security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
13,931 Commits 1 Branch 57 Tags
fec24ddd0f7cf56ea6e985fac2b5432055be32e5
Commit Graph

10867 Commits

Author SHA1 Message Date
Veramine 3bb741af66 Remove Windows 10 volume control false positive 
https://superuser.com/questions/1175267/what-is-this-rundll32-instance-running
 2022-12-21 23:41:39 -08:00
Nasreddine Bencherchali 9d4bbec633 Merge pull request #3805 from zakibro/master 
Create lnx_privileged_user_creation.yml
 2022-12-21 21:35:59 +01:00
Nasreddine Bencherchali 4c7db89847 fix: improve overall structure 2022-12-21 20:40:29 +01:00
Nasreddine Bencherchali b9ae5303f1 Merge pull request #2801 from tuanhxh1/master 
add rules related to usage of "usermod"
 2022-12-21 20:33:04 +01:00
zakibro a0c07b2fba Update rules/linux/builtin/lnx_privileged_user_creation.yml 
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
 2022-12-21 19:31:34 +01:00
zakibro 14f006382a Update rules/linux/builtin/lnx_privileged_user_creation.yml 
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
 2022-12-21 19:31:24 +01:00
Nasreddine Bencherchali d51ff694a4 fix: rule status 2022-12-21 19:23:23 +01:00
zakibro 0fa4f8a454 Create lnx_privileged_user_creation.yml 
Adding new use case for tracking of Creation of privileged user in linux
 2022-12-21 18:16:20 +01:00
Nasreddine Bencherchali c97463e774 fix: update linux rules 2022-12-21 17:59:46 +01:00
sai prashanth pulisetti 3b6100ccd9 Create Possible Manipulation Of Tokens on a Windows computers remotely Detected via impersonate (#3803) 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-12-21 13:27:22 +01:00
Florian Roth b75c7d4bdb Merge pull request #3802 from nasbench/nasbench-rule-devel 
feat: updates and enhancements
 2022-12-21 10:02:23 +01:00
Florian Roth f9d1eb1f2d Update proc_creation_win_renamed_office_processes.yml 2022-12-21 09:18:06 +01:00
Florian Roth 9372987801 fix: missing upper tick 
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
 2022-12-21 08:57:37 +01:00
Florian Roth 7e7cbe41c3 docs: change modified date 2022-12-21 08:57:05 +01:00
Nasreddine Bencherchali 4b6f5f143d feat: add more suspicious cases 
Co-authored-by: Florian Roth <venom14@gmail.com>
 2022-12-21 00:18:44 +01:00
Nasreddine Bencherchali 7c46e4c3c0 fix: fix #2479 2022-12-21 00:11:04 +01:00
Florian Roth 2580b84de3 fix: typo 2022-12-21 00:07:51 +01:00
Nasreddine Bencherchali beccf416da feat: add two new rules 2022-12-20 23:44:44 +01:00
Nasreddine Bencherchali c36acb333f fix: typo in comment 2022-12-20 22:28:49 +01:00
Nasreddine Bencherchali 6679347fe3 fix: rename files to follow convention 2022-12-20 22:25:49 +01:00
Nasreddine Bencherchali 68f1ce8b9e Merge branch 'SigmaHQ:master' into nasbench-rule-devel 2022-12-20 22:24:56 +01:00
Nasreddine Bencherchali e72bc1dcaf fix: add reference 2022-12-20 22:14:46 +01:00
Nasreddine Bencherchali 592e0062a1 fix: update condition and add new ref 2022-12-20 22:14:14 +01:00
zakibro 1a117d38e7 Update rules/linux/auditd/lnx_auditd_create_account.yml 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-12-20 19:30:26 +01:00
zakibro 59e4dc3e1c Modifying Creation Of An User Account 
Added additional test for record type of ADD_USER which should be generated whether you have created auditd rule or not.
 2022-12-20 15:51:40 +01:00
Nasreddine Bencherchali 7679d05706 fix: fp found in testing exchange server 2022-12-20 13:23:32 +01:00
Nasreddine Bencherchali 3f48eb4963 fix: selection name and add old path 2022-12-20 10:42:21 +01:00
Nasreddine Bencherchali de5345cfd2 fix: add permalink instead of master 2022-12-20 10:25:52 +01:00
Nasreddine Bencherchali 22761ec2c3 fix: add missing id 2022-12-20 10:25:03 +01:00
MetaOSINT ba52dc2aa8 T1539 Steal Web Session Cookie rules 
Update existing rule and add one new rule related to Steal Web Session Cookie technique (T1539)
 2022-12-19 23:20:13 -05:00
Nasreddine Bencherchali 05bdb9af74 fix: rename files to fit logic 2022-12-19 19:28:23 +01:00
Nasreddine Bencherchali ff94bfee2b fix: update description to fit logic 2022-12-19 19:23:11 +01:00
Nasreddine Bencherchali 9c308642c7 fix: apply suggestions from code review 
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
 2022-12-19 19:21:55 +01:00
Nasreddine Bencherchali c374413664 fix: change to permalink 2022-12-19 18:15:57 +01:00
Nasreddine Bencherchali 060174e2dd fix: small fixes 
- Added modified date
- Updated DLL sideload version
 2022-12-19 18:14:01 +01:00
pbssubhash 8a9f1ee273 Update file_event_win_wermgr_local_privilege_escalation.yml 2022-12-19 22:39:05 +05:30
pbssubhash ae974d8f15 Modifying existing rule instead of a new one 2022-12-19 22:35:36 +05:30
pbssubhash b763ddd7c7 Update file_event_win_dircreate2system_privesc.yml 2022-12-19 22:21:37 +05:30
pbssubhash 8d617d2587 Create file_event_win_dircreate2system_privesc.yml 2022-12-19 22:14:25 +05:30
Nasreddine Bencherchali ba3e985bed feat: multiple update and enhancements 2022-12-19 17:41:40 +01:00
Nasreddine Bencherchali 025c1a4aae fix: enhance logic and severity 2022-12-19 11:21:24 +01:00
Qasim Qlf 9318c05751 fix: modify the detection and condtion 2022-12-19 15:00:00 +05:00
Nasreddine Bencherchali ecaf76f661 Merge pull request #1964 from BlackB0lt/patch-14 
Create CVE-2021-26084 detection
 2022-12-18 21:08:48 +01:00
frack113 646351808e Refractor (#3794) 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
 2022-12-18 21:00:14 +01:00
frack113 41d841ada2 Merge pull request #3793 from nasbench/nasbench-rule-devel 
feat: updates and enhancements
 2022-12-18 18:48:06 +01:00
Nasreddine Bencherchali 1882a4a0c2 fix: remove unnecessary definition 2022-12-18 15:24:58 +01:00
Nasreddine Bencherchali 3f6bcb6cee fix: fp found in testing 2022-12-18 15:07:47 +01:00
orenebahar 021499e6ef Update net_connection_win_malware_backconnect_ports.yml 
Add description about the right event ID in sysmon configuration
 2022-12-18 12:13:29 +00:00
Nasreddine Bencherchali a606223568 fix: add missing filename to the logic 2022-12-16 19:47:13 +01:00
Nasreddine Bencherchali dbe3c80dd3 fix: fp found with baseline 2022-12-16 18:50:38 +01:00