security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,629 Commits 1 Branch 57 Tags
f2cc5c8ce7ddeb6727e0c76f3364735dfd6dfdce
Commit Graph

3 Commits

Author SHA1 Message Date
Florian Roth 15cee5c0b1 Update proc_creation_win_susp_taskkill.yml 2022-05-18 17:28:26 +02:00
Nasreddine Bencherchali dcf236fede Quick Updates and Fixes 
- Added "Invoke-EventViewer.ps1" script to the rule "file_event_win_powershell_exploit_scripts"
- Added "OriginalFileName" to "proc_creation_win_susp_taskkill"
- Created rule for "winword" being used as a LOLBIN to download and load arbitrary DLLs
 2022-05-18 12:50:59 +01:00
frack113 8bb3379b68 Normalization of rule names 2022-02-22 11:16:31 +01:00