security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,034 Commits 1 Branch 57 Tags
ed5963493c04698bcb0c4a02bf54b39aeeaba4e7
Commit Graph

2969 Commits

Author SHA1 Message Date
Florian Roth ed5963493c Merge pull request #3012 from svch0stz/patch-2 
Update proc_creation_win_webshell_spawn.yml
 2022-05-16 16:51:04 +02:00
frack113 f386440bb3 Add status 2022-05-15 16:17:02 +02:00
svch0stz 3ec531979a Update proc_creation_win_webshell_spawn.yml 
Example pulled from manage engine below:

Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ParentImage: C:\Program Files\ManageEngine\SupportCenterPlus\jre\bin\java.exe
ParentCommandline: "..\jre\bin\java" -Dcatalina.home=.. -Dserver.home=.. -Dserver.stats=1000  <snip>
 2022-05-15 14:57:21 +10:00
Nasreddine Bencherchali 4241a5d13e Update proc_creation_win_wmi_spwns_powershell.yml 2022-05-13 15:33:48 +01:00
Nasreddine Bencherchali ae2ddae5aa Fix Requested Changes 2022-05-13 15:28:22 +01:00
Nasreddine Bencherchali 2e689eca54 Quick Fix 
- Removed "Contains" modifier from "OriginalFileName" across  all rules.
- Added "Image" field back in the rules highlighted by Florian
 2022-05-13 11:52:31 +01:00
Nasreddine Bencherchali 1e494e508a Update proc_creation_win_powershell_defender_exclusion.yml 
Added ' -ExclusionIpAddress' Option
 2022-05-12 23:28:14 +01:00
Nasreddine Bencherchali d8a3ca6919 Updated Rules to Use OriginalFileName 2022-05-12 23:27:48 +01:00
Florian Roth 26e041f13a fix: VSCode icacls 2022-05-12 21:48:05 +02:00
Florian Roth 9e218149d9 Merge pull request #3008 from SigmaHQ/rule-devel 
refactor: AV rules, changes, new PW protected ZIP rules
 2022-05-12 17:38:11 +02:00
Florian Roth 23fbf66679 Removed duplicate rule 2022-05-12 17:19:57 +02:00
Florian Roth 2b0db86440 Merge pull request #3002 from phantinuss/master 
Various new Rule Tests
 2022-05-11 15:49:46 +02:00
phantinuss 6f92a11c02 chore: test rules: check for all modifier with single item 2022-05-11 11:06:09 +02:00
phantinuss 112b715dd6 chore: test rules: reactivate single value list check 2022-05-10 17:13:04 +02:00
phantinuss b4fdb13e8a chore: test rules: check for unused selections 2022-05-10 11:07:40 +02:00
Nasreddine Bencherchali 5151fc25c9 Updated "modified" field 2022-05-09 19:28:50 +01:00
Nasreddine Bencherchali b987752cfe Small update 
- Updated regini rules to take into consideration OriginalFileName
- Added another function to execute execute click-once via rundll32 (dfshim)
 2022-05-09 19:26:51 +01:00
phantinuss b991a5be52 chore: test rules: warn on errors or invalid FP reasons 
also adapted the existing rules to pass the tests
 2022-05-09 16:07:55 +02:00
phantinuss dbd68bf3f0 chore: test rules: capitalization on FP list entries 
Entires to the false positive list should begin with
a capital letter. e.g. Unkown instead of unkown.

