frack113 1060009949 Redcannary

2022-03-18 11:15:05 +01:00

..

posh_ps_access_to_browser_login_data.yml

Change status and related

2022-02-03 06:53:50 +01:00

posh_ps_access_to_chrome_login_data.yml

Change status and related

2022-02-03 06:53:50 +01:00

posh_ps_accessing_win_api.yml

fix: FP

2022-02-23 17:18:53 +01:00

posh_ps_adrecon_execution.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_as_rep_roasting.yml

Update posh_ps_as_rep_roasting.yml

2022-03-17 20:22:11 +01:00

posh_ps_automated_collection.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_azurehound_commands.yml

fix: remove penetration testing as a valid false positive

2022-03-16 13:51:26 +01:00

posh_ps_capture_screenshots.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_cl_invocation_lolscript_count.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_cl_invocation_lolscript.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_cl_mutexverifiers_lolscript_count.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_cl_mutexverifiers_lolscript.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_clear_powershell_history.yml

Update posh_ps_clear_powershell_history.yml

2022-01-27 16:16:57 +01:00

posh_ps_clearing_windows_console_history.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_cmdlet_scheduled_task.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_copy_item_system32.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_ps_cor_profiler.yml

fix: legitimate --> Legitimate

2022-03-16 14:35:19 +01:00

posh_ps_create_local_user.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

posh_ps_create_volume_shadow_copy.yml

Windows Redcannary

2022-01-12 20:27:56 +01:00

posh_ps_data_compressed.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

posh_ps_detect_vm_env.yml

update Author contribute

2022-03-03 14:34:13 +07:00

posh_ps_directorysearcher.yml

Windows Redcannary

2022-02-12 15:53:13 +01:00

posh_ps_directoryservices_accountmanagement.yml

fix: legitimate --> Legitimate

2022-03-16 14:35:19 +01:00

posh_ps_dnscat_execution.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

posh_ps_dump_password_windows_credential_manager.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_enable_psremoting.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

posh_ps_enumerate_password_windows_credential_manager.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_file_and_directory_discovery.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_ps_get_acl_service.yml

fix: legitimate --> Legitimate

2022-03-16 14:35:19 +01:00

posh_ps_get_adreplaccount.yml

refactor: increased level to medium

2022-02-06 14:17:38 +01:00

posh_ps_get_childitem_bookmarks.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_icmp_exfiltration.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_invoke_command_remote.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

posh_ps_invoke_dnsexfiltration.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

posh_ps_invoke_nightmare.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_invoke_obfuscation_clip.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_invoke_obfuscation_obfuscated_iex.yml

fix: used in legitimate microsoft scripts

2022-02-02 11:00:43 +01:00

posh_ps_invoke_obfuscation_stdin.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_invoke_obfuscation_var.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_invoke_obfuscation_via_compress.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_ps_invoke_obfuscation_via_rundll.yml

Refactor regex

2022-03-08 19:07:37 +01:00

posh_ps_invoke_obfuscation_via_stdin.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_invoke_obfuscation_via_use_clip.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_invoke_obfuscation_via_use_mhsta.yml

Refactor regex

2022-03-07 19:08:30 +01:00

posh_ps_invoke_obfuscation_via_use_rundll32.yml

Refactor regex

2022-03-08 19:07:37 +01:00

posh_ps_invoke_obfuscation_via_var.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_keylogging.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_localuser.yml

fix: legitimate --> Legitimate

2022-03-16 14:35:19 +01:00

posh_ps_malicious_commandlets.yml

fix: remove penetration testing as a valid false positive

2022-03-16 13:51:26 +01:00

posh_ps_malicious_keywords.yml

fix: remove penetration test as valid false positive reason

2022-03-16 14:33:18 +01:00

posh_ps_memorydump_getstoragediagnosticinfo.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_msxml_com.yml

fix: legitimate --> Legitimate

2022-03-16 14:35:19 +01:00

posh_ps_nishang_malicious_commandlets.yml

fix: remove penetration testing as a valid false positive

2022-03-16 13:51:26 +01:00

posh_ps_ntfs_ads_access.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_ps_office_comobject_registerxll.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_ps_powerview_malicious_commandlets.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_prompt_credentials.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

posh_ps_psattack.yml

fix: remove penetration test as valid false positive reason

2022-03-16 14:33:18 +01:00

posh_ps_remote_session_creation.yml

fix: legitimate --> Legitimate

2022-03-16 14:35:19 +01:00

posh_ps_remove_item_path.yml

fix registry FP

2022-03-17 14:26:12 +01:00

posh_ps_request_kerberos_ticket.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_ps_root_certificate_installed.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_run_from_mount_diskimage.yml

