security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
0420e9c3bb3cb8ecbd6607256a8bdfaa72ccc838
blue-team-tools/rules-deprecated/windows
T
History
Nasreddine Bencherchali 2710bf4710 feat: new rules, updates and fp fixes (#4162)
2023-04-11 13:04:22 +02:00
..
file_event_win_hktl_createminidump.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
file_event_win_mimikatz_memssp_log_file.yml
feat: updates and fixes
2023-02-17 17:51:44 +01:00
file_event_win_susp_clr_logs.yml
feat: updates and enhancements
2023-01-06 16:35:34 +01:00
image_load_side_load_advapi32.yml
chore: increase level of some sideloading rules
2023-03-15 01:10:52 +01:00
image_load_side_load_scm.yml
feat: more rules updates
2023-02-14 19:30:18 +01:00
image_load_susp_winword_wmidll_load.yml
Update modified last change
2023-01-02 08:44:46 +01:00
posh_pm_powercat.yml
feat: update and merge some pwsh rules
2023-01-20 17:07:23 +01:00
posh_ps_access_to_chrome_login_data.yml
Update modified last change
2023-01-02 08:44:46 +01:00
posh_ps_azurehound_commands.yml
feat: updates and enhancements
2023-01-02 14:49:45 +01:00
posh_ps_invoke_nightmare.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
powershell_suspicious_download.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
powershell_suspicious_invocation_generic.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
powershell_suspicious_invocation_specific.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
powershell_syncappvpublishingserver_exe.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_access_win_in_memory_assembly_execution.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_apt_apt29_thinktanks.yml
feat: update and fixes
2023-03-09 22:10:42 +01:00
proc_creation_win_apt_dragonfly.yml
feat: update and fixes
2023-03-09 22:10:42 +01:00
proc_creation_win_apt_gallium.yml
feat: update and fixes
2023-03-09 22:10:42 +01:00
proc_creation_win_apt_hurricane_panda.yml
feat: more apt rules updates
2023-03-10 16:50:29 +01:00
proc_creation_win_apt_lazarus_activity_apr21.yml
feat: more apt rules updates
2023-03-10 16:50:29 +01:00
proc_creation_win_apt_lazarus_loader.yml
feat: more apt rules updates
2023-03-10 16:50:29 +01:00
proc_creation_win_apt_muddywater_dnstunnel.yml
feat: more apt rules updates
2023-03-10 16:50:29 +01:00
proc_creation_win_certutil_susp_execution.yml
feat: update certutil rules
2023-02-15 19:55:39 +01:00
proc_creation_win_cmd_read_contents.yml
feat: update cmd based rules
2023-03-07 14:13:57 +01:00
proc_creation_win_cmd_redirect_to_stream.yml
feat: update cmd based rules
2023-03-07 14:13:57 +01:00
proc_creation_win_credential_acquisition_registry_hive_dumping.yml
feat: update and enhancements
2023-02-07 13:55:14 +01:00
proc_creation_win_cscript_vbs.yml
feat: more updates
2023-03-06 00:39:26 +01:00
proc_creation_win_execution_mssql_xp_cmdshell_stored_procedure.yml
feat: more updates
2023-03-06 00:39:26 +01:00
proc_creation_win_indirect_cmd.yml
feat: updates and enhancements
2023-01-04 17:49:32 +01:00
proc_creation_win_indirect_command_execution_forfiles.yml
fix: status
2023-01-04 17:55:48 +01:00
proc_creation_win_invoke_obfuscation_via_rundll.yml
feat: multiple fixes and updates
2023-02-21 22:15:30 +01:00
proc_creation_win_invoke_obfuscation_via_use_rundll32.yml
Update proc_creation_win_invoke_obfuscation_via_use_rundll32.yml
2022-12-30 09:53:25 +01:00
proc_creation_win_lolbas_execution_of_wuauclt.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_lolbins_by_office_applications.yml
feat: additional updates and fixes
2023-02-04 21:06:47 +01:00
proc_creation_win_mal_ryuk.yml
feat: multiple updates and fixes
2023-02-03 02:22:28 +01:00
proc_creation_win_mavinject_proc_inj.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_win_msdt_diagcab.yml
feat: update and enhancements
2023-02-07 13:55:14 +01:00
proc_creation_win_new_service_creation.yml
feat: multiple fixes and updates
2023-02-21 22:15:30 +01:00
proc_creation_win_nslookup_pwsh_download_cradle.yml
fix: add missing modified field
2022-12-14 10:32:11 +01:00
proc_creation_win_office_from_proxy_executing_regsvr32_payload2.yml
feat: general updates and fixes
2022-12-02 23:16:03 +01:00
proc_creation_win_office_from_proxy_executing_regsvr32_payload.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_office_spawning_wmi_commandline.yml
feat: additional updates and fixes
2023-02-04 21:06:47 +01:00
