security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
26583da2ea985348ad29e6fd5afc5bf0c2830ae0
blue-team-tools/rules/windows/image_load
T
History
phantinuss 7f056da95b fix: FPs found in different environments
2023-04-20 09:48:47 +02:00
..
image_load_abusing_azure_browser_sso.yml
feat: update browsers selections and filters
2023-04-18 18:05:08 +02:00
image_load_alternate_powershell_hosts_moduleload.yml
fix: resolves #4015
2023-02-07 14:33:56 +01:00
image_load_cmstp_load_dll_from_susp_location.yml
feat: updates and fixes
2023-02-17 17:51:44 +01:00
image_load_dcom_iertutil_dll_hijack.yml
Refractor (#3794)
2022-12-18 21:00:14 +01:00
image_load_dll_amsi_uncommon_process.yml
feat: new rules, updates and fp fixes (#4136)
2023-04-03 12:06:14 +02:00
image_load_dll_comsvcs_load_renamed_version_by_rundll32.yml
feat: updates and fixes
2023-02-17 17:51:44 +01:00
image_load_dll_dbghelp_dbgcore_susp_load.yml
feat: update and fixes
2023-03-09 22:10:42 +01:00
image_load_dll_dbghelp_dbgcore_unsigned_load.yml
feat: updates and fixes
2023-02-17 17:51:44 +01:00
image_load_dll_sdiageng_load_by_msdt.yml
fix: apply suggestions from code review
2023-02-20 12:06:37 +01:00
image_load_dll_system_drawing_load.yml
feat: updates and fixes
2023-02-23 12:49:44 +01:00
image_load_dll_system_management_automation_susp_load.yml
fix: apply suggestions from code review
2023-02-20 12:06:37 +01:00
image_load_dll_vss_ps_susp_load.yml
Fix FP
2023-03-28 14:42:15 +02:00
image_load_dll_vssapi_susp_load.yml
fix: FPs found in different environments
2023-04-20 09:48:47 +02:00
image_load_dll_vsstrace_susp_load.yml
Fix FP
2023-03-28 14:55:57 +02:00
image_load_hktl_sharpevtmute.yml
fix: apply suggestions from code review
2023-02-20 12:06:37 +01:00
image_load_hktl_silenttrinity_stager.yml
feat: updates and fixes
2023-02-17 17:51:44 +01:00
image_load_malware_3cx_compromise_susp_dll.yml
feat: update 3cx compromise related rules (#4156)
2023-03-31 15:01:41 +02:00
image_load_malware_foggyweb_nobelium.yml
feat: updates and fixes
2023-02-17 17:51:44 +01:00
image_load_malware_pingback_backdoor.yml
fix: add missing modified
2023-02-17 22:52:09 +01:00
image_load_office_dotnet_assembly_dll_load.yml
feat: new rules, updates and fp fixes (#4136)
2023-04-03 12:06:14 +02:00
image_load_office_dotnet_clr_dll_load.yml
feat: new rules, updates and fp fixes (#4136)
2023-04-03 12:06:14 +02:00
image_load_office_dotnet_gac_dll_load.yml
feat: update rules related to onenote and more
2023-02-10 00:40:16 +01:00
image_load_office_dsparse_dll_load.yml
feat: new rules, updates and fp fixes (#4136)
2023-04-03 12:06:14 +02:00
image_load_office_kerberos_dll_load.yml
feat: new rules, updates and fp fixes (#4136)
2023-04-03 12:06:14 +02:00
image_load_office_outlook_outlvba_load.yml
feat: update rules related to onenote and more
2023-02-10 00:40:16 +01:00
image_load_office_vbadll_load.yml
feat: update rules related to onenote and more
2023-02-10 00:40:16 +01:00
image_load_pcre_net_load.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
image_load_scrcons_wmi_scripteventconsumer.yml
feat: updates and fixes
2023-02-23 12:49:44 +01:00
image_load_side_load_antivirus.yml
new rules related to possible dll sideloading
2023-03-13 14:47:52 +02:00
image_load_side_load_aruba_networks_virtual_intranet_access.yml
chore: increase level of some sideloading rules
2023-03-15 01:10:52 +01:00
image_load_side_load_classicexplorer32.yml