Windows Redcannary T1553.005

2022-02-01 18:41:53 +01:00

posh_ps_security_software_discovery.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_send_mailmessage.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

posh_ps_set_policies_to_unsecure_level.yml

fix: reduce level, many legitimate usages expected

2022-02-23 14:13:12 +01:00

posh_ps_shellcode_b64.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

posh_ps_shellintel_malicious_commandlets.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_software_discovery.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_store_file_in_alternate_data_stream.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_susp_directory_enum.yml

Update posh_ps_susp_directory_enum.yml

2022-03-17 20:22:51 +01:00

posh_ps_susp_get_adcomputer.yml

Redcannary

2022-03-17 16:48:41 +01:00

posh_ps_susp_get_addefaultdomainpasswordpolicy.yml

Redcannary

2022-03-18 11:15:05 +01:00

posh_ps_susp_get_adgroup.yml

Update posh_ps_susp_get_adgroup.yml

2022-03-17 20:23:14 +01:00

posh_ps_susp_get_process.yml

Redcannary

2022-03-17 16:48:41 +01:00

posh_ps_susp_invoke_webrequest_useragent.yml

Windows Redcannary

2022-01-23 16:37:59 +01:00

posh_ps_susp_remove_adgroupmember.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_susp_ssl_keyword.yml

fix: legitimate --> Legitimate

2022-03-16 14:35:19 +01:00

posh_ps_susp_wallpaper.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_susp_win32_shadowcopy.yml

refactor: some adjustments

2022-03-04 16:34:15 +01:00

posh_ps_susp_zip_compress.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_suspicious_ad_group_reco.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_ps_suspicious_download.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

posh_ps_suspicious_execute_batch_script.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

posh_ps_suspicious_export_pfxcertificate.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_suspicious_extracting.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_suspicious_getprocess_lsass.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_suspicious_gwmi.yml

Windows Redcannary

2022-01-12 20:27:56 +01:00

posh_ps_suspicious_invocation_generic.yml

fix: remove penetration test as valid false positive reason

2022-03-16 14:33:18 +01:00

posh_ps_suspicious_invocation_specific.yml

fix: remove penetration test as valid false positive reason

2022-03-16 14:33:18 +01:00

posh_ps_suspicious_iofilestream.yml

fix: values missed escaping

2022-03-05 10:39:15 +01:00

posh_ps_suspicious_keywords.yml

fix: remove penetration test as valid false positive reason

2022-03-16 14:33:18 +01:00

posh_ps_suspicious_local_group_reco.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_ps_suspicious_mail_acces.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_suspicious_mount_diskimage.yml

Windows Redcannary T1553.005

2022-02-01 18:41:53 +01:00

posh_ps_suspicious_mounted_share_deletion.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_suspicious_networkcredential.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_ps_suspicious_new_psdrive.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_ps_suspicious_recon.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_suspicious_smb_share_reco.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_ps_suspicious_start_process.yml

Windows Redcannary

2022-01-15 17:04:03 +01:00

posh_ps_suspicious_unblock_file.yml

Windows Redcannary T1553.005

2022-02-01 18:41:53 +01:00

posh_ps_suspicious_win32_pnpentity.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

posh_ps_suspicious_windowstyle.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_syncappvpublishingserver_exe.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_tamper_defender.yml

refactor: PowerShell Defender modifications

2022-03-03 13:53:06 +01:00

posh_ps_test_netconnection.yml

fix: legitimate --> Legitimate

2022-03-16 14:35:19 +01:00

posh_ps_timestomp.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

posh_ps_trigger_profiles.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_upload.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

posh_ps_web_request.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

posh_ps_windows_firewall_profile_disabled.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_winlogon_helper_dll.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

posh_ps_wmi_persistence.yml

Rename powershell_script

2022-01-15 10:54:21 +01:00

posh_ps_wmimplant.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

posh_ps_xml_iex.yml

fix: legitimate --> Legitimate

2022-03-16 14:35:19 +01:00