security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,749 Commits 1 Branch 57 Tags
f00aaf8461f97abec19f81aa4fc0edaa76ff6cf1
Commit Graph

155 Commits

Author SHA1 Message Date
Florian Roth a5c6bbe04d Merge pull request #1946 from SigmaHQ/rule-devel 
rule: ProxyToken CVE-2021-33766 Exchange
 2021-08-30 17:39:37 +02:00
Florian Roth af9392ba0f refactor: add 500 status code in selection2 
to avoid FPs with exploitation attempts
 2021-08-30 16:12:42 +02:00
Florian Roth 4a4966af77 rule: ProxyToken CVE-2021-33766 Exchange 2021-08-30 15:47:53 +02:00
frack113 718b44c38a fix List values must be strings or numbers (46) 2021-08-29 08:57:25 +02:00
frack113 061c093f3f Merge pull request #1918 from d4rk-d4nph3/master 
Added rule for Arcadyan Router Exploitations
 2021-08-25 08:10:48 +02:00
Bhabesh Rai df4180547e Merged rules 2021-08-25 11:18:51 +05:45
Bhabesh Rai a4d0e3453d Fix for CVE tag 2021-08-25 10:24:15 +05:45
Bhabesh Rai ce6141e318 Added rule for Arcadyan Router Exploitations 2021-08-24 21:11:46 +05:45
frack113 c2302a15da fix cve tags 2021-08-24 10:10:45 +02:00
frack113 8f85ac0fde tags update 2021-08-24 09:35:04 +02:00
SomeOne 295054dcbe Replace old mitre techniques by new one 2021-08-22 13:57:56 +02:00
frack113 07a87aa7f8 Merge pull request #1858 from frack113/fix_pr718 
Replace pr718
 2021-08-21 18:02:30 +02:00
Florian Roth 700b8e440f Merge pull request #1868 from d4rk-d4nph3/master 
Added rule for zero day CVE-2021-22123 in Fortinet WAFs
 2021-08-20 16:52:49 +02:00
Florian Roth 0c6db48ceb Update web_fortinet_cve_2021_22123_exploit.yml 2021-08-19 08:27:15 +02:00
Austin Songer c9128687ee Spelling Errors on Rules 2021-08-18 18:58:20 +00:00
Bhabesh Rai 8d9f2e059a Added rule for zero day CVE-2021-22123 in Fortinet WAFs 2021-08-18 17:28:57 +05:45
Florian Roth a2e45353aa Merge pull request #1825 from frack113/iis_ProxyLogon 
rule: ProxyLogon web_cve_2021_26858_iis_rce.yml
 2021-08-18 09:54:15 +02:00
frack113 e098fc73cb add keywords condition 2021-08-17 06:24:04 +02:00
frack113 c3457c9911 fix titles 2021-08-15 19:05:00 +02:00
frack113 245cb6d510 fix more errors 2021-08-15 18:55:44 +02:00
frack113 a75859a976 First commit 2021-08-15 16:00:14 +02:00
frack113 abcaf00aee Merge pull request #1818 from frack113/split_1802_net 
Correct lists with only 1 value
 2021-08-13 10:17:24 +02:00
Florian Roth 852d7a8b22 fix: typo in description 2021-08-12 10:11:17 +02:00
frack113 32fc191163 fix cs-uri-query and cs-uri-stem 2021-08-11 15:09:53 +02:00
frack113 ff5c9116a4 Update to w3c-logging 2021-08-11 11:28:04 +02:00
frack113 50ccd87904 fix title 2021-08-10 13:16:45 +02:00
frack113 1437b1943a add web_cve_2021_26858_iis_rce.yml 2021-08-10 13:09:43 +02:00
Florian Roth a9ad4eda4a rules: ProxyShell refactoring and new rule 2021-08-09 17:57:34 +02:00
frack113 fc64b8b937 Split PR 1802 fix net rules 2021-08-09 17:23:15 +02:00
Florian Roth af1e43f3c1 more generic 2021-08-08 23:05:56 +02:00
Florian Roth a80f9f280c refactor: feedback from Rich Warren 2021-08-08 23:05:23 +02:00
Florian Roth 5443298092 rule: ProxyShell improved 2021-08-08 18:52:49 +02:00
Florian Roth 0a8904a61e fix: issues with new rule 2021-08-07 10:10:12 +02:00
Florian Roth 1ac49a2055 rule: ProxyShell patterns 2021-08-07 09:22:24 +02:00
G Y 544ec5861b Update web_nginx_core_dump.yml 
Fixed typo in description field.
 2021-07-03 10:39:37 +08:00
Florian Roth f438039af9 Update web_cve_2021_22893_pulse_secure_rce_exploit.yml 2021-07-01 09:49:01 +02:00
Bhabesh Rai 206adbb2b6 Merging upstream updates 2021-07-01 12:18:30 +05:45
Sittikorn S c9ce298b2e Update web_cve_2021_22893_pulse_secure_rce_exploit.yml 
remove http response
 2021-06-29 17:49:01 +07:00
Sittikorn S 14d1c68cc8 Update web_cve_2021_22893_pulse_secure_rce_exploit.yml 2021-06-29 15:19:22 +07:00
Sittikorn S 67f483e6a9 Update web_cve_2021_22893_pulse_secure_rce_exploit.yml 2021-06-29 14:17:27 +07:00
Sittikorn S c446c519cf Update web_cve_2021_22893_pulse_secure_rce_exploit.yml 2021-06-29 13:59:08 +07:00
Sittikorn S f3c1d78615 Create web_cve_2021_22893_pulse_secure_rce_exploit.yml 2021-06-29 13:56:30 +07:00
Florian Roth ab73dd4dd6 rule: nginx core dump 2021-05-31 10:49:42 +02:00
Florian Roth 02323043d7 Create web_cve_2021_26814_wzuh_rce.yml 2021-05-22 15:45:38 +02:00
Florian Roth 3cf1be9e8d rule: exchange vulnerability CVE-2021-28480 2021-05-14 10:08:41 +02:00
Josh Brower af09dd8e3c Clean up: Webshell ReGeorg Detection 2021-04-05 13:01:10 -04:00
Florian Roth 428db0c74a Merge pull request #1382 from d4rk-d4nph3/master 
Added rule for CVE-2021-21978 in VMware View Planner
 2021-03-29 11:22:56 +02:00
Bhabesh Rai a58c5ed7cc Added rule for CVE-2021-21978 in VMware View Planner 2021-03-10 18:05:15 +05:45
Florian Roth dca5c870d7 Merge pull request #1374 from hieuttmmo/master 
Detect HAFNIUM operations
 2021-03-09 09:16:52 +01:00
Florian Roth 62b65a3578 Merge pull request #1375 from SigmaHQ/rule-devel 
fix: description
 2021-03-04 17:35:53 +01:00