security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
2952d630a413a820fcd8b6033dbc14ac3566e554
blue-team-tools/rules/windows/builtin/security
T
History
Swachchhanda Shrawan Poudel f7f61a9f95 Merge PR #5789 from @swachchhanda000 - Add fps filter observed on ARM-based Windows updates 
fix: Uncommon AppX Package Locations - filter out system32
fix: Unauthorized System Time Modification - filter out vmwaretools
fix: Files With System Process Name In Unsuspected Locations - filter windows temp
fix: Startup Folder File Write - filter out wuauclt.exe and C:$WinREAgent\Scratch\Mount\ directory
fix: Potentially Suspicious WDAC Policy File Creation - filter wuaucltcore.exe
fix: Creation of WerFault.exe/Wer.dll in Unusual Folder - filter C:\Windows\UUS\arm64\
fix: Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load - filter C:$WinREAgent\Scratch\
fix: Potential System DLL Sideloading From Non System Locations - filter legitimate ARM based locations
fix: Potential Defense Evasion Via Raw Disk Access By Uncommon Tools - filter legitimate ARM based locations

---------

Co-authored-by: Nasreddine Bencherchali <nasbench@users.noreply.github.com>
2025-12-09 08:29:51 +05:45
..
account_management
Merge PR #5740 from @swachchhanda000 - chore: reorganize threat specific rules into rules-emerging-threats directory
2025-11-10 12:00:08 +01:00
object_access
Merge PR #5101 from @nasbench - Promote older rules status from experimental to test
2024-12-01 13:40:32 +01:00
win_security_aadhealth_mon_agent_regkey_access.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_aadhealth_svc_agent_regkey_access.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_account_backdoor_dcsync_rights.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_account_discovery.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_ad_object_writedac_access.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_ad_replication_non_machine_account.yml
Merge PR #5769 from @nasbench - fix keywords rule and remove the fields field
2025-11-24 09:54:29 +01:00
win_security_ad_user_enumeration.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_adcs_certificate_template_configuration_vulnerability_eku.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_adcs_certificate_template_configuration_vulnerability.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_add_remove_computer.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_admin_share_access.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_alert_active_directory_user_control.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_alert_ad_user_backdoors.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_alert_enable_weak_encryption.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_alert_ruler.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_atsvc_task.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_audit_log_cleared.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_camera_microphone_access.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_cobaltstrike_service_installs.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_codeintegrity_check_failure.yml
Merge PR #5167 from @djlukic - Fix multiple false positives found in the wild
2025-01-30 21:15:39 +01:00
win_security_dce_rpc_smb_spoolss_named_pipe.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_dcom_iertutil_dll_hijack.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_dcsync.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_default_domain_gpo_modification.yml
Merge PR #5717 from @tropChaud - Add and Enhance Windows Default Domain GPO & RDP Tampering Rules
2025-11-23 20:36:08 +05:45
win_security_device_installation_blocked.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_disable_event_auditing_critical.yml
Merge PR #5451 from @frack113 - chore: cleanup metadata
2025-06-04 13:33:36 +02:00
win_security_disable_event_auditing.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_dot_net_etw_tamper.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_dpapi_domain_backupkey_extraction.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_dpapi_domain_masterkey_backup_attempt.yml
Merge PR #5769 from @nasbench - fix keywords rule and remove the fields field
2025-11-24 09:54:29 +01:00
win_security_external_device.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_gpo_scheduledtasks.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_hidden_user_creation.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_hktl_edr_silencer.yml
Merge PR #5101 from @nasbench - Promote older rules status from experimental to test
2024-12-01 13:40:32 +01:00
win_security_hktl_nofilter.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_hybridconnectionmgr_svc_installation.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_impacket_psexec.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_impacket_secretdump.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_invoke_obfuscation_clip_services_security.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_invoke_obfuscation_obfuscated_iex_services_security.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_invoke_obfuscation_stdin_services_security.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_invoke_obfuscation_var_services_security.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_invoke_obfuscation_via_compress_services_security.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_invoke_obfuscation_via_rundll_services_security.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_invoke_obfuscation_via_stdin_services_security.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_invoke_obfuscation_via_use_clip_services_security.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_invoke_obfuscation_via_use_mshta_services_security.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_invoke_obfuscation_via_use_rundll32_services_security.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_invoke_obfuscation_via_var_services_security.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_iso_mount.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_kerberoasting_activity.yml
Merge PR #5708 from @nasbench - Multiple updates and issue fixes
2025-10-29 11:45:19 +01:00
win_security_kerberos_asrep_roasting.yml
Merge PR #5512 from @GrepItAll - fix: use the correct PreAuthType selection field name
2025-07-07 10:25:39 +02:00
win_security_kerberos_coercion_via_dns_object.yml
Merge PR #5769 from @nasbench - fix keywords rule and remove the fields field
2025-11-24 09:54:29 +01:00
win_security_lm_namedpipe.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_lsass_access_non_system_account.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_mal_creddumper.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_mal_wceaux_dll.yml