Apply suggestions from code review
2022-12-13 18:26:42 +01:00
image_load_side_load_comctl32.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
image_load_side_load_coregen.yml
chore: increase level of some sideloading rules
2023-03-15 01:10:52 +01:00
image_load_side_load_dbgcore_dll.yml
chore: increase level of some sideloading rules
2023-03-15 01:10:52 +01:00
image_load_side_load_dbghelp_dll.yml
chore: increase level of some sideloading rules
2023-03-15 01:10:52 +01:00
image_load_side_load_from_non_system_location.yml
chore: increase level of some sideloading rules
2023-03-15 01:10:52 +01:00
image_load_side_load_iviewers.yml
chore: author update
2023-04-12 16:11:58 +02:00
image_load_side_load_jsschhlp.yml
fix: add additional reference
2022-12-14 23:25:13 +01:00
image_load_side_load_libvlc.yml
fix: typos/wording
2023-04-17 08:39:41 +02:00
image_load_side_load_non_existent_dlls.yml
feat: more rules updates
2023-02-14 19:30:18 +01:00
image_load_side_load_office_dlls.yml
chore: increase level of some sideloading rules
2023-03-15 01:10:52 +01:00
image_load_side_load_rcdll.yml
chore: author update
2023-04-12 16:11:58 +02:00
image_load_side_load_shell_chrome_api.yml
feat: more fixes and updates
2023-02-05 21:46:22 +01:00
image_load_side_load_svchost_dlls.yml
feat: more rules updates
2023-02-14 19:30:18 +01:00
image_load_side_load_third_party.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
image_load_side_load_ualapi.yml
feat: updates and enhancements
2023-02-08 19:12:35 +01:00
image_load_side_load_vmguestlib.yml
fix: typos in multiple rules (#4011)
2023-02-06 13:53:23 +01:00
image_load_side_load_vmware_xfer.yml
feat: updates and fixes
2023-02-17 17:51:44 +01:00
image_load_side_load_wazuh.yml
chore: author update
2023-04-12 16:11:58 +02:00
image_load_side_load_web_browsers.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
image_load_side_load_windows_defender.yml
feat: updates and enhancements
2023-02-08 19:12:35 +01:00
image_load_spoolsv_dll_load.yml
Order yaml field
2022-10-26 09:42:26 +02:00
image_load_susp_dll_load_system_process.yml
feat: new rules, updates and fp fixes (#4136)
2023-04-03 12:06:14 +02:00
image_load_susp_python_image_load.yml
fix: broken single item lists
2022-12-08 16:23:58 +01:00
image_load_susp_script_dotnet_clr_dll_load.yml
fix: fp found in baseline
2023-02-23 13:39:17 +01:00
image_load_susp_uncommon_image_load.yml
Order yaml field
2022-10-26 09:42:26 +02:00
image_load_tttracer_mod_load.yml
Update title (#3746)
2022-12-02 18:10:43 +01:00
image_load_uac_bypass_iscsicpl.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
image_load_uac_bypass_via_dism.yml
Promotion rules (#3821)
2022-12-27 12:29:10 +01:00
image_load_uipromptforcreds_dlls.yml
fix: filter fp found in testing
2023-01-20 11:39:08 +01:00
image_load_unsigned_image_loaded_into_lsass.yml
Order yaml field
2022-10-26 09:42:26 +02:00
image_load_usp_svchost_clfsw32.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
image_load_wmi_module_load.yml
fix: resolves #4015
2023-02-07 14:33:56 +01:00
image_load_wmi_persistence_commandline_event_consumer.yml
Order yaml field
2022-10-26 09:42:26 +02:00
image_load_wmic_remote_xsl_scripting_dlls.yml
Order yaml field
2022-10-26 09:42:26 +02:00
image_load_wmiprvse_wbemcomn_dll_hijack.yml
fix: resolves #4015
2023-02-07 14:33:56 +01:00
image_load_wsman_provider_image_load.yml
Order yaml field
2022-10-26 09:42:26 +02:00