proc_creation_win_possible_applocker_bypass.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_powershell_amsi_bypass_pattern_nov22.yml
feat: even more updates
2023-02-03 20:17:09 +01:00
proc_creation_win_powershell_base64_invoke_susp_cmdlets.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_win_powershell_base64_listing_shadowcopy.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_win_powershell_base64_shellcode.yml
feat: new rules, updates and fp fixes (#4162)
2023-04-11 13:04:22 +02:00
proc_creation_win_powershell_bitsjob.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_powershell_service_modification.yml
feat: more updates
2023-03-06 00:39:26 +01:00
proc_creation_win_powershell_xor_encoded_command.yml
fix: revert related field for deprecated rules
2023-01-31 11:25:07 +01:00
proc_creation_win_reg_dump_sam.yml
Update proc_creation_win_reg_dump_sam.yml
2023-02-04 22:48:10 +01:00
proc_creation_win_renamed_paexec.yml
feat: updates and enhancements
2023-02-14 00:51:20 +01:00
proc_creation_win_renamed_powershell.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_win_renamed_psexec.yml
update modified
2023-03-04 16:07:17 +09:00
proc_creation_win_renamed_rundll32.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_win_root_certificate_installed.yml
feat: more updates
2023-03-06 00:39:26 +01:00
proc_creation_win_run_from_zip.yml
feat: more updates
2023-03-06 00:39:26 +01:00
proc_creation_win_sc_delete_av_services.yml
feat: more updates
2023-03-06 00:39:26 +01:00
proc_creation_win_schtasks_user_temp.yml
fix: fp found in testing
2023-03-14 23:58:04 +01:00
proc_creation_win_service_stop.yml
feat: more updates
2023-03-06 00:39:26 +01:00
proc_creation_win_susp_bitstransfer.yml
fix: some issues
2023-01-11 11:18:54 +01:00
proc_creation_win_susp_cmd_exectution_via_wmi.yml
Update proc_creation_win_susp_cmd_exectution_via_wmi.yml
2023-01-20 06:45:38 +01:00
proc_creation_win_susp_commandline_chars.yml
feat: more updates
2023-03-06 00:39:26 +01:00
proc_creation_win_susp_run_folder.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_susp_squirrel_lolbin.yml
feat: updates and enhancements
2023-02-14 00:51:20 +01:00
proc_creation_win_sysinternals_psexec_service_execution.yml
feat: more updates and fixes
2023-02-28 15:22:25 +01:00
proc_creation_win_sysinternals_psexesvc_start.yml
feat: more updates and fixes
2023-02-28 15:22:25 +01:00
proc_creation_win_whoami_as_system.yml
fix: add missing modified
2023-02-28 15:44:37 +01:00
proc_creation_win_winword_dll_load.yml
feat: new rules, updates and fp fixes (#4136)
2023-04-03 12:06:14 +02:00
proc_creation_win_wmic_execution_via_office_process.yml
feat: additional updates and fixes
2023-02-04 21:06:47 +01:00
proc_creation_win_wmic_remote_command.yml
feat: update wmic rules
2023-02-14 19:30:18 +01:00
proc_creation_win_wmic_remote_service.yml
feat: update wmic rules
2023-02-14 19:30:18 +01:00
process_creation_syncappvpublishingserver_exe.yml
Update modified last change
2023-01-02 08:44:46 +01:00
registry_add_sysinternals_sdelete_registry_keys.yml
Merge branch 'registry-rules-update' of https://github.com/nasbench/sigma into registry-rules-update
2023-02-08 11:40:56 +01:00
registry_event_asep_reg_keys_modification.yml
Update modified last change
2023-01-02 08:44:46 +01:00
registry_set_abusing_windows_telemetry_for_persistence.yml
Update modified last change
2023-01-02 08:44:46 +01:00
registry_set_add_hidden_user.yml
feat: updates and fixes
2023-01-26 22:42:56 +01:00
registry_set_silentprocessexit.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
sysmon_accessing_winapi_in_powershell_credentials_dumping.yml
Refractor (#3794)
2022-12-18 21:00:14 +01:00
sysmon_dcom_iertutil_dll_hijack.yml
fix: resolves #4015
2023-02-07 14:33:56 +01:00
sysmon_mimikatz_detection_lsass.yml
Update modified last change
2023-01-02 08:44:46 +01:00
sysmon_rclone_execution.yml
Update modified last change
2023-01-02 08:44:46 +01:00
win_dsquery_domain_trust_discovery.yml
fix: add missing modified and small fixes to selections
2023-02-04 11:44:33 +01:00
win_lateral_movement_condrv.yml
Update modified last change
2023-01-02 08:44:46 +01:00
win_security_lolbas_execution_of_nltest.yml
feat: multiple updates and fixes
2023-02-03 02:22:28 +01:00
win_susp_esentutl_activity.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
win_susp_rclone_exec.yml
Update modified last change
2023-01-02 08:44:46 +01:00
win_susp_vssadmin_ntds_activity.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00