security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,892 Commits 1 Branch 57 Tags
fefb8564717d69af72ededb4172bc7ec00aac734
Commit Graph

7892 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Florian Roth 505140d273 rule: extended WMI suspicious scripts rule 2021-09-01 13:57:48 +02:00
Florian Roth e787420be1 rule: WMI filter content encoded executable 2021-09-01 13:57:36 +02:00
Florian Roth 8761927e8c rule: susp scrcons.exe creating named pipe 2021-09-01 13:57:17 +02:00
frack113 e71fce6f11 fix errors 2021-09-01 13:55:14 +02:00
Florian Roth affc929c3b LiquidSnake named pipe 2021-09-01 13:54:47 +02:00
frack113 80dbfa7af5 add process_creation_alternate_data_streams.yml 2021-09-01 13:52:09 +02:00
Florian Roth c8b3036949 Merge pull request #1968 from SigmaHQ/rule-devel 
docs: note to improved sysmon config
 2021-09-01 13:21:28 +02:00
Florian Roth f102b2d9a1 docs: note to improved sysmon config 2021-09-01 13:07:18 +02:00
Florian Roth 8bba246205 refactor: better way to write it 2021-09-01 12:57:34 +02:00
frack113 2cb5f5e4c6 add missing tags 2021-09-01 12:54:21 +02:00
Florian Roth c146bc44c7 Merge branch 'master' into patch-1 2021-09-01 12:48:51 +02:00
Bhabesh Rai 6859b6c38f Added rule for detection of Atera RMM Agent installation 2021-09-01 15:24:47 +05:45
frack113 af599e4877 Merge pull request #1958 from phantinuss/master 
Bulk of new rules, mainly UAC Bypasses
 2021-09-01 10:53:02 +02:00
frack113 892c58270a Update tags 2021-09-01 10:33:57 +02:00
frack113 4b8ffbc183 Update tags 2021-09-01 10:30:43 +02:00
phantinuss 9ffdced740 fix: implement suggestions from PR discussion 2021-09-01 10:21:37 +02:00
frack113 240c5584ff update tags 2021-09-01 09:56:46 +02:00
frack113 6f3fc7036e Update tags 2021-09-01 09:45:31 +02:00
frack113 3ed7d6e330 Merge pull request #1959 from frack113/update_ps 
Update PowerShell rules
 2021-09-01 08:06:31 +02:00
frack113 b8a1f4c63b Merge pull request #1961 from SigmaHQ/rule-devel 
SideWalk User-Agent used by Sparkling Goblin
 2021-09-01 08:06:15 +02:00
Cyb3rEng 470d64e66c Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:28:34 -06:00
Cyb3rEng e0e1396dff Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:26:44 -06:00
Cyb3rEng e7c7e4c061 Updated Rule 
Detection changed to #useful_information
 2021-08-31 22:24:28 -06:00
Cyb3rEng f2b8b83fe3 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:23:45 -06:00
Cyb3rEng 0d2257fb19 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:22:01 -06:00
Cyb3rEng 1b9a0c4a01 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:20:17 -06:00
Cyb3rEng c5507658c0 Updated Rule 
updated title
 2021-08-31 22:13:31 -06:00
Cyb3rEng d309784e58 Updated Rule 
Modified Title
 2021-08-31 22:12:34 -06:00
Cyb3rEng 93334878f5 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section.
 2021-08-31 22:09:57 -06:00
Cyb3rEng 785fc98ee3 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 22:05:10 -06:00
Cyb3rEng d5f73a8910 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 22:03:31 -06:00
Cyb3rEng fa3b882fdc Updated Rule 
Removed " " from falsepositives section
 2021-08-31 21:58:50 -06:00
Cyb3rEng c7c49c55d2 Updated Rule 
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 21:58:09 -06:00
Cyb3rEng d5fa226180 Updated Rule 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 21:54:32 -06:00
Cyb3rEng 900f71e6b2 Rule Update Review 
Completed the following updates on the rule:
- Modified the title
- incremented 4 spaces for references and tags
- updated false positives
- updated author
- updated description in detection section. 
- Removed the service: Sysmon, updated selection1.
 2021-08-31 21:50:44 -06:00
frack113 9671d6c0db Merge pull request #1960 from austinsonger/sysmon_dns_over_https_enabled.yml 
sysmon_dns_over_https_enabled.yml
 2021-08-31 18:37:29 +02:00
neu5ron 414e851108 Merge branch 'master' into qoutes_and_wildcards 
Signed-off-by: neu5ron <neu5ron@users.noreply.github.com>
 2021-08-31 12:06:20 -04:00
Florian Roth 9b20060275 SideWalk UA 2021-08-31 17:14:19 +02:00
frack113 cff572b752 Update sysmon_dns_over_https_enabled.yml 2021-08-31 17:11:04 +02:00
phantinuss add1ad40f8 additional UAC bypass rule 2021-08-31 16:23:32 +02:00
phantinuss 59d8e0b866 add System IntegrityLevel to uac bypass rules, the level is not used most of the time, but might 2021-08-31 16:18:05 +02:00
Austin Songer 9dc8d38565 Create sysmon_dns_over_https_enabled.yml 2021-08-31 09:14:14 -05:00
phantinuss 6eb7245673 fix: remove user sid, match any sid instead 2021-08-31 15:58:57 +02:00
frack113 eb434732a7 move rule not only powershell 2021-08-31 13:48:07 +02:00
frack113 18cdc36d73 Fix EventID 4103 detection 2021-08-31 13:44:54 +02:00
phantinuss 3a9e10d081 bulk of new rules to match working UACMe UAC bypasses 2021-08-31 12:51:21 +02:00
phantinuss ea77d9161e add another possible sdclt uac bypass registry path 2021-08-31 12:51:21 +02:00
phantinuss 50b8ca5110 add more COM interfaces and sharpen rule logic 2021-08-31 12:51:21 +02:00
phantinuss 3155f7172d detection for proxyshell MSF module 2021-08-31 12:51:16 +02:00
phantinuss abf40ecfbc fix: typo in URL 2021-08-31 12:50:11 +02:00