security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,892 Commits 1 Branch 57 Tags
fefb8564717d69af72ededb4172bc7ec00aac734
Commit Graph

5864 Commits

Author SHA1 Message Date
frack113 acf2bfbd27 Update sigma_uuid verify 
Make a better verify code
 2021-09-05 10:43:42 +02:00
zakibro 5042ba65ac Update lnx_auditd_audio_capture.yml 
Added more references about arecord.
 2021-09-05 09:28:53 +02:00
Austin Songer fa5554660c Update sysmon_mal_cobaltstrike_re.yml 2021-09-04 17:33:05 -05:00
Pawel Mazur caf78b5ea1 New Rule - Linux-Audio-Capture 2021-09-04 22:10:34 +02:00
Austin Songer e7c5827776 Update azure_service_principal_removed.yml 2021-09-03 22:43:11 -05:00
Austin Songer 0612ea7f6e Update azure_device_no_longer_managed_or_compliant.yml 2021-09-03 22:42:26 -05:00
Austin Songer c420a17e05 Update azure_service_principal_removed.yml 2021-09-03 22:29:21 -05:00
Austin Songer fda1e3362e Update azure_owner_removed_from_application_or_service_principal.yml 2021-09-03 22:29:12 -05:00
Austin Songer 9d26116d27 Update azure_device_no_longer_managed_or_compliant.yml 2021-09-03 22:29:02 -05:00
Austin Songer 8fe7bfc452 Update azure_application_deleted.yml 2021-09-03 22:28:53 -05:00
Austin Songer c021ae9e7c Update and rename azure_device_or_configuration_deleted.yml to azure_device_or_configuration_modified_or_deleted.yml 2021-09-03 22:28:35 -05:00
Austin Songer 6744fb7f2e Create azure_application_deleted.yml 2021-09-03 22:25:34 -05:00
Austin Songer 70ac0104cf Create azure_service_principal_removed.yml 2021-09-03 22:25:01 -05:00
Austin Songer 6e15618c75 Create azure_device_or_configuration_deleted.yml 2021-09-03 22:24:32 -05:00
Austin Songer b478132769 Create azure_owner_removed_from_application_or_service_principal.yml 2021-09-03 22:23:59 -05:00
Austin Songer c0bdc3fb1b Create azure_device_no_longer_managed_or_compliant.yml 2021-09-03 22:23:21 -05:00
frack113 6780182c37 Merge pull request #1974 from frack113/tags_pack2 
Add missing Tags
 2021-09-03 19:13:32 +02:00
frack113 2e474628fa Merge pull request #1987 from zakibro/master 
New Rule - Linux-Auditd-System Information Discovery
 2021-09-03 19:10:28 +02:00
frack113 688df3405a Merge pull request #1970 from frack113/red_T1564.004_1 
Redcanary  t1564.004  ADS test 1
 2021-09-03 19:06:51 +02:00
frack113 77c6b74c72 Merge pull request #1985 from mvelazc0/master 
Adding Petitpotam/ADCS attack vector detections
 2021-09-03 19:06:03 +02:00
mvelazco a7a002cb7f updating fields as per frack113 feedback 2021-09-03 10:01:54 -04:00
frack113 769451dc03 Add missing id 2021-09-03 13:42:15 +02:00
frack113 815134df7f Cleanup 2021-09-03 13:30:10 +02:00
phantinuss aa2e86963c fix: rename filter 2021-09-03 13:26:34 +02:00
phantinuss f3bdb0e43d fix: remove unneeded selection 2021-09-03 13:26:23 +02:00
phantinuss 2de2de8433 Addition to UAC Bypasses 2021-09-03 13:26:11 +02:00
zakibro 8bd859f550 Update lnx_auditd_system_info_discovery.yml 2021-09-03 13:07:42 +02:00
ncrqnt adc3c9e608 fixed date: switched day/month 2021-09-03 12:03:38 +02:00
Pawel Mazur 864286e206 New Rule - Linux-Auditd-System Information Discovery 2021-09-03 11:33:18 +02:00
frack113 89562273cc Merge pull request #1984 from austinsonger/azure_app_credential_modification.yml 
azure_app_credential_modification.yml
 2021-09-03 08:17:55 +02:00
frack113 88389f945d Merge pull request #1983 from austinsonger/azure_service_principal_created.yml 
azure_service_principal_created.yml
 2021-09-03 08:14:47 +02:00
frack113 d40cdec062 Merge pull request #1982 from austinsonger/azure_network_firewall_policy_modified_or_deleted.yml 
azure_network_firewall_policy_modified_or_deleted.yml
 2021-09-03 08:13:30 +02:00
frack113 bd1b4c0d70 Merge pull request #1978 from rachelrice/update_aws_login 
Update AWS Update Login Profile rule
 2021-09-03 08:12:28 +02:00
frack113 1fc2a39720 Merge pull request #1975 from frack113/red_T1564.004_2 
Redcanary  t1564.004 test 2
 2021-09-03 08:12:08 +02:00
frack113 11e4b900e4 Update global id 2021-09-03 06:59:40 +02:00
frack113 135d0a2c61 Update global id 2021-09-03 06:50:00 +02:00
frack113 a6bb5574fb Update global id 2021-09-03 06:35:35 +02:00
mvelazco ba41e922d2 adding Petitpotam host detections 2021-09-03 00:12:49 -04:00
Austin Songer 775c0e8e7f Update azure_app_credential_modification.yml 2021-09-02 21:00:21 -05:00
Austin Songer 643ec0abe3 Update azure_service_principal_created.yml 2021-09-02 21:00:02 -05:00
Austin Songer 10af7bbdb1 Create azure_app_credential_modification.yml 2021-09-02 20:53:32 -05:00
Austin Songer d25fd420d6 Create azure_service_principal_created.yml 2021-09-02 20:48:35 -05:00
Austin Songer 1272c76ae7 Create azure_network_firewall_policy_modified_or_deleted.yml 2021-09-02 20:31:27 -05:00
frack113 d02ee1eddd Update global ID 2021-09-02 21:16:55 +02:00
frack113 f90c7558a7 update global id 2021-09-02 21:03:25 +02:00
frack113 ac90ee0002 Update global ID 2021-09-02 20:23:23 +02:00
frack113 086a15fc45 Update global ID 2021-09-02 20:07:03 +02:00
Rachel Rice 78d3fa4795 Update AWS STS AssumeRole Misuse rule 
Update selection criteria for AWS STS AssumeRole Misuse rule for any event by an AssumedRole userIdentity.
Closes SigmaHQ/sigma#1963.
 2021-09-02 17:40:35 +01:00
Rachel Rice 7ccb773b20 Update AWS Update Login Profile rule 
Update selection criteria for AWS Update Login Profile rule to check for mismatch between userIdentity.arn and requestParameters.userName.
Closes SigmaHQ/sigma#1966.
 2021-09-02 17:37:41 +01:00
frack113 9bcefc6a93 move uuid from global 2021-09-02 16:05:05 +02:00