security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,892 Commits 1 Branch 57 Tags
fefb8564717d69af72ededb4172bc7ec00aac734
Commit Graph

400 Commits

Author SHA1 Message Date
nsaddler 7ee644eac0 Update powershell_CL_Invocation_LOLScript_v2.yml 2020-10-28 19:30:21 +03:00
nsaddler d0a796439b Update powershell_CL_Invocation_LOLScript.yml 2020-10-28 19:25:43 +03:00
Наталья Шорникова a4a3e01f25 Splitting into two rules 2020-10-28 19:13:29 +03:00
Наталья Шорникова 55a7fe6b9d Splitting into two rules 2020-10-28 19:08:23 +03:00
Florian Roth ee789a309c fix: FP with expression 2020-10-20 13:11:10 +02:00
Timur Zinniatullin 8b255ab959 Add powershell_invoke_obfuscation_via_compress.yml 2020-10-18 19:50:58 +03:00
Timur Zinniatullin eb2af704e7 Update powershell_invoke_obfuscation_via_rundll.yml 2020-10-18 19:05:27 +03:00
Timur Zinniatullin 35a9a7d46c Update powershell_invoke_obfuscation_via_rundll.yml 2020-10-18 18:54:59 +03:00
Timur Zinniatullin eee01f6a86 Add powershell_invoke_obfuscation_via_rundll.yml 2020-10-18 18:51:51 +03:00
OpalSec ca09ae5039 Modification of search logic per advice from @zinint 
Edited suggested searches to improve performance:

VAR+
16ms:	.*cmd.*(?:\/c|\/r).*set.*(?:\{\d\}){1,}\\\"\s+?\-f(?:.*\)){1,}.*\"

6ms:  .*cmd.{0,5}(?:\/c|\/r)(?:\s|)\"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\\"\s+?\-f(?:.*\)){1,}.*\"

STDIN+
7ms:    .*cmd.*(?:\/c|\/r).*powershell.+(?:\$\{?input}?|noexit).*\"

3ms:    .*cmd.{0,5}(?:\/c|\/r).+powershell.+(?:\$\{?input\}?|noexit).+\"

CLIP+
28ms:    .*cmd.*(?:\/c|\/r).*\|.*clip(?:\.exe)?.*&&.*clipboard]::\(\s\\\"\{\d\}.*\-f.*\"

