security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,511 Commits 1 Branch 57 Tags
e91fc4486e57fc40e30d12253694de4c80a9e4ea
Commit Graph

10511 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
sagiezero eb5578fa33 fix(rules): fixed capital in rule names, removed unknown mitre tags, removed unknown tag in logsource. 2022-01-20 16:53:01 +02:00
frack113 b7b95f9055 Order application folder 2022-01-20 14:57:57 +01:00
Florian Roth 885f70b0f3 Update lnx_doas_execution.yml 2022-01-20 13:08:39 +01:00
Florian Roth 375acb8ba4 Update lnx_doas_conf_creation.yml 2022-01-20 13:07:53 +01:00
frack113 0ae1e37ac9 Merge pull request #2586 from phantinuss/master 
fix: typo unkown --> unknown
 2022-01-20 11:36:33 +01:00
Florian Roth 8cf78fb4e6 rules: advancedrun executions 2022-01-20 11:08:08 +01:00
Florian Roth e99d030754 Merge pull request #2585 from SigmaHQ/rule-devel 
First code integrity rule - new log source
 2022-01-20 11:06:20 +01:00
sagiezero c76443051a feat(rules): changing location to "application" folder 2022-01-20 11:57:10 +02:00
phantinuss 26c1c23305 fix: typo 2022-01-20 10:45:30 +01:00
Florian Roth 9b7b48c0e6 Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel 2022-01-20 09:45:03 +01:00
Florian Roth 4395a6dafa rule: code integrity failed driver load 2022-01-20 09:45:00 +01:00
Florian Roth 68f0cdf338 feat: new log channel windows-codeintegrity-operational 
https://twitter.com/SBousseaden/status/1483810148602814466
 2022-01-20 09:44:36 +01:00
Sittikorn S f21d10b69f Update lnx_doas_conf_creation.yml 2022-01-20 11:00:18 +07:00
Sittikorn S f195160baa Update lnx_doas_execution.yml 2022-01-20 10:58:47 +07:00
Sittikorn S 8b94046efa Update lnx_doas_execution.yml 2022-01-20 10:11:24 +07:00
Sittikorn S 41065bcc91 Update lnx_doas_conf_creation.yml 2022-01-20 10:11:14 +07:00
Sittikorn S bb574151ba Create lnx_doas_conf_creation.yml 2022-01-20 09:50:41 +07:00
Sittikorn S 4f56e0d92e Update lnx_doas_execution.yml 2022-01-20 09:48:24 +07:00
Sittikorn S eb4731b370 Create lnx_doas_execution.yml 2022-01-20 09:46:17 +07:00
frack113 caa4c7f977 Add Redcannary Windows Rules 2022-01-19 20:40:43 +01:00
Florian Roth 8a70729654 Merge pull request #2574 from SigmaHQ/rule-devel 
rule: extended Defender exclusions rule
 2022-01-19 20:32:14 +01:00
Florian Roth 86165466e5 Merge pull request #2577 from SigmaHQ/aurora-false-positive-fixing 
fix: FPs noticed with Aurora
 2022-01-19 20:32:05 +01:00
frack113 0ebf540deb Merge pull request #2573 from redsand/fp_alernat_powershell_hosts_pipe_allow_dsac 
Allow dsac, wmi and mssql sqlps.exe to perform powershell execution over named pipes
 2022-01-19 20:27:59 +01:00
Florian Roth d6af219bed Merge branch 'master' into pr/2573 2022-01-19 19:42:49 +01:00
Florian Roth 6835381e6a Merge branch 'master' into rule-devel 2022-01-19 19:42:14 +01:00
Florian Roth 27912f20d1 Merge branch 'master' into aurora-false-positive-fixing 2022-01-19 19:41:39 +01:00
Florian Roth e10decf584 Merge branch 'aurora-false-positive-fixing' of https://github.com/SigmaHQ/sigma into aurora-false-positive-fixing 2022-01-19 19:41:09 +01:00
Florian Roth 51970e888e Merge branch 'master' into aurora-false-positive-fixing 2022-01-19 19:40:51 +01:00
Florian Roth eb382c4a59 Merge pull request #2576 from frack113/remove_old_tag 
remove invalid tag
 2022-01-19 19:40:01 +01:00
Florian Roth ba3a71aa9a Merge branch 'master' into aurora-false-positive-fixing 2022-01-19 18:35:20 +01:00
Florian Roth 94df11f53c fix: FPs noticed with Aurora 2022-01-19 18:34:07 +01:00
frack113 4631d0c482 remove invalid tag 2022-01-19 18:23:30 +01:00
Tim Shelton 37243f5902 Updating formatting for more accurate mssql sqlps.exe detection 2022-01-19 14:49:00 +00:00
Florian Roth 49502f3796 fix: wrong number of placeholders 2022-01-19 15:24:24 +01:00
Florian Roth 2a118e900a refactor: added requirement, debug output for MITRE ATTCK eval 2022-01-19 15:21:50 +01:00
Florian Roth d7de27ca3c rule: extended Defender exclusions rule 2022-01-19 13:21:19 +01:00
Tim Shelton dc1e150a46 adding support for mssql sqlps.exe 2022-01-18 23:55:04 +00:00
Tim Shelton ec51cf6698 Allow wmi service to also perform, since winrm is being allowed 2022-01-18 22:20:55 +00:00
Tim Shelton a0983a3659 Allow dsac to perform powershell execution over named pipes. DSAC - Active Directory Admin Client 2022-01-18 19:55:00 +00:00
Tim Shelton 3c115408b6 Adding translation for Imphash 2022-01-18 15:47:53 +00:00
frack113 926b9c964c Merge pull request #2571 from thomai/master 
Adjust case sensitivity of Provider_Name field
 2022-01-17 16:03:06 +01:00
Tom Maier 2cd464e77c Adjusted modified field to current date 2022-01-17 14:18:33 +01:00
Tom Maier 82e7ce7799 Adjust case sensitivity of Provider_Name field 2022-01-17 10:36:09 +01:00
frack113 3ec9f6d252 Merge pull request #2569 from frack113/red_20220116 
Windows Redcannary defense_evasion
 2022-01-17 06:36:41 +01:00
frack113 fc7485a07c Merge pull request #2567 from frack113/red_20220115 
Windows Redcannary
 2022-01-17 06:35:49 +01:00
Florian Roth c1e1809dae Merge pull request #2570 from SigmaHQ/rule-devel 
Admin Share rules, JS RunHTMLApplication
 2022-01-16 22:44:02 +01:00
Florian Roth a3a9e2add8 fix: wrong modifier 2022-01-16 17:43:55 +01:00
Florian Roth be224a6f37 rule: new rules covering admin share activity 2022-01-16 17:40:50 +01:00
frack113 2ef4b1a712 fix empty id 2022-01-16 15:24:44 +01:00
frack113 7b3d2d4313 Fix space 2022-01-16 15:12:50 +01:00