security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,892 Commits 1 Branch 57 Tags
fefb8564717d69af72ededb4172bc7ec00aac734
Commit Graph

7892 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
frack113 65251e13e9 Add missing system field 2021-08-06 10:52:24 +02:00
Lei Chen 932fe14cf6 Update README.md 2021-08-06 16:51:19 +08:00
Lei Chen 0078ee795b chore: update sigma ci badge 
Replace travis-ci tatus badge with github actions tatus badge
 2021-08-06 16:47:35 +08:00
frack113 cf8d8d3ed4 fix TargetFilename case error 2021-08-06 08:43:05 +02:00
Sam0x90 96911e55b9 Adding detection rule for esentutl utility 
Used by Conti affiliates to target NTDS file and MSEdge info
 2021-08-06 00:55:57 +04:00
frack113 4a8192fecc fix typo mono 2021-08-05 22:38:48 +02:00
RedKyper b353a10643 elastalert multi output file 2021-08-05 20:37:07 +02:00
Florian Roth eb247704fe Merge pull request #1761 from d4rk-d4nph3/master 
Added rule for Cabinet file expansion and Pypykatz
 2021-08-05 15:50:12 +02:00
Florian Roth c44b22b52f Merge pull request #1762 from frack113/redcanary_collection 
[OSCD] Redcanary TA0009 collection
 2021-08-05 15:49:10 +02:00
Florian Roth 83505351bc Merge pull request #1764 from frack113/fix_product 
fix product sysmon_apt_sourgrum.yml
 2021-08-05 15:48:35 +02:00
Florian Roth f67e372af6 Merge pull request #1766 from frack113/patch_elastalert 
Fix duplicate output in elastalert Backend
 2021-08-05 15:48:18 +02:00
Florian Roth 448868302d Merge pull request #1767 from frack113/redcanary_t1497_001 
[OSCD] Detect Virtualization Environment (Windows) T1497.001
 2021-08-05 15:47:37 +02:00
Florian Roth 3634901bf1 Update poweshell_detect_vm_env.yml 2021-08-05 15:47:29 +02:00
Florian Roth 6a11190e79 Merge pull request #1769 from frack113/fix_powershell_400 
Cleanup eventid 400 powershell-classic
 2021-08-05 15:47:04 +02:00
Florian Roth da6b5f8ec5 Merge pull request #1770 from frack113/redcanary_powershell_T1070.006 
[OSCD] powershell_timestomp.yml T1070.006
 2021-08-05 15:46:48 +02:00
Florian Roth b1fb462c39 Update powershell_timestomp.yml 2021-08-05 15:46:01 +02:00
Florian Roth 9b7be5985e Merge pull request #1773 from phantinuss/master 
Two CobaltStrike BOF rules and a little fix on the local rule test script usage text
 2021-08-05 15:42:47 +02:00
Florian Roth 6507e8c060 Merge pull request #1774 from frack113/fix_4104_ScriptBlockText 
Clean-up Powershell EventID 4104
 2021-08-05 15:42:35 +02:00
Florian Roth 52b41da731 Merge pull request #1775 from austinsonger/sysmon_disabled_pua_protection_on_microsoft_defender.yml 
Create sysmon_disabled_pua_protection_on_microsoft_defender.yml
 2021-08-05 15:42:17 +02:00
Florian Roth c05dacb1f0 Merge pull request #1776 from austinsonger/sysmon_disabled_tamper_protection_on_microsoft_defender.yml 
sysmon_disabled_tamper_protection_on_microsoft_defender.yml
 2021-08-05 15:41:54 +02:00
Florian Roth 53cfe2895d Merge pull request #1777 from austinsonger/sysmon_disabled_exploit_guard_network_protection_on_microsoft_defender.yml 
sysmon_disabled_exploit_guard_network_protection_on_microsoft_defender.yml
 2021-08-05 15:41:37 +02:00
Florian Roth 6742b4ad3d Merge pull request #1778 from frack113/winlogbeat_modules_enabled 
Update winlogbeat-modules-enabled.yml
 2021-08-05 14:44:23 +02:00
frack113 4b44ee654b Fix missing a space 2021-08-05 13:36:18 +02:00
frack113 0b053e79cc fix syntax error 2021-08-05 13:33:39 +02:00
frack113 439b3cecc3 Add most of security EventID 2021-08-05 13:31:39 +02:00
frack113 ac43eecc36 Add eventid 4624 2021-08-05 11:20:22 +02:00
frack113 1d1b58d712 add sysmon mapping 2021-08-05 10:54:58 +02:00
Austin Songer 483dacb209 Create sysmon_disabled_exploit_guard_network_protection_on_microsoft_defender.yml 2021-08-04 19:11:00 -05:00
Austin Songer ff7fb4e4d2 Create sysmon_disabled_tamper_protection_on_microsoft_defender.yml 2021-08-04 19:08:10 -05:00
Austin Songer 6a2663a3ae Update sysmon_disabled_pua_protection_on_microsoft_defender.yml 2021-08-04 17:00:34 -05:00
Austin Songer 8d195bf5d5 Update sysmon_disabled_pua_protection_on_microsoft_defender.yml 2021-08-04 13:11:31 -05:00
Austin Songer bae075713c Update sysmon_disabled_pua_protection_on_microsoft_defender.yml 2021-08-04 13:10:37 -05:00
Austin Songer f89ba18c5d Create sysmon_disabled_pua_protection_on_microsoft_defender.yml 2021-08-04 11:27:41 -05:00
phantinuss 882ea7ec22 fix: remove unnecessary single value list 2021-08-04 15:50:39 +02:00
frack113 481cd9aca1 add security 7045 2021-08-04 15:46:05 +02:00
frack113 47086d5d78 fix duplicate 2021-08-04 15:12:01 +02:00
frack113 21228a21c7 update SYSMON Hashes 2021-08-04 15:09:02 +02:00
frack113 f040725dd8 fix EventID: 4104 ScriptBlockText 2021-08-04 14:49:50 +02:00
phantinuss 994701bd8e CobaltStrike injected AMSI bypass 2021-08-04 11:28:58 +02:00
eocete 692bc9a63a Added support for multicondition rules using Devo subqueries 2021-08-04 08:52:32 +02:00
frack113 644fe80786 add powershell_timestomp.yml 2021-08-03 16:01:54 +02:00
Bhabesh Rai 85b88c7646 Added rule for pypykatz 2021-08-03 15:06:27 +05:45
frack113 b5e4b04cb5 fix eventid 400 powershell-classic 2021-08-03 10:04:15 +02:00
frack113 0efe69bd36 add poweshell_detect_vm_env.yml 2021-08-03 08:30:26 +02:00
Florian Roth 97d2dc89a8 fix: order of modifiers 2021-08-02 00:25:09 +02:00
frack113 359dd6bbb8 fix my code 2021-08-01 19:34:07 +02:00
frack113 186583f78f fix the output not the core 2021-08-01 16:14:51 +02:00
Florian Roth bda207660d refactor: modified CobaltStrike service install rule 2021-07-31 12:51:42 +02:00
Florian Roth a04aa6ac49 rule: ADCSPwn 2021-07-31 10:18:21 +02:00
Florian Roth 6cd2e26fa0 rule: WinDivert driver load 2021-07-30 16:54:29 +02:00