11ms:    .*cmd.{0,5}(?:\/c|\/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\\"\{\d\}.+\-f.+\"
 2020-10-18 21:15:43 +11:00
nsaddler 3aa2a73ba7 Update powershell_CL_Invocation_LOLScript.yml 2020-10-18 10:38:40 +03:00
nsaddler a6f00d6acc Update powershell_CL_Invocation_LOLScript.yml 2020-10-18 02:48:21 +03:00
Vasiliy Burov 700ed134bc Update powershell_cmdline_special_characters.yml 2020-10-16 10:18:37 +03:00
Vasiliy Burov d2184aee5e Update powershell_cmdline_special_characters.yml 2020-10-16 09:58:59 +03:00
Jonhnathan fc6c727c70 Update powershell_malicious_commandlets.yml 2020-10-15 20:59:27 -03:00
Jonhnathan ce4e22750d Update powershell_winlogon_helper_dll.yml 2020-10-15 17:15:23 -03:00
Jonhnathan efe9c2d3d6 Update powershell_shellcode_b64.yml 2020-10-15 17:14:01 -03:00
Jonhnathan 013533fceb Update powershell_prompt_credentials.yml 2020-10-15 17:13:16 -03:00
Jonhnathan 8cf2596068 Update powershell_malicious_keywords.yml 2020-10-15 17:12:08 -03:00
Jonhnathan ec10d5a61f Update powershell_malicious_commandlets.yml 2020-10-15 17:11:20 -03:00
Jonhnathan 4a3607d50b Update powershell_exe_calling_ps.yml 2020-10-15 17:09:47 -03:00
Vasiliy Burov b10332dde8 Update powershell_cmdline_special_characters.yml 2020-10-15 21:31:24 +03:00
Vasiliy Burov ea1a288cc8 Update powershell_cmdline_special_characters.yml 2020-10-15 20:55:12 +03:00
Vasiliy Burov 2657a0219c Update powershell_cmdline_special_characters.yml 2020-10-15 20:33:56 +03:00
Vasiliy Burov d27574ce08 Update powershell_cmdline_special_characters.yml 2020-10-15 20:07:59 +03:00
Vasiliy Burov 1838aac682 Update powershell_cmdline_special_characters.yml 2020-10-15 20:04:49 +03:00
Vasiliy Burov fa7036430e Update powershell_cmdline_special_characters.yml 2020-10-15 19:39:24 +03:00
Vasiliy Burov 1b0d4e546f Create powershell_cmdline_special_characters.yml 2020-10-15 19:04:22 +03:00
Наталья Шорникова ef8f5e626f Adding powershell_CL_Mutexverifiers_LOLScript.yml Rule 2020-10-15 17:55:11 +03:00
Наталья Шорникова e8f21bc094 Adding powershell_CL_Invocation_LOLScript.yml Rule 2020-10-15 17:41:52 +03:00
OpalSec ffbcb402e3 Creation of Rules for Task 24 - Invoke-Obfuscation VAR+ Launcher 2020-10-15 21:36:27 +11:00
OpalSec 762840ec25 Creation of Rules for Task 25 - Invoke-Obfuscation STDIN+ Launcher 2020-10-15 17:59:36 +11:00
OpalSec df7bd91ffb Create powershell_invoke_obfuscation_clip+.yml 2020-10-15 17:50:27 +11:00
invrep-de 3be21d5478 Some minor formatting updates; 
Formatting updates;
 2020-10-14 16:55:52 -04:00
invrep-de 8f28c16d6e Some further updates to fix spacing; 
Some further updates to fix spacing;
 2020-10-14 15:42:19 -04:00
invrep-de 637065fd97 Some minor updates to address spacing; 
Some further minor updates to address spacing;
 2020-10-14 15:41:31 -04:00
invrep-de 2672b10808 Some minor restructuring to incorporate the feedback from the oscd team; 
Some minor restructuring to incorporate the feedback from the oscd team;
 2020-10-14 15:37:15 -04:00
Thomas Patzke 6cc33e5989 Merge pull request #1060 from svch0stz/oscd6 
[OSCD] Created powershell_suspicious_mounted_share_deletion.yml
 2020-10-13 22:59:25 +02:00
Thomas Patzke 08eec2b6e6 Merge pull request #1094 from NikitaStormwind/Regular30 
[OSCD] Detects Obfuscated Powershell via use Rundll32 in Scripts #30 (4104, 4103)
 2020-10-13 21:43:16 +02:00
Thomas Patzke 5f4d60951d Merge pull request #1112 from NikitaStormwind/regular29(1) 
[OSCD] Detects Obfuscated Powershell via use Clip.exe in Scripts #29 (4104, 4103)
 2020-10-13 21:34:38 +02:00
Thomas Patzke 7e8930f15e Merge pull request #1142 from NikitaStormwind/regular28(1) 
[OSCD] Detects Obfuscated Powershell via Stdin in Scripts #28 (4104, 4103)
 2020-10-13 11:38:26 +02:00
Thomas Patzke 0c77edb859 Merge pull request #1120 from bczyz1/oscd 
[OSCD] Create powershell_icmp_exfiltration.yml
 2020-10-13 11:37:40 +02:00
Vasiliy Burov dff2e16ad2 Update powershell_cmdline_specific_comb_methods.yml 2020-10-13 10:59:20 +03:00
Roberto Rodriguez 2cb540f95e 13 Rules from THP - Backlog Rules (old) 2020-10-13 03:33:55 -04:00
cyb3rward0g cd270672a6 Update delete alternate powershell host 2020-10-12 23:52:35 -04:00
invrep-de 6a9bc7063f [OSCD] Bad Opsec Powershell Artifacts 2020-10-13 02:21:46 +02:00
Timur Zinniatullin d1ef56bddb @aw350m3 style complience (: 2020-10-13 02:47:09 +03:00
Timur Zinniatullin 870574b635 Add powershell_invoke_obfuscation_via_var++.yml 2020-10-13 02:19:57 +03:00
Thomas Patzke cb86c509f1 Merge pull request #1129 from bczyz1/oscd-sprint-2-keylogging 
[OSCD] Modify powershell_malicious_commandlets.yml to leverage ScriptBlock logging feature
 2020-10-13 00:58:24 +02:00
Thomas Patzke eaa9f293e7 Merge pull request #1125 from vburov/patch-12 
[OSCD] Create powershell_cmdline_reversed_strings
 2020-10-13 00:57:22 +02:00