security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,511 Commits 1 Branch 57 Tags
e91fc4486e57fc40e30d12253694de4c80a9e4ea
Commit Graph

10511 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
503139 df74abc957 removed leading slash and allow for mult spaces 2020-09-04 13:33:31 -04:00
Florian Roth 61e8498551 Merge pull request #995 from veritasr3x/master 
Windows Defender LOLBIN
 2020-09-04 17:06:24 +02:00
Florian Roth 22465037ac Update win_susp_mpcmdrun_download.yml 2020-09-04 16:50:57 +02:00
Florian Roth 3283e33cbc Update and rename win_lolbas_mpcmdrun.yml to win_susp_mpcmdrun_download.yml 2020-09-04 16:49:44 +02:00
Matthew Matchen df532be142 Added ID field using UUID generated value 2020-09-04 16:38:52 +02:00
Matthew Matchen 2c69815b7b Removed empty ID field 2020-09-04 16:32:41 +02:00
Matthew Matchen e0baa097a8 Initial creation 2020-09-04 16:00:23 +02:00
veritasr3x 3e8dda723b Merge pull request #1 from Neo23x0/master 
Repo Update
 2020-09-04 15:46:10 +02:00
aw350m3 bd5026f6b9 fixed typos in tags 2020-09-03 14:29:05 +00:00
aw350m3 198e42d724 deleted extra spaces 2020-09-03 14:22:31 +00:00
aw350m3 b00047a4e8 att&ck tags review: application, apt, cloud, generic, proxy 2020-09-03 14:16:54 +00:00
Alexey Lednyov cf011e4a00 Removed duplicate key 'modified' 2020-09-03 17:12:37 +03:00
Alexey Lednyov 1eb675f693 att&ck tags review: web, network/zeek 2020-09-03 17:06:37 +03:00
Florian Roth 22547e188b some fixes and additions 2020-09-03 13:30:21 +02:00
Florian Roth 4ade5bd957 Merge pull request #991 from Neo23x0/rule-devel 
Rule devel
 2020-09-03 12:15:05 +02:00
Florian Roth 720ac0d998 fix: syntax bug in rule 2020-09-03 09:18:28 +02:00
Yugoslavskiy Daniil 71fec94417 review network/cisco/aaa 2020-09-03 00:34:41 +02:00
Florian Roth 198469bed3 Merge branch 'master' into rule-devel 2020-09-02 17:40:12 +02:00
Florian Roth 423f81c912 Update win_mouse_lock.yml 2020-09-02 14:49:37 +02:00
Florian Roth 73bc514f60 fix: 1 of them / one selection 2020-09-02 12:34:35 +02:00
Florian Roth 7ddb63ec1b fix: FPs with McAfee and CyberReason 2020-09-02 12:30:34 +02:00
Yugoslavskiy Daniil 11e0f794d9 review windows/process_creation part 4 2020-09-02 02:34:34 +02:00
aw350m3 7c6c5263ab fix duplication of key modified in win_malware_emotet.yml 2020-09-01 17:09:54 +00:00
aw350m3 8ed3eb1494 att&ck tags review: windows/process_creation part 3 2020-09-01 17:02:59 +00:00
grikos 65d201b1e4 att&ck tags review: windows/process_creation part 7 2020-08-30 19:17:38 +03:00
Yugoslavskiy Daniil e04b896cbc fix tags 2020-08-29 21:34:20 +02:00
grikos a95c4347d9 fixed typo in tag 2020-08-29 20:19:46 +03:00
grikos 6092bfcec1 att&ck tags review: windows/process_creation part 9 2020-08-29 19:22:09 +03:00
grikos 6eadfccc68 Merge branch 'master' of https://github.com/oscd-initiative/sigma 2020-08-29 12:30:45 +03:00
aw350m3 ae99a2b207 Removed extra space that broke tests 2020-08-29 04:46:12 +00:00
aw350m3 4ed3db8d23 Merge branch 'master' of github.com:oscd-initiative/sigma 2020-08-29 04:39:45 +00:00
aw350m3 da766a245f att&ck tags review: windows/process_creation part 2 2020-08-29 04:39:30 +00:00
Yugoslavskiy Daniil cd12ab8a77 Merge branch 'master' of https://github.com/oscd-initiative/sigma 2020-08-29 02:03:39 +02:00
Yugoslavskiy Daniil 5b70cfd3f7 review windows/sysmon 2020-08-29 02:03:28 +02:00
yugoslavskiy 21a8667720 Merge pull request #1 from zinint/master 
Linux rules reviewed
 2020-08-29 01:55:24 +02:00
yugoslavskiy a3ec8729c6 Merge pull request #2 from grikos/attack_tags_review_process_creation_8 
attack_tags_review_process_creation_8
 2020-08-29 01:55:09 +02:00
grikos 3783b34832 Merge branch 'master' of https://github.com/grikos/sigma 2020-08-28 17:17:11 +03:00
grikos 293662810e att&ck tags review: windows/process_creation part 8 2020-08-28 17:14:26 +03:00
vh a2fec9f3b9 Fix sysmon backend 2020-08-28 12:26:40 +03:00
Alexey Lednyov 880b10cce1 att&ck tags review: windows/process_creation part 1, network 2020-08-27 20:43:47 +03:00
Florian Roth 7d3a6293f5 rule: Snatch ransomware 2020-08-26 09:42:34 +02:00
aw350m3 eb6b9be5a2 added missing ATT&CK v6.3 IDs with comments and removed unnecessary "modified" attributes 2020-08-25 23:51:22 +00:00
Thomas Patzke bae09e9447 Sigmatools release 0.18.1 0.18.1 2020-08-26 00:06:25 +02:00
grikos ac0e42d0e2 Merge pull request #2 from aw350m33d/master 
sync master
 2020-08-25 23:07:48 +03:00
Thomas Patzke b742e4ef08 Merge pull request #990 from neu5ron/es_backend 
ES and Readme from SOC Prime
 2020-08-25 21:34:55 +02:00
Nate Guagenti f21b3c50c6 control whether to use an analyzed field or different type if a query/value contains a wildcard. 
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com>
 2020-08-25 13:13:18 -04:00
Nate Guagenti a7ffb96b6b elasticsearch regex escape of '.' for case insensitivity backend options 
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com>
 2020-08-25 13:10:25 -04:00
Nate Guagenti 474e04dfe3 add new options to readme for elasticbackend 
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com>
 2020-08-25 13:00:22 -04:00
Nate Guagenti 76910eaee4 fix sub field name usage if there are 3 or more fields.. 
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com>
 2020-08-25 12:56:57 -04:00
Nate Guagenti 0d713e4544 control whether to use an analyzed field or different type if a query/value contains a wildcard. 
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com>
 2020-08-25 12:56:33 -04:00