security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
291ca18d22f720f2ebcd30cf468f4434cecccdaa
blue-team-tools/deprecated/windows
T
History
Nasreddine Bencherchali e13510ffa7 Merge pull request #4382 from nasbench/new-rules-august-23 
feat: new rules and updates
2023-08-18 15:45:00 +02:00
..
create_remote_thread_win_susp_remote_thread_target.yml
feat: more updates
2023-05-05 17:52:47 +02:00
file_event_win_hktl_createminidump.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
file_event_win_mimikatz_memssp_log_file.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
file_event_win_susp_clr_logs.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
image_load_alternate_powershell_hosts_moduleload.yml
feat: more updates
2023-06-01 23:22:35 +02:00
image_load_side_load_advapi32.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
image_load_side_load_scm.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
image_load_susp_winword_wmidll_load.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
net_connection_win_binary_github_com.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
pipe_created_psexec_pipes_artifacts.yml
feat: rules update
2023-08-07 16:09:21 +02:00
posh_pm_powercat.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
posh_ps_access_to_chrome_login_data.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
posh_ps_azurehound_commands.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
posh_ps_cl_invocation_lolscript.yml
feat: update cl diag script rules
2023-08-17 19:26:21 +02:00
posh_ps_cl_mutexverifiers_lolscript.yml
feat: update cl diag script rules
2023-08-17 19:26:21 +02:00
posh_ps_invoke_nightmare.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
powershell_suspicious_download.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
powershell_suspicious_invocation_generic.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
powershell_suspicious_invocation_specific.yml
refactor: use 1 of selection_*
2023-05-04 14:23:08 +09:00
powershell_syncappvpublishingserver_exe.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_access_win_in_memory_assembly_execution.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_apt29_thinktanks.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_dragonfly.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_gallium.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_hurricane_panda.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_lazarus_activity_apr21.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_lazarus_loader.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_muddywater_dnstunnel.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_ta505_dropper.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_certutil_susp_execution.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_cmd_read_contents.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_cmd_redirect_to_stream.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_credential_acquisition_registry_hive_dumping.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_cscript_vbs.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_execution_mssql_xp_cmdshell_stored_procedure.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_indirect_cmd.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_indirect_command_execution_forfiles.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_invoke_obfuscation_via_rundll.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_invoke_obfuscation_via_use_rundll32.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_lolbas_execution_of_wuauclt.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_lolbin_office.yml
feat: new rules & updates (#4328)
2023-07-13 10:01:05 +02:00
proc_creation_win_lolbin_rdrleakdiag.yml
fix: merge rules and update detection
2023-04-24 19:24:19 +02:00
proc_creation_win_lolbins_by_office_applications.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_mal_ryuk.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_malware_trickbot_recon_activity.yml
chore: move rules to new folders (#4205)
2023-05-02 23:17:57 +02:00
proc_creation_win_mavinject_proc_inj.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_msdt_diagcab.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_new_service_creation.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_nslookup_pwsh_download_cradle.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_odbcconf_susp_exec.yml
feat: add/update rules related to odbcconf (#4228)
2023-05-23 14:08:56 +02:00
proc_creation_win_office_from_proxy_executing_regsvr32_payload2.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_office_from_proxy_executing_regsvr32_payload.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_office_spawning_wmi_commandline.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_possible_applocker_bypass.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_amsi_bypass_pattern_nov22.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_base64_invoke_susp_cmdlets.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_base64_listing_shadowcopy.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_base64_shellcode.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_bitsjob.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_service_modification.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_xor_encoded_command.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_reg_dump_sam.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_regsvr32_anomalies.yml
feat: update more regsvr32
2023-05-26 15:59:30 +02:00
proc_creation_win_renamed_paexec.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_renamed_powershell.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_renamed_psexec.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_renamed_rundll32.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_root_certificate_installed.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_run_from_zip.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_sc_delete_av_services.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_schtasks_user_temp.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_service_stop.yml
chore: fix typo of lowercase Windows in description
2023-06-21 09:52:43 +02:00
proc_creation_win_susp_bitstransfer.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_susp_cmd_exectution_via_wmi.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_susp_commandline_chars.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_susp_run_folder.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_susp_squirrel_lolbin.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_sysinternals_psexec_service_execution.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_sysinternals_psexesvc_start.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_whoami_as_system.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_winword_dll_load.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_wmic_execution_via_office_process.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_wmic_remote_command.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_wmic_remote_service.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
process_creation_syncappvpublishingserver_exe.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
registry_add_sysinternals_sdelete_registry_keys.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
registry_event_asep_reg_keys_modification.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
registry_set_abusing_windows_telemetry_for_persistence.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_add_hidden_user.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disable_microsoft_office_security_features.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_office_security.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_silentprocessexit.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
sysmon_accessing_winapi_in_powershell_credentials_dumping.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
sysmon_dcom_iertutil_dll_hijack.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
sysmon_mimikatz_detection_lsass.yml
fix:F multiple 404 links in references (#4332)
2023-06-26 10:10:04 +01:00
sysmon_powershell_execution_moduleload.yml
feat: more updates
2023-06-01 23:22:35 +02:00
sysmon_rclone_execution.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_dsquery_domain_trust_discovery.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_lateral_movement_condrv.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_security_group_modification_logging.yml
chore: move rules to new folders (#4205)
2023-05-02 23:17:57 +02:00
win_security_lolbas_execution_of_nltest.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_susp_esentutl_activity.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_susp_rclone_exec.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_susp_vssadmin_ntds_activity.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00