update aws_securityhub_finding_evasion.yml 2021-06-28 15:52:42 +07:00
Sittikorn S ff83414871 Update and rename aws_securityhub_disable_finding.yml to aws_securityhub_finding_evasion.yml 2021-06-28 15:45:31 +07:00
Sittikorn S 4c323d40dd Create aws_securityhub_disable_finding.yml 2021-06-28 15:42:34 +07:00
Florian Roth d1f1e8e7c4 rule: reg add run key 2021-06-28 09:39:12 +02:00
Florian Roth ab0502f893 refactor: add wscript.exe to mshta rule 2021-06-28 09:39:04 +02:00
Florian Roth d48009748f rule: mshta shell spawn 2021-06-28 09:32:28 +02:00
Florian Roth e7d9f1b427 Merge pull request #1577 from austinsonger/master 
Update win_susp_disable_eventlog.yml
 2021-06-28 08:46:17 +02:00
Florian Roth faf5e4a514 Update win_run_virtualbox.yml 2021-06-28 08:42:09 +02:00
Austin Songer 8e6ab7fd79 Update win_susp_disable_eventlog.yml 2021-06-28 00:59:53 -05:00
Austin Songer bfe969f071 Update win_susp_disable_eventlog.yml 2021-06-28 00:53:52 -05:00
Austin Songer d1fba0e1a5 Update win_susp_disable_eventlog.yml 2021-06-27 20:26:44 -05:00
frack113 e096b853cf Fix file from PR 1022 2021-06-27 18:24:56 +02:00
wagga40 d6afa46e68 Added missing "modified" fields. Removed trailing wildcard. 2021-06-27 17:36:32 +02:00
wagga40 d6c430408f Removed duplicate field 2021-06-27 15:54:26 +02:00
wagga40 3f0dd2417b Removed Drive letter before "Users" directory 2021-06-27 15:32:46 +02:00
wagga40 11df697cdc Updated rules with modifiers instead of '*' and remove trailing '\\' 2021-06-27 14:51:29 +02:00
Austin Songer f1d937cbd6 Update win_susp_disable_eventlog.yml 2021-06-26 12:22:54 -05:00
Austin Songer de6fac1d18 Update win_susp_disable_eventlog.yml 2021-06-26 03:15:05 -05:00
mlp1515 60d352a21a Merge branch 'SigmaHQ:master' into master 2021-06-25 13:17:24 +02:00
Florian Roth 014c3ec400 more generic approach to the Admin* group 2021-06-25 12:38:47 +02:00
Florian Roth 6c3f94fb72 Merge pull request #1572 from adeemm/ldap-recon 
Add rule to detect AD enumeration
 2021-06-25 12:18:26 +02:00
Florian Roth 685bd490f5 Merge pull request #1573 from d4rk-d4nph3/master 
Added rule for default cobalt strike certificate
 2021-06-25 12:16:31 +02:00
Florian Roth c90e31275d Merge pull request #1576 from CriimBow/patch-1 
Typo on Find-DomainObjectPropertyOutlier
 2021-06-25 12:15:59 +02:00
Florian Roth 537d89d185 Merge pull request #1575 from SigmaHQ/rule-devel 
rules: PurpleSharp, WMIC ActiveScriptEventConsumer
 2021-06-25 12:15:35 +02:00
CriimBow 188b847670 Typo on Find-DomainObjectPropertyOutlier 2021-06-25 10:35:33 +02:00
Florian Roth 7b6208c05c rules: PurpleSharp, WMIC ActiveScriptEventConsumer 2021-06-25 09:56:42 +02:00
Bhabesh Rai 91cc97d099 Fixed the taxonomy 2021-06-24 21:07:52 +05:45
Andreas Hunkeler 3de0679d5a Add fp note to PortProxy rules 2021-06-24 11:22:41 +02:00
Andreas Hunkeler 366d83ab44 Add fp note to PortProxy rules 2021-06-24 11:21:29 +02:00
Florian Roth 1dd557e543 fix: global action unneeded 2021-06-23 09:23:08 +02:00
Bhabesh Rai 1ebbc6c1a3 Added rule for default cobalt strike certificate 2021-06-23 10:17:27 +05:45
Sittikorn S c0724e533f Update and rename win_renamed_meg.yml to win_renamed_megasync.yml 2021-06-23 09:24:42 +07:00
Sittikorn S a310806dbf Update win_renamed_meg.yml 2021-06-23 08:35:12 +07:00
Adeem Mawani 8077dedbc5 Add rule to detect AD enumeration 2021-06-22 15:57:49 -04:00
Sittikorn S 10488512ae Update win_renamed_meg.yml 2021-06-22 22:27:34 +07:00
Sittikorn S 177442d6df Update win_renamed_meg.yml 2021-06-22 22:20:49 +07:00
Sittikorn S 6328ce8ef6 Update win_renamed_meg.yml 2021-06-22 22:17:51 +07:00
Sittikorn S f55cd9ed1b Update win_renamed_meg.yml 2021-06-22 22:03:56 +07:00
Sittikorn S 268a4c31e3 Update win_renamed_meg.yml 
Change mitre tags T1218.001 to T1218
 2021-06-22 22:00:35 +07:00
Sittikorn S e6d08d0ad6 Update win_renamed_meg.yml 2021-06-22 21:55:09 +07:00
Sittikorn S a08b6c4e0a Create win_renamed_meg.yml 2021-06-22 21:50:07 +07:00
Florian Roth 7e748fa91a Merge pull request #1567 from BlackB0lt/patch-2 
Create win_script_event_consumer_spawn new rule
 2021-06-22 12:43:34 +02:00
Sittikorn S d9a749eec0 Update and rename win_script_event_consumer_spawn to win_script_event_consumer_spawn.yml 2021-06-22 16:35:46 +07:00
Florian Roth cbe97206de fix: several indentation issues, casing in tags 2021-06-22 11:03:17 +02:00
Florian Roth a87f8d1384 Merge pull request #1569 from Karneades/PortProxy 
rule: add port proxy registry rule and further references
 2021-06-22 11:01:17 +02:00
Andreas Hunkeler ed41125f70 fix: remove duplicate status in portproxy reg rule 2021-06-22 08:28:17 +02:00
Andreas Hunkeler cd0b46ab62 rule: add port proxy registry rule and add references 2021-06-22 08:16:56 +02:00