blue-team-tools

posh_ps_aadinternals_cmdlets_execution.yml

fix: fp section

2022-12-23 19:24:08 +01:00

posh_ps_access_to_browser_login_data.yml

fix: date position

2022-12-23 20:02:54 +01:00

posh_ps_accessing_win_api.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_add_dnsclient_rule.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_adrecon_execution.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_amsi_bypass_pattern_nov22.yml

fix: duplicate UUID

2022-11-09 09:56:04 +01:00

posh_ps_apt_silence_eda.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_as_rep_roasting.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_automated_collection.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_azurehound_commands.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_capture_screenshots.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_cl_invocation_lolscript_count.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_cl_invocation_lolscript.yml

titles modified (#3730 )

2022-11-26 08:49:30 +01:00

posh_ps_cl_mutexverifiers_lolscript_count.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_cl_mutexverifiers_lolscript.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_clear_powershell_history.yml

Update title (#3746 )

2022-12-02 18:10:43 +01:00

posh_ps_clearing_windows_console_history.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_cmdlet_scheduled_task.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_computer_discovery_get_adcomputer.yml

Rule Dev

2022-11-18 11:15:28 +01:00

posh_ps_copy_item_system_directory.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_cor_profiler.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_create_local_user.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_create_volume_shadow_copy.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_data_compressed.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_detect_vm_env.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_directorysearcher.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_directoryservices_accountmanagement.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_disable_psreadline_command_history.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_disable_windowsoptionalfeature.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_dnscat_execution.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_dotnet_assembly_from_file.yml

Rules for Issue 575 (#3820 )

2022-12-27 15:17:45 +01:00

posh_ps_download_com_cradles.yml

Rules for Issue 575 (#3820 )

2022-12-27 15:17:45 +01:00

posh_ps_dump_password_windows_credential_manager.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_enable_psremoting.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_enable_windowsoptionalfeature.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_enumerate_password_windows_credential_manager.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_etw_trace_evasion.yml

titles modified (#3730 )

2022-11-26 08:49:30 +01:00

posh_ps_exchange_mailbox_smpt_forwarding_rule.yml

Add/Update Exchange/Mailbox Rules

2022-10-26 23:17:54 +02:00

posh_ps_file_and_directory_discovery.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_frombase64string_archive.yml

Apply suggestions from code review

2022-12-23 12:34:56 +01:00

posh_ps_get_acl_service.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_get_adcomputer.yml

Rule Dev

2022-11-18 11:15:28 +01:00

posh_ps_get_adgroup.yml

Rule Dev

2022-11-18 11:15:28 +01:00

posh_ps_get_adreplaccount.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_get_childitem_bookmarks.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_hotfix_enum.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_icmp_exfiltration.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_import_module_susp_dirs.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_invoke_command_remote.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_invoke_dnsexfiltration.yml

fix: update rules to not use regex

2022-11-18 11:16:13 +01:00

posh_ps_invoke_nightmare.yml

fix: update rules to not use regex

2022-11-18 11:16:13 +01:00

posh_ps_invoke_obfuscation_clip.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

posh_ps_invoke_obfuscation_obfuscated_iex.yml

Update Title (#3733 )

2022-11-28 06:43:17 +01:00

posh_ps_invoke_obfuscation_stdin.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

posh_ps_invoke_obfuscation_var.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

posh_ps_invoke_obfuscation_via_compress.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

posh_ps_invoke_obfuscation_via_rundll.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

posh_ps_invoke_obfuscation_via_stdin.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

posh_ps_invoke_obfuscation_via_use_clip.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

posh_ps_invoke_obfuscation_via_use_mhsta.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

posh_ps_invoke_obfuscation_via_use_rundll32.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

posh_ps_invoke_obfuscation_via_var.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

posh_ps_keylogging.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_localuser.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_mailboxexport_share.yml

Add/Update Exchange/Mailbox Rules

2022-10-26 23:17:54 +02:00

posh_ps_malicious_commandlets.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

posh_ps_malicious_keywords.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_memorydump_getstoragediagnosticinfo.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_modify_group_policy_settings.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_msxml_com.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_nishang_malicious_commandlets.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_ntfs_ads_access.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_office_comobject_registerxll.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_potential_invoke_mimikatz.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_powerview_malicious_commandlets.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_prompt_credentials.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_psasyncshell.yml

