security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,034 Commits 1 Branch 57 Tags
ed5963493c04698bcb0c4a02bf54b39aeeaba4e7
Commit Graph

6550 Commits

Author SHA1 Message Date
Florian Roth ed5963493c Merge pull request #3012 from svch0stz/patch-2 
Update proc_creation_win_webshell_spawn.yml
 2022-05-16 16:51:04 +02:00
Florian Roth 4ae8fa322d Merge pull request #3014 from frack113/missing_status 
Add status
 2022-05-16 16:50:18 +02:00
Florian Roth 5ec29f38f8 Merge branch 'master' into aurora-false-positive-fixing 2022-05-16 16:05:02 +02:00
Florian Roth 55d5766bf9 fix: FPs with lsass as source 2022-05-16 16:04:13 +02:00
Florian Roth 17369f2671 Merge pull request #3015 from redsand/fp_ntopenprocess_ms_edge_update 
FP: ignoreing microsoft edge when performing NtOpenProcess
 2022-05-16 10:12:09 +02:00
Tim Shelton ca6b4d7862 FP: fixing error in labels 2022-05-15 17:41:22 +00:00
Tim Shelton 1019015473 FP: ignoring vmware to systeminfo.exe 2022-05-15 17:35:02 +00:00
Tim Shelton 71249ff7e0 FP: ignoring microsoft vc redistributable when performing NtOpenProcess 2022-05-15 17:33:31 +00:00
Tim Shelton 67e78ef455 FP: ignoreing microsoft edge when performing NtOpenProcess 2022-05-15 17:23:53 +00:00
frack113 f386440bb3 Add status 2022-05-15 16:17:02 +02:00
svch0stz 3ec531979a Update proc_creation_win_webshell_spawn.yml 
Example pulled from manage engine below:

Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ParentImage: C:\Program Files\ManageEngine\SupportCenterPlus\jre\bin\java.exe
ParentCommandline: "..\jre\bin\java" -Dcatalina.home=.. -Dserver.home=.. -Dserver.stats=1000  <snip>
 2022-05-15 14:57:21 +10:00
frack113 196aa6d83d move deprecated rules 2022-05-14 09:42:32 +02:00
Nasreddine Bencherchali 4241a5d13e Update proc_creation_win_wmi_spwns_powershell.yml 2022-05-13 15:33:48 +01:00
Nasreddine Bencherchali ae2ddae5aa Fix Requested Changes 2022-05-13 15:28:22 +01:00
Nasreddine Bencherchali 2e689eca54 Quick Fix 
- Removed "Contains" modifier from "OriginalFileName" across  all rules.
- Added "Image" field back in the rules highlighted by Florian
 2022-05-13 11:52:31 +01:00
Nasreddine Bencherchali 1e494e508a Update proc_creation_win_powershell_defender_exclusion.yml 
Added ' -ExclusionIpAddress' Option
 2022-05-12 23:28:14 +01:00
Nasreddine Bencherchali d8a3ca6919 Updated Rules to Use OriginalFileName 2022-05-12 23:27:48 +01:00
Florian Roth 93caa59248 fix: lowercase false positive 2022-05-12 21:56:46 +02:00
Florian Roth 26e041f13a fix: VSCode icacls 2022-05-12 21:48:05 +02:00
Florian Roth 8692140b26 Merge pull request #2982 from jstnk9/master 
Create registry_set_scr_file_executed_by_rundll32.yml
 2022-05-12 17:40:24 +02:00
Florian Roth 9e218149d9 Merge pull request #3008 from SigmaHQ/rule-devel 
refactor: AV rules, changes, new PW protected ZIP rules
 2022-05-12 17:38:11 +02:00
Florian Roth 1b9ce19b2c fix: several issues 2022-05-12 17:30:30 +02:00
Florian Roth 23fbf66679 Removed duplicate rule 2022-05-12 17:19:57 +02:00
Florian Roth 2cd5a93fb6 refactor: update antivirus rules 2022-05-12 17:19:46 +02:00
frack113 1f7021fedd Merge pull request #2996 from frack113/WerFault 
Add file_event_win_werfault_dll_hijacking
 2022-05-12 17:13:11 +02:00
Florian Roth ccfa7742da Update file_event_win_werfault_dll_hijacking.yml 2022-05-12 13:59:49 +02:00
Florian Roth ee3aba2541 Merge pull request #3005 from BlackB0lt/patch-27 
Create win_security_krbrelayup_service_installation.yml
 2022-05-12 13:01:44 +02:00
Florian Roth fe312319d3 Update win_security_krbrelayup_service_installation.yml 2022-05-12 13:01:24 +02:00
frack113 69b4bd551c Merge pull request #3004 from redsand/fp_dnsZoneScope 
filtering out dnsZoneScope
 2022-05-12 06:56:50 +02:00
Florian Roth 2b0db86440 Merge pull request #3002 from phantinuss/master 
Various new Rule Tests
 2022-05-11 15:49:46 +02:00
Sittikorn S 800669d90c Update win_security_krbrelayup_service_installation.yml 2022-05-11 18:59:37 +07:00
Sittikorn S df8c6c118f Create win_security_krbrelayup_service_installation.yml 
Detects service creation from KrbRelayUp tool
 2022-05-11 18:59:14 +07:00
phantinuss 6f92a11c02 chore: test rules: check for all modifier with single item 2022-05-11 11:06:09 +02:00
Tim Shelton d072472b25 filtering out dnsZoneScope 2022-05-10 21:29:05 +00:00
frack113 4b829c45cd Merge pull request #3000 from redsand/fp_win_direct_syscall_ntopenprocess 
Fp win direct syscall ntopenprocess
 2022-05-10 17:50:18 +02:00
frack113 8cba1e0e06 Merge pull request #2997 from nasbench/master 
Small Update
 2022-05-10 17:29:39 +02:00
phantinuss 112b715dd6 chore: test rules: reactivate single value list check 2022-05-10 17:13:04 +02:00
jstnk9 cf975127b6 title modified 2022-05-10 11:41:19 +02:00
phantinuss b4fdb13e8a chore: test rules: check for unused selections 2022-05-10 11:07:40 +02:00
Tim Shelton db6d32c6b9 Adding condition update 2022-05-09 23:55:37 +00:00
Tim Shelton 5f0ca05492 Adding FP filter for cylance 2022-05-09 23:54:40 +00:00
Nasreddine Bencherchali 5151fc25c9 Updated "modified" field 2022-05-09 19:28:50 +01:00
Nasreddine Bencherchali b987752cfe Small update 
- Updated regini rules to take into consideration OriginalFileName
- Added another function to execute execute click-once via rundll32 (dfshim)
 2022-05-09 19:26:51 +01:00
frack113 c1a99350e6 Add file_event_win_werfault_dll_hijacking 2022-05-09 19:27:11 +02:00
Florian Roth 4e7ceae0e1 rule: added another keyword 2022-05-09 18:33:34 +02:00
Florian Roth ec4beca37b Merge branch 'master' into rule-devel 2022-05-09 18:03:29 +02:00
Florian Roth 9d87716dfb rule: encrypted ZIP files 2022-05-09 18:03:16 +02:00
Florian Roth 8b798fbf21 refactor: tightened task scheduler rule 2022-05-09 18:03:02 +02:00
Florian Roth cc68a89ad0 refactor: moved rule 2022-05-09 18:02:36 +02:00
phantinuss b991a5be52 chore: test rules: warn on errors or invalid FP reasons 
also adapted the existing rules to pass the tests
 2022-05-09 16:07:55 +02:00