security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
1c0c29f45f554d65d30a1dfbf8fd9cb77c192546
blue-team-tools/rules/windows/registry/registry_set
T
History
Nasreddine Bencherchali df2c86f941 fix: separate selection and add missing modified
2023-01-06 17:41:01 +01:00
..
registry_set_add_hidden_user.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_add_load_service_in_safe_mode.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_add_port_monitor.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_aedebug_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_allow_rdp_remote_assistance_feature.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_amsi_com_hijack.yml
feat: updates and enhancements
2023-01-04 17:49:32 +01:00
registry_set_asep_reg_keys_modification_classes.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_common.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_currentcontrolset.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_currentversion_nt.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_currentversion.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_internet_explorer.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_office.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_session_manager.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_system_scripts.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_winsock2.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_asep_reg_keys_modification_wow6432node_classes.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_wow6432node.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_blackbyte_ransomware.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_bypass_uac_using_delegateexecute.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_bypass_uac_using_eventviewer.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_bypass_uac_using_silentcleanup_task.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_change_rdp_port.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_change_security_zones.yml
feat: updates and enhancements
2023-01-06 16:35:34 +01:00
registry_set_change_sysmon_driver_altitude.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_change_winevt_channelaccess.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_chm_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_chrome_extension.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_cobaltstrike_service_installs.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_comhijack_sdclt.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_crashdump_disabled.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_creation_service_susp_folder.yml
Update rules/windows/registry/registry_set/registry_set_creation_service_susp_folder.yml
2022-12-03 09:09:51 +01:00
registry_set_creation_service_uncommon_folder.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_custom_file_open_handler_powershell_execution.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_cve_2020_1048_new_printer_port.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_cve_2021_31979_cve_2021_33771_exploits.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_cve_2022_30190_msdt_follina.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
registry_set_dbgmanageddebugger_persistence.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_defender_exclusions.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_dhcp_calloutdll.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_administrative_share.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_autologger_sessions.yml
feat: more updates to etw tamper rules
2022-12-09 19:09:24 +01:00
registry_set_disable_defender_firewall.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_function_user.yml
Rule Dev
2022-11-18 11:15:28 +01:00
registry_set_disable_macroruntimescanscope.yml
Apply suggestions from code review
2022-10-25 15:17:50 +02:00
registry_set_disable_microsoft_office_security_features.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_privacy_settings_experience.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_security_center_notifications.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_system_restore.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_uac_registry.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_windows_defender_service.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_windows_firewall.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_winevt_logging.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disabled_exploit_guard_net_protection_on_ms_defender.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disabled_microsoft_defender_eventlog.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disabled_pua_protection_on_microsoft_defender.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disabled_tamper_protection_on_microsoft_defender.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disallowrun_execution.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disk_cleanup_handler_autorun_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_dns_over_https_enabled.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_dns_serverlevelplugindll.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_dot_net_etw_tamper.yml
fix: add dword version
2022-12-09 19:44:44 +01:00
registry_set_enabling_cor_profiler_env_variables.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_enabling_turnoffcheck.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_evtx_file_key_tamper.yml
fix: update evtx tamper rules
2023-01-02 15:25:19 +01:00
registry_set_exploit_guard_susp_allowed_apps.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_fax_change_service_user.yml
Fix invalid field cast or name (#3841)
2022-12-30 11:46:21 +01:00
registry_set_fax_dll_persistance.yml
Fix invalid field cast or name (#3841)
2022-12-30 11:46:21 +01:00
registry_set_file_association_exefile.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_globalflags_persistence.yml
fix: typo
2022-12-21 00:07:51 +01:00
registry_set_hangs_debugger_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_hhctrl_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_hidden_extention.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_hide_file.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_hide_function_user.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_hide_scheduled_task_via_index_tamper.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_ie_persistence.yml
feat: updates and enhancements
2023-01-06 16:35:34 +01:00
registry_set_ifilter_persistence.yml
fix: unused selection
2023-01-06 17:16:20 +01:00
registry_set_install_root_or_ca_certificat.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_lolbin_onedrivestandaloneupdater.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_lsa_extension_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_lsass_usermode_dumping.yml
fix: enhance rules related to Lsass-Shtinkering
2022-12-08 11:02:56 +01:00
registry_set_mal_adwind.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_mal_blue_mockingbird.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_mpnotify_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_natural_language_persistence.yml
feat: filename test enhancements (#3812)
2022-12-23 09:25:16 +01:00
registry_set_net_cli_ngenassemblyusagelog.yml
Apply suggestions from code review
2022-11-18 15:43:08 +01:00
registry_set_new_application_appcompat.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_new_network_provider.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_office_enable_dde.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_office_security.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_office_vsto_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_outlook_c2_registry_key.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_outlook_registry_todaypage.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_outlook_registry_webview.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_outlook_security.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_persistence_appx_debugger.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_persistence_autodial_dll.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_persistence_com_hijacking_susp_locations.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_persistence_mycomputer.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_persistence_search_order.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_persistence_typed_paths.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_policies_associations_tamper.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_policies_attachments_tamper.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_powershell_as_service.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_powershell_in_run_keys.yml
updated modified date
2022-11-09 18:32:47 +01:00
registry_set_powershell_logging_disabled.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_register_custom_protocol_handler.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_renamed_sysinternals_eula_accepted.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_rpcrt4_etw_tamper.yml
fix: typos and errors
2022-12-09 19:15:35 +01:00
registry_set_scr_file_executed_by_rundll32.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_scrobj_dll_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_servicedll_hijack.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_services_etw_tamper.yml
fix: typos and errors
2022-12-09 19:15:35 +01:00
registry_set_set_nopolicies_user.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_shim_databases_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_sip_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_sophos_av_tamaper.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_special_accounts.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_suppress_defender_notifications.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_susp_app_paths_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_susp_keyboard_layout_load.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_susp_printer_driver.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_susp_reg_persist_explorer_run.yml
fix: broken single item lists
2022-12-08 16:23:58 +01:00
registry_set_susp_run_key_img_folder.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_susp_service_installed.yml
fix: fix fp found in testing
2022-12-07 02:25:52 +01:00
registry_set_susp_user_shell_folders.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_suspicious_env_variables.yml
feat: add more suspicious cases
2022-12-21 00:18:44 +01:00
registry_set_taskcache_entry.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_telemetry_persistence.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_terminal_server_suspicious.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_terminal_server_tampering.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_timeproviders_dllname.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_treatas_persistence.yml
fix: separate selection and add missing modified
2023-01-06 17:41:01 +01:00
registry_set_uac_bypass_eventvwr.yml
Title modified in several rules (#3728)
2022-11-25 15:34:38 +01:00
registry_set_uac_bypass_sdclt.yml
refactor: rule with ??? causing issues in some backends
2022-12-01 14:02:15 +01:00
registry_set_uac_bypass_winsat.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_uac_bypass_wmp.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_vbs_payload_stored.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_wab_dllpath_reg_change.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_wdigest_enable_uselogoncredential.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_windows_defender_tamper.yml
fix: FPs noticed in Nextron testing CI
2022-12-05 17:39:42 +01:00
registry_set_winlogon_allow_multiple_tssessions.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_winlogon_notify_key.yml
Order yaml field
2022-10-26 06:16:55 +02:00