Create posh_ps_psasyncshell.yml

2022-10-04 20:57:15 +02:00

posh_ps_psattack.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_remote_session_creation.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_remove_item_path.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_request_kerberos_ticket.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_root_certificate_installed.yml

Update title (#3746 )

2022-12-02 18:10:43 +01:00

posh_ps_run_from_mount_diskimage.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_security_software_discovery.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_send_mailmessage.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_sensitive_file_discovery.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_set_policies_to_unsecure_level.yml

fix: broken single item lists

2022-12-08 16:23:58 +01:00

posh_ps_shellcode_b64.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_shellintel_malicious_commandlets.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_software_discovery.yml

Update title (#3746 )

2022-12-02 18:10:43 +01:00

posh_ps_store_file_in_alternate_data_stream.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_susp_ad_group_reco.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_susp_clear_eventlog.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_directory_enum.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_download.yml

Update title (#3746 )

2022-12-02 18:10:43 +01:00

posh_ps_susp_execute_batch_script.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_export_pfxcertificate.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

posh_ps_susp_extracting.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_susp_follina_execution.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_get_addefaultdomainpasswordpolicy.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_get_current_user.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_get_gpo.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_get_process.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_getprocess_lsass.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_susp_gettypefromclsid.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_gwmi.yml

Fix

2022-11-03 09:39:48 +01:00

posh_ps_susp_hyper_v_condlet.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_invocation_generic.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_susp_invocation_specific.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_invoke_webrequest_useragent.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_iofilestream.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_keywords.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_susp_local_group_reco.yml

titles modified (#3730 )

2022-11-26 08:49:30 +01:00

posh_ps_susp_mail_acces.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_susp_mount_diskimage.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_mounted_share_deletion.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_susp_networkcredential.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_new_psdrive.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_proxy_scripts.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_recon_export.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_susp_remove_adgroupmember.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_service_dacl_modification_set_service.yml

fix: Fix typo in selection

2022-10-25 01:47:53 +02:00

posh_ps_susp_smb_share_reco.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_susp_ssl_keyword.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_start_process.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_unblock_file.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_wallpaper.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_win32_pnpentity.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_susp_win32_shadowcopy_deletion.yml

Update title (#3746 )

2022-12-02 18:10:43 +01:00

posh_ps_susp_win32_shadowcopy.yml

Update title (#3746 )

2022-12-02 18:10:43 +01:00

posh_ps_susp_windowstyle.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_susp_write_eventlog.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_susp_zip_compress.yml

Update title (#3746 )

2022-12-02 18:10:43 +01:00

posh_ps_syncappvpublishingserver_exe.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_tamper_defender_remove_mppreference.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_tamper_defender.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_test_netconnection.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_timestomp.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_token_obfuscation.yml

PowerShell Token Obfuscation (#3825 )

2022-12-27 20:03:05 +01:00

posh_ps_trigger_profiles.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_upload.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_user_discovery_get_aduser.yml

Rule Dev

2022-11-18 11:15:28 +01:00

posh_ps_using_set_service_to_hide_services.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_web_request_cmd_and_cmdlets.yml

Rules for Issue 575 (#3820 )

2022-12-27 15:17:45 +01:00

posh_ps_win32_product_install_msi.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_win_defender_exclusions_added.yml

Update Title (#3731 )

2022-11-27 19:19:27 +01:00

posh_ps_windows_firewall_profile_disabled.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_winlogon_helper_dll.yml

Order yaml field

2022-10-26 09:43:39 +02:00

posh_ps_wmi_persistence.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_wmi_unquoted_service_search.yml

titles modified (#3730 )

2022-11-26 08:49:30 +01:00

posh_ps_wmimplant.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

posh_ps_x509enrollment.yml

Add more ref

2022-12-23 13:22:50 +01:00

posh_ps_xml_iex.yml

Order yaml field

2022-10-26 09:43:39 +02:00