Fixed the existing rules accordingly
 2022-05-09 16:07:44 +02:00
Florian Roth 99dc599432 Update proc_creation_win_lolbin_ie4uinit.yml 2022-05-07 10:55:58 +02:00
Florian Roth 4c51bab130 Update proc_creation_win_lolbas_replace.yml 2022-05-07 10:55:03 +02:00
frack113 c90e2828d4 Lolbin 2022-05-07 10:37:55 +02:00
Florian Roth 35a7244c62 Merge pull request #2986 from elhoim/susp_regsvr32_child_explorer 
[New Rule] Suspicious explorer as child of regsvr32
 2022-05-06 20:17:33 +02:00
Florian Roth 3ed4c1ad14 Merge pull request #2985 from humpalum/patch-6 
Create proc_creation_win_susp_NtlmRelay.yml
 2022-05-06 20:17:02 +02:00
Florian Roth bf9417c88d Update proc_creation_win_susp_ntlmrelay.yml 2022-05-06 19:46:24 +02:00
Florian Roth 5243e5567f Update proc_creation_win_susp_regsvr32_explorer.yml 2022-05-06 19:43:43 +02:00
Nasreddine Bencherchali f729bbef1d Update proc_creation_win_tool_nircmd.yml 2022-05-06 15:18:42 +01:00
Nasreddine Bencherchali 4a4ce131c1 Update proc_creation_win_tool_nircmd.yml 2022-05-06 12:11:54 +01:00
Nasreddine Bencherchali bd2f527a36 Update proc_creation_win_susp_advancedrun.yml 2022-05-05 22:32:44 +01:00
Nasreddine Bencherchali 43d4bfa9db Update proc_creation_win_tool_nircmd.yml 2022-05-05 22:32:36 +01:00
Nasreddine Bencherchali 04ad307e4e Update proc_creation_win_susp_advancedrun_priv_user.yml 
Added cases for LocalService and NetworkService, which could be interesting to monitor:

RunAs=10 (Network Service)
RunAs=11 (Local Service)
 2022-05-05 21:06:53 +01:00
Florian Roth a285238808 fix: typo 2022-05-05 19:01:43 +02:00
Tobias Michalski 91a2411ea3 Update and rename proc_creation_win_susp_NtlmRelay.yml to proc_creation_win_susp_ntlmrelay.yml 2022-05-05 18:57:42 +02:00
Florian Roth 35d1aaa6bb Merge pull request #2987 from elhoim/add_sec_service 
Adding security services and defender options
 2022-05-05 18:56:51 +02:00
Florian Roth 10fb5b5bbf Merge pull request #2978 from frack113/lolbin_20220502 
Lolbin windows rules
 2022-05-05 17:06:24 +02:00
David ANDRE c1d4e3377a Added 2 references.\nAdded modified date and author credits.\nAdded WindowsDefender Registry Key options 2022-05-05 17:05:33 +02:00
David ANDRE c73205ef59 Remove trailing spaces of services names 2022-05-05 16:30:18 +02:00
David ANDRE c94b385bae Added two services 2022-05-05 16:28:43 +02:00
David ANDRE 0bce08b83f correct selection named status 2022-05-05 15:20:05 +02:00
David ANDRE 357a651b49 [New Rule] Suspicious explorer as child of regsvr32 2022-05-05 15:11:20 +02:00
Tobias Michalski ca36856d41 Create proc_creation_win_susp_NtlmRelay.yml 2022-05-05 13:58:51 +02:00
Florian Roth 4f1c6b619f Update proc_creation_win_lolbin_printbrm.yml 2022-05-05 08:00:22 +02:00
Florian Roth 1da043e727 Update proc_creation_win_lolbin_jsc.yml 2022-05-05 07:58:25 +02:00
Florian Roth f21961f366 Update proc_creation_win_lolbin_gpscript.yml 2022-05-05 07:57:31 +02:00
frack113 2ec87f0459 Fix errors 2022-05-02 20:05:30 +02:00
Florian Roth 8b0ed3d064 Update proc_creation_win_susp_gpresult.yml 2022-05-02 19:25:42 +02:00
frack113 74cdc43549 Lolbin rules 2022-05-02 19:19:12 +02:00
frack113 315a79fcf0 Update proc_creation_win_susp_gpresult.yml 2022-05-02 18:13:03 +02:00
frack113 e5a30a7b89 Add proc_creation_win_susp_gpresult 2022-05-01 19:18:39 +02:00
Florian Roth 548b223e3b Merge pull request #2973 from SigmaHQ/rule-devel 
fix: missing author
 2022-04-29 16:53:09 +02:00