security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
063bb57dfdabbefb7c84166b7a35dfdabd2b8c90
blue-team-tools/rules/windows/registry/registry_set
T
History
Nasreddine Bencherchali 637d610884 chore: move rules to new folders (#4205)
2023-05-02 23:17:57 +02:00
..
registry_set_add_load_service_in_safe_mode.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_add_port_monitor.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_aedebug_persistence.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_allow_rdp_remote_assistance_feature.yml
fix: typos in multiple rules (#4011)
2023-02-06 13:53:23 +01:00
registry_set_amsi_com_hijack.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_asep_reg_keys_modification_classes.yml
fix: fp found in testing
2023-01-18 18:41:07 +01:00
registry_set_asep_reg_keys_modification_common.yml
feat: new rules, updates and fp fixes (#4136)
2023-04-03 12:06:14 +02:00
registry_set_asep_reg_keys_modification_currentcontrolset.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_currentversion_nt.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_currentversion.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_internet_explorer.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_asep_reg_keys_modification_office.yml
fix: fp found in baseline
2023-02-17 23:16:42 +01:00
registry_set_asep_reg_keys_modification_session_manager.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_asep_reg_keys_modification_system_scripts.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_asep_reg_keys_modification_winsock2.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_asep_reg_keys_modification_wow6432node_classes.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_wow6432node.yml
fix: fp found in testing
2023-01-19 18:47:11 +01:00
registry_set_blackbyte_ransomware.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_bypass_uac_using_delegateexecute.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_bypass_uac_using_eventviewer.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_bypass_uac_using_silentcleanup_task.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_change_rdp_port.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_change_security_zones.yml
feat: updates and enhancements
2023-01-06 16:35:34 +01:00
registry_set_change_sysmon_driver_altitude.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_change_winevt_channelaccess.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_chrome_extension.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_cobaltstrike_service_installs.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_comhijack_sdclt.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_crashdump_disabled.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_creation_service_susp_folder.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_creation_service_uncommon_folder.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_custom_file_open_handler_powershell_execution.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_cve_2020_1048_new_printer_port.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_cve_2022_30190_msdt_follina.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
registry_set_dbgmanageddebugger_persistence.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_defender_exclusions.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_dhcp_calloutdll.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_administrative_share.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_disable_autologger_sessions.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_disable_defender_firewall.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_disable_function_user.yml
Rule Dev
2022-11-18 11:15:28 +01:00
registry_set_disable_macroruntimescanscope.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_disable_microsoft_office_security_features.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_disable_privacy_settings_experience.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_security_center_notifications.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_system_restore.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_uac_registry.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_windows_defender_service.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_windows_firewall.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_winevt_logging.yml
fix: small changes
2023-04-05 13:19:26 +02:00
registry_set_disabled_exploit_guard_net_protection_on_ms_defender.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disabled_microsoft_defender_eventlog.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_disabled_pua_protection_on_microsoft_defender.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disabled_tamper_protection_on_microsoft_defender.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disallowrun_execution.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disk_cleanup_handler_autorun_persistence.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_dns_over_https_enabled.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_dns_server_level_plugin_dll.yml
fix: multiple typos
2023-02-06 12:28:45 +01:00
registry_set_dot_net_etw_tamper.yml
fix: add dword version
2022-12-09 19:44:44 +01:00
registry_set_enabling_cor_profiler_env_variables.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_enabling_turnoffcheck.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_evtx_file_key_tamper.yml
fix: update evtx tamper rules
2023-01-02 15:25:19 +01:00
registry_set_exploit_guard_susp_allowed_apps.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_fax_change_service_user.yml
Fix invalid field cast or name (#3841)
2022-12-30 11:46:21 +01:00
registry_set_fax_dll_persistance.yml
Fix invalid field cast or name (#3841)
2022-12-30 11:46:21 +01:00
registry_set_file_association_exefile.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_hangs_debugger_persistence.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_hhctrl_persistence.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_hidden_extention.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_hide_file.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_hide_function_user.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_hide_scheduled_task_via_index_tamper.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_install_root_or_ca_certificat.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_lolbin_onedrivestandaloneupdater.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_lsa_disablerestrictedadmin.yml
fix: add related metadata
2023-01-13 17:21:21 +01:00
registry_set_lsass_usermode_dumping.yml
fix: enhance rules related to Lsass-Shtinkering
2022-12-08 11:02:56 +01:00
registry_set_mal_adwind.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_mal_blue_mockingbird.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_net_cli_ngenassemblyusagelog.yml
Apply suggestions from code review
2022-11-18 15:43:08 +01:00
registry_set_new_application_appcompat.yml
fix: resolves #4015
2023-02-07 14:33:56 +01:00
registry_set_new_network_provider.yml
fix: add missing modified field
2023-02-02 00:28:32 +01:00
registry_set_office_enable_dde.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_office_outlook_enable_load_macro_provider_on_boot.yml
fix: typos
2023-02-09 13:09:46 +01:00
registry_set_office_outlook_enable_macro_execution.yml
fix: typos
2023-02-09 13:09:46 +01:00
registry_set_office_outlook_enable_unsafe_client_mail_rules.yml
fix: duplicate titles
2023-02-09 16:06:09 +01:00
registry_set_office_outlook_security_settings.yml
fix: resolves #4014
2023-02-09 15:48:13 +01:00
registry_set_office_security.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_persistence_app_paths.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_persistence_appx_debugger.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_autodial_dll.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_persistence_chm.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_persistence_com_hijacking_susp_locations.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_persistence_custom_protocol_handler.yml
fix: typos in multiple rules (#4011)
2023-02-06 13:53:23 +01:00
registry_set_persistence_event_viewer_events_asp.yml
Update ATT&CK Techniques and Tactics (#4096)
2023-03-10 01:21:42 +01:00
registry_set_persistence_globalflags.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_ie.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_ifilter.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_persistence_lsa_extension.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_persistence_mpnotify.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_persistence_mycomputer.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_persistence_natural_language.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_persistence_office_vsto.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_outlook_homepage.yml
fix: apply suggestions
2023-02-09 10:41:41 +01:00
registry_set_persistence_outlook_todaypage.yml
fix: duplicate ids and small updates
2023-02-08 19:36:55 +01:00
registry_set_persistence_scrobj_dll.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_search_order.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_shim_databases.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_typed_paths.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_persistence_xll.yml
Rename registry_set_persistance_xll.yml to registry_set_persistence_xll.yml
2023-01-30 14:33:49 +05:00
registry_set_policies_associations_tamper.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_policies_attachments_tamper.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_powershell_as_service.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_powershell_execution_policy.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_powershell_in_run_keys.yml
fix: typos in multiple rules (#4011)
2023-02-06 13:53:23 +01:00
registry_set_powershell_logging_disabled.yml
fix: optimize pwsh reg logging tamper rule
2023-01-21 12:28:28 +01:00
registry_set_renamed_sysinternals_eula_accepted.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_rpcrt4_etw_tamper.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_scr_file_executed_by_rundll32.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_servicedll_hijack.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_services_etw_tamper.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_set_nopolicies_user.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_sip_persistence.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_sophos_av_tamper.yml
fix: typos in multiple rules (#4011)
2023-02-06 13:53:23 +01:00
registry_set_special_accounts.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_suppress_defender_notifications.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_susp_keyboard_layout_load.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_susp_pendingfilerenameoperations.yml
Fix test errors
2023-01-27 15:09:43 +01:00
registry_set_susp_printer_driver.yml
fix: fp found in testing
2023-03-14 23:58:04 +01:00
registry_set_susp_reg_persist_explorer_run.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_susp_run_key_img_folder.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_susp_service_installed.yml
fix: fix fp found in testing
2022-12-07 02:25:52 +01:00
registry_set_susp_user_shell_folders.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_suspicious_env_variables.yml
fix: typos in multiple rules (#4011)
2023-02-06 13:53:23 +01:00
registry_set_taskcache_entry.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_telemetry_persistence.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_terminal_server_suspicious.yml
fix: resolves #4015
2023-02-07 14:33:56 +01:00
registry_set_terminal_server_tampering.yml
fix: resolves #4015
2023-02-07 14:33:56 +01:00
registry_set_timeproviders_dllname.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_treatas_persistence.yml
fix: separate selection and add missing modified
2023-01-06 17:41:01 +01:00
registry_set_turn_on_dev_features.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_uac_bypass_eventvwr.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_uac_bypass_sdclt.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_uac_bypass_winsat.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_uac_bypass_wmp.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_vbs_payload_stored.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_wab_dllpath_reg_change.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_wdigest_enable_uselogoncredential.yml
fix: change to permalink
2023-02-23 10:47:52 +01:00
registry_set_windows_defender_tamper.yml
fix: remove unnecessary filter
2023-03-15 00:11:35 +01:00
registry_set_winget_admin_settings_tampering.yml
feat: more winget updates
2023-04-18 03:35:42 +02:00
registry_set_winget_enable_local_manifest.yml
fix: apply suggestions from code review
2023-04-19 15:50:29 +02:00
registry_set_winlogon_allow_multiple_tssessions.yml
Update ATT&CK Techniques and Tactics (#4096)
2023-03-10 01:21:42 +01:00
registry_set_winlogon_notify_key.yml
change status to test
2023-01-27 06:48:34 +01:00