security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,892 Commits 1 Branch 57 Tags
fefb8564717d69af72ededb4172bc7ec00aac734
Commit Graph

7892 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
frack113 8d8df10687 use same trick as Invoke-Obfuscation Obfuscated IEX Invocation 2021-05-27 09:31:57 +02:00
frack113 ce53a5a67b use same trick as Invoke-Obfuscation Obfuscated IEX Invocation 2021-05-27 09:30:00 +02:00
frack113 417da3ac95 use same trick as Invoke-Obfuscation Obfuscated IEX Invocation 2021-05-27 09:28:06 +02:00
frack113 f0d1c9aa7d use same trick as Invoke-Obfuscation Obfuscated IEX Invocation 2021-05-27 09:26:08 +02:00
frack113 788ebbafdc use same trick as Invoke-Obfuscation Obfuscated IEX Invocation 2021-05-27 09:20:29 +02:00
Florian Roth fb07b204b4 Merge pull request #1510 from SigmaHQ/rule-devel 
CobaltStrike Pipe Rule Changes
 2021-05-26 18:30:34 +02:00
Florian Roth a5fe7af25f Cobalt Strike Service Installation 2021-05-26 18:05:38 +02:00
Florian Roth c1cebe627a refactor: reworked CS pipe rule 2021-05-26 17:22:34 +02:00
Florian Roth d06f2bcf14 fix: sysmon backend "startswith" 2021-05-26 15:42:16 +02:00
Florian Roth ba12057919 Merge pull request #1505 from WojciechLesicki/master 
Update rule regarding other named pipe
 2021-05-26 14:35:22 +02:00
Florian Roth bb71860fb2 Merge pull request #1509 from vastlimits/feature/update-6.1 
Updated uberAgent backend to support version 6.1.
 2021-05-26 13:08:08 +02:00
Florian Roth 8aabb58eca Merge pull request #1498 from w0rk3r/otrf 
Update broken OTRF Threat Hunter Playbook References
 2021-05-26 13:06:16 +02:00
WojciechLesicki 8b707bc948 Added also \status_ pipe. 2021-05-25 21:58:22 +02:00
WojciechLesicki f1a0308e73 Add one more pipe, references etc. 2021-05-25 21:07:23 +02:00
Bhabesh Rai cc9ac2ddcf Added rule for PowerView's malicious cmdlets 2021-05-25 21:04:32 +05:45
WojciechLesicki 38552e98cf Adding some pipes 2021-05-25 15:47:34 +02:00
Florian Roth 5e62cc2094 Merge pull request #1503 from frack113/fix_typo 
Fix some typo
 2021-05-25 15:03:28 +02:00
frack113 3717c68bb7 fix typo of level 2021-05-24 10:45:58 +02:00
frack113 104a004b3d fix typo of tags 2021-05-24 10:41:17 +02:00
frack113 afb3d63900 fix typo of fields 2021-05-24 10:37:14 +02:00
frack113 1fcd0bf951 fix typo of fields 2021-05-24 10:34:56 +02:00
frack113 a1bddf51e7 fix typo of falsepositives 2021-05-24 10:31:28 +02:00
frack113 466bb88ab5 Merge branch 'SigmaHQ:master' into sigmac_add_time_filter 2021-05-22 18:18:23 +02:00
Florian Roth 51771b0d67 Merge pull request #1499 from SigmaHQ/rule-devel 
Rule devel
 2021-05-22 16:28:12 +02:00
Florian Roth 211bf35640 Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel 2021-05-22 15:45:40 +02:00
Florian Roth 02323043d7 Create web_cve_2021_26814_wzuh_rce.yml 2021-05-22 15:45:38 +02:00
Florian Roth 576e047e76 Delete win_susp_Register_cimprovider.yml 2021-05-22 15:43:41 +02:00
Florian Roth 4c281d117c fix: bug in rule syntax 2021-05-22 15:31:23 +02:00
Florian Roth 9b7fb0c0f3 Update win_susp_shell_spawn_from_winrm.yml 2021-05-22 15:28:50 +02:00
Florian Roth 7e1ac347ef Merge branch 'master' into rule-devel 2021-05-22 15:27:32 +02:00
Florian Roth c0d58cb7f9 PAExec and PSexec rules 2021-05-22 10:52:01 +02:00
frack113 0e688d8dd0 Add the 'logsource!=' filter 2021-05-22 09:04:30 +02:00
frack113 f213226eb4 Add the 'tag!=' filter 2021-05-22 08:57:42 +02:00
frack113 8aa3ea15d7 change to the more revealing name "inlastday" 2021-05-22 08:44:30 +02:00
Jonhnathan 687f2d67fc Update Threat Hunter Playbook Reference 2021-05-22 01:09:30 -03:00
Jonhnathan 7f335cbb4a Update Threat Hunter Playbook Reference 2021-05-22 01:08:23 -03:00
Jonhnathan 34e2a81371 Update Threat Hunter Playbook Reference 2021-05-22 01:04:53 -03:00
Jonhnathan 89cfef9d49 Update Threat Hunter Playbook Reference 2021-05-22 01:04:20 -03:00
Jonhnathan 26ecbea0ba Update Threat Hunter Playbook Reference 2021-05-22 01:03:49 -03:00
Jonhnathan 4ebdcf2f1d Update Threat Hunter Playbook Reference 2021-05-22 01:03:23 -03:00
Jonhnathan c7f7eb6698 Update Threat Hunter Playbook Reference 2021-05-22 01:02:43 -03:00
Jonhnathan 5f6c19f203 Update Threat Hunter Playbook Reference 2021-05-22 01:02:19 -03:00
Jonhnathan 627a83914a Update Threat Hunter Playbook Reference 2021-05-22 01:01:33 -03:00
Jonhnathan 3853d71c56 Update Threat Hunter Playbook Reference 2021-05-22 01:01:07 -03:00
Jonhnathan e218c32a4c Update Threat Hunter Playbook Reference 2021-05-22 01:00:39 -03:00
Jonhnathan 1b32a5c0f3 Update Threat Hunter Playbook Reference 2021-05-22 00:59:54 -03:00
Jonhnathan 93087d2130 Update Threat Hunter Playbook Reference 2021-05-22 00:59:35 -03:00
Jonhnathan d3afed53ac Update Threat Hunter Playbook Reference 2021-05-22 00:59:04 -03:00
Jonhnathan 7007287832 Update Threat Hunter Playbook Reference 2021-05-22 00:58:23 -03:00
Jonhnathan 2e139b4264 Update win_protected_storage_service_access.yml 2021-05-22 00:57:25 -03:00