blue-team-tools

Files

T

Kamran Saifullah 71be3c719b Merge PR #5003 from @deFr0ggy - Add Network Connection Initiated To BTunnels Domains

new: Network Connection Initiated To BTunnels Domains 

---------

Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

2024-09-13 12:15:58 +02:00

net_connection_win_addinutil_initiated.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_adws_unusual_connection.yml

Merge PR #4961 from @tsale - Add multiples rules and updates

2024-08-29 19:21:47 +02:00

net_connection_win_certutil_initiated_connection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_cmstp_initiated_connection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_dialer_initiated_connection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_azurewebsites.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_btunnels.yml

Merge PR #5003 from @deFr0ggy - Add Network Connection Initiated To BTunnels Domains

2024-09-13 12:15:58 +02:00

net_connection_win_domain_cloudflared_communication.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_crypto_mining_pools.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_dead_drop_resolvers.yml

Merge PR #4954 from @omaramin17 - Update multiple rules with additional sharing domains

2024-08-23 11:16:06 +02:00

net_connection_win_domain_devtunnels.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_dropbox_api.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_external_ip_lookup.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_google_api_non_browser_access.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_localtonet_tunnel.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_mega_nz.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_ngrok_tunnel.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_ngrok.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_notion_api_susp_communication.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_portmap.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_telegram_api_non_browser_access.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_vscode_tunnel_connection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_eqnedt.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_imewdbld.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_notepad.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_office_outbound_non_local_ip.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_office_uncommon_ports.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_python.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_rdp_outbound_over_non_standard_tools.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_rdp_reverse_tunnel.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_rdp_to_http.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_regasm_network_activity.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_regsvr32_network_activity.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_remote_access_tools_anydesk_incoming_connection.yml

Merge PR #4990 from @dan21san - Add Remote Access Tool - AnyDesk Incoming Connection

2024-09-02 14:23:22 +02:00

net_connection_win_rundll32_net_connections.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_silenttrinity_stager_msbuild_activity.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_susp_binary_no_cmdline.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_susp_file_sharing_domains_susp_folders.yml

Merge PR #4954 from @omaramin17 - Update multiple rules with additional sharing domains

2024-08-23 11:16:06 +02:00

net_connection_win_susp_initiated_uncommon_or_suspicious_locations.yml

Merge PR #4954 from @omaramin17 - Update multiple rules with additional sharing domains

2024-08-23 11:16:06 +02:00

net_connection_win_susp_malware_callback_port.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_susp_malware_callback_ports_uncommon.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_susp_outbound_kerberos_connection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_susp_outbound_mobsync_connection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_susp_outbound_smtp_connections.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_susp_remote_powershell_session.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_winlogon_net_connections.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_wordpad_uncommon_ports.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_wscript_cscript_local_connection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_wscript_cscript_outbound_connection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_wuauclt_network_connection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00