security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
11164849b3595a427c4ee9c5fe8ccfa3d78aa989
blue-team-tools/rules/windows/powershell/powershell_script
T
History
Florian Roth 11164849b3 Merge pull request #2543 from SigmaHQ/rule-devel 
Several new rules and some fixes
2022-01-11 12:44:03 +01:00
..
posh_ps_suspicious_iofilestream.yml
fix detection
2022-01-10 17:48:46 +01:00
powershell_accessing_win_api.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_adrecon_execution.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_automated_collection.yml
feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*'
2021-12-02 14:47:39 +01:00
powershell_azurehound_commands.yml
Create powershell_azurehound_commands.yml
2021-10-23 18:27:36 -05:00
powershell_cl_invocation_lolscript_count.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_cl_invocation_lolscript.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_cl_mutexverifiers_lolscript_count.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_cl_mutexverifiers_lolscript.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_clearing_windows_console_history.yml
Update powershell_clearing_windows_console_history.yml
2021-11-26 09:18:37 -06:00
powershell_create_local_user.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_data_compressed.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_detect_vm_env.yml
feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*'
2021-12-02 14:47:39 +01:00
powershell_dnscat_execution.yml
Change double quote to quote
2022-01-06 14:02:35 +01:00
powershell_icmp_exfiltration.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_invoke_nightmare.yml
Add MITTRE Technique
2021-11-20 10:56:41 +01:00
powershell_invoke_obfuscation_clip_in_scriptblocktext.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_invoke_obfuscation_obfuscated_iex_in_scriptblocktext.yml
fix quote
2022-01-06 14:09:09 +01:00
powershell_invoke_obfuscation_stdin_in_scriptblocktext.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_invoke_obfuscation_var_in_scriptblocktext.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_invoke_obfuscation_via_compress_in_scriptblocktext.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_invoke_obfuscation_via_rundll_in_scriptblocktext.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_invoke_obfuscation_via_stdin_in_scriptblocktext.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_invoke_obfuscation_via_use_clip_in_scriptblocktext.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_invoke_obfuscation_via_use_mhsta_in_scriptblocktext.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_invoke_obfuscation_via_use_rundll32_in_scriptblocktext.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_invoke_obfuscation_via_var_in_scriptblocktext.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_keylogging.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_malicious_commandlets.yml
Change double quote to quote
2022-01-06 14:02:35 +01:00
powershell_malicious_keywords.yml
Change double quote to quote
2022-01-06 14:02:35 +01:00
powershell_memorydump_getstoragediagnosticinfo.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_nishang_malicious_commandlets.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_ntfs_ads_access.yml
feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*'
2021-12-02 14:47:39 +01:00
powershell_powerview_malicious_commandlets.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_prompt_credentials.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_ps_access_to_chrome_login_data.yml
Fix error
2021-12-20 11:35:12 +01:00
powershell_ps_capture_screenshots.yml
Windows Redcannay
2021-12-29 17:47:43 +01:00
powershell_ps_cmdlet_scheduled_task.yml
Windows Redcannay
2021-12-29 17:47:43 +01:00
powershell_ps_copy_item_system32.yml
Windows redcannary rules
2021-12-27 20:25:01 +01:00
powershell_ps_cor_profiler.yml
Windows persistence
2021-12-30 11:58:10 +01:00
powershell_ps_directoryservices_accountmanagement.yml
Update powershell_ps_directoryservices_accountmanagement.yml
2021-12-31 15:48:15 +01:00
powershell_ps_dump_password_windows_credential_manager.yml
Windows redcannary
2021-12-20 10:43:32 +01:00
powershell_ps_enable_psremoting.yml
Windows Redcannary
2022-01-08 09:17:56 +01:00
powershell_ps_enumerate_password_windows_credential_manager.yml
Windows redcannary
2021-12-20 10:43:32 +01:00
powershell_ps_file_and_directory_discovery.yml
Windows redcannary
2021-12-15 19:36:16 +01:00
powershell_ps_get_acl_service.yml
Windows persistence
2021-12-30 11:58:10 +01:00
powershell_ps_get_childitem_bookmarks.yml
Rename powershell_ps_get_childitem_bookmarks
2021-12-13 12:04:00 +01:00
powershell_ps_invoke_command_remote.yml
Windows Redcannary
2022-01-08 09:17:56 +01:00
powershell_ps_invoke_dnsexfiltration.yml
refactor: adjusted rule level
2022-01-09 16:13:25 +01:00
powershell_ps_localuser.yml
Windows Redcannay
2021-12-29 17:47:43 +01:00
powershell_ps_office_comobject_registerxll.yml
Update powershell_ps_office_comobject_registerxll.yml
2021-12-31 15:48:41 +01:00
powershell_ps_remote_session_creation.yml
Windows Redcannary
2022-01-08 09:17:56 +01:00
powershell_ps_request_kerberos_ticket.yml
Windows Redcannay
2021-12-29 17:47:43 +01:00
powershell_ps_security_software_discovery.yml
fix space
2021-12-16 10:41:07 +01:00
powershell_ps_send_mailmessage.yml
Windows Redcannary
2022-01-08 09:17:56 +01:00
powershell_ps_susp_remove_adgroupmember.yml
Update powershell_ps_susp_remove_adgroupmember.yml
2021-12-28 12:03:40 +01:00
powershell_ps_susp_wallpaper.yml
Windows Redcannary impact
2021-12-26 12:09:42 +01:00
powershell_ps_susp_win32_shadowcopy.yml
Update powershell_ps_susp_win32_shadowcopy.yml
2021-12-28 12:04:14 +01:00
powershell_ps_suspicious_ad_group_reco.yml
Windows redcannary
2021-12-15 19:36:16 +01:00
powershell_ps_suspicious_execute_batch_script.yml
Windows Redcannary
2022-01-02 10:36:52 +01:00
powershell_ps_suspicious_local_group_reco.yml
fix space
2021-12-12 12:25:05 +01:00
powershell_ps_suspicious_networkcredential.yml
Windows redcannary rules
2021-12-27 20:25:01 +01:00
powershell_ps_suspicious_new_psdrive.yml
Windows redcannary
2022-01-01 08:42:40 +01:00
powershell_ps_suspicious_smb_share_reco.yml
Windows redcannary
2021-12-15 19:36:16 +01:00
powershell_ps_upload.yml
Windows Redcannary
2022-01-08 09:17:56 +01:00
powershell_psattack.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_set_policies_to_unsecure_level.yml
fix: FPs
2021-11-26 14:42:21 +01:00
powershell_shellcode_b64.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_shellintel_malicious_commandlets.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_software_discovery.yml
Fix category and EventID
2021-11-12 12:18:44 +01:00
powershell_store_file_in_alternate_data_stream.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_susp_zip_compress_in_scriptblocktext.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_suspicious_download_in_scriptblocktext.yml
cleanup list
2021-10-18 14:52:35 +02:00
powershell_suspicious_export_pfxcertificate.yml
Change double quote to quote
2022-01-06 14:02:35 +01:00
powershell_suspicious_extracting.yml
Windows Redcannary
2021-12-19 11:20:42 +01:00
powershell_suspicious_getprocess_lsass.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_suspicious_invocation_generic_in_scriptblocktext.yml
feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*'
2021-12-02 14:47:39 +01:00
powershell_suspicious_invocation_specific_in_scripblocktext.yml
refactor: change all " of them" expressions
2022-01-11 10:59:57 +01:00
powershell_suspicious_keywords.yml
Change double quote to quote
2022-01-06 14:02:35 +01:00
powershell_suspicious_mail_acces.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_suspicious_mounted_share_deletion.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_suspicious_recon.yml
feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*'
2021-12-02 14:47:39 +01:00
powershell_suspicious_win32_pnpentity.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_suspicious_windowstyle.yml
add powershell_suspicious_windowstyle
2021-10-20 13:57:24 +02:00
powershell_syncappvpublishingserver_exe_in_scriptblocktext.yml
Missing status in rules (#2284)
2021-11-19 22:32:26 +01:00
powershell_timestomp.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_trigger_profiles.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_web_request.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_windows_firewall_profile_disabled.yml
Add MITTRE Technique
2021-11-20 10:56:41 +01:00
powershell_winlogon_helper_dll.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_wmi_persistence.yml
change to category: ps_script
2021-10-16 08:18:49 +02:00
powershell_wmimplant.yml
Change double quote to quote
2022-01-06 14:02:35 +01:00
win_root_certificate_installed.yml
Order rules
2021-12-04 10:07:07 +01:00