security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
099d435adc688e568ddad9297ae3548de119ebca
blue-team-tools/rules/web/proxy_generic
T
History
Luca 099d435adc Merge PR #4565 from @CrimpSec - Add UA related to PlugX backdoor 
update: APT User Agent - adding user agent associated with PlugX backdoor.

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
2023-11-13 11:43:55 +01:00
..
proxy_adv_ip_port_scanner_upd_check.yml
Merge PR #4479 From @frack113 - Upgrade Rules Status
2023-10-17 14:35:26 +02:00
proxy_apt40.yml
chore: update rules from r-dns to cs-host
2023-05-18 23:03:23 +02:00
proxy_baby_shark.yml
Merge PR #4479 From @frack113 - Upgrade Rules Status
2023-10-17 14:35:26 +02:00
proxy_chafer_malware.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proxy_cobalt_amazon.yml
Order root rules folder
2023-01-31 14:05:08 +01:00
proxy_cobalt_malformed_uas.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proxy_cobalt_ocsp.yml
Order root rules folder
2023-01-31 14:05:08 +01:00
proxy_cobalt_onedrive.yml
Order root rules folder
2023-01-31 14:05:08 +01:00
proxy_download_susp_dyndns.yml
chore: update rules from r-dns to cs-host
2023-05-18 23:03:23 +02:00
proxy_download_susp_tlds_blacklist.yml
chore: update rules from r-dns to cs-host
2023-05-18 23:03:23 +02:00
proxy_download_susp_tlds_whitelist.yml
chore: update rules from r-dns to cs-host
2023-05-18 23:03:23 +02:00
proxy_downloadcradle_webdav.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proxy_empire_ua_uri_combos.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proxy_empty_ua.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proxy_exchange_owassrf_exploitation.yml
Merge PR #4533 from @nasbench - Promote experimental rules
2023-11-02 10:48:45 +01:00
proxy_exchange_owassrf_poc_exploitation.yml
Merge PR #4533 from @nasbench - Promote experimental rules
2023-11-02 10:48:45 +01:00
proxy_ios_implant.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proxy_java_class_download.yml
Order root rules folder
2023-01-31 14:05:08 +01:00
proxy_powershell_ua.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proxy_pwndrop.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proxy_raw_paste_service_access.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proxy_susp_flash_download_loc.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proxy_susp_ipfs_cred_harvest.yml
feat: new rule proxy_susp_ipfs_cred_harvest.yml (#4113)
2023-03-24 12:29:25 +01:00
proxy_telegram_api.yml
chore: update rules from r-dns to cs-host
2023-05-18 23:03:23 +02:00
proxy_turla_comrat.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proxy_ua_apt.yml
Merge PR #4565 from @CrimpSec - Add UA related to PlugX backdoor
2023-11-13 11:43:55 +01:00
proxy_ua_base64_encoded.yml
feat: updates and new rules related to fin7
2023-05-05 01:26:06 +02:00
proxy_ua_bitsadmin_susp_ip.yml
Merge PR #4479 From @frack113 - Upgrade Rules Status
2023-10-17 14:35:26 +02:00
proxy_ua_bitsadmin_susp_tld.yml
Update proxy_ua_bitsadmin_susp_tld.yml to use proxy field
2023-05-17 13:46:28 +02:00
proxy_ua_cryptominer.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proxy_ua_frameworks.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proxy_ua_hacktool.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proxy_ua_malware.yml
Merge PR #4522 from @X-Junior - updating multiple rules
2023-11-06 17:07:33 +01:00
proxy_ua_rclone.yml
Merge PR #4479 From @frack113 - Upgrade Rules Status
2023-10-17 14:35:26 +02:00
proxy_ua_susp_base64.yml
fix: apply suggestions from code review
2023-05-09 16:04:24 +02:00
proxy_ua_susp.yml
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18 11:53:44 +02:00
proxy_ursnif_malware_c2_url.yml
Order root rules folder
2023-01-31 14:05:08 +01:00
proxy_ursnif_malware_download_url.yml
Order root rules folder
2023-01-31 14:05:08 +01:00
proxy_webdav_search_ms.yml
Merge PR #4393 from @phantinuss - use explicit CIDR notation for loopback
2023-08-25 10:29:04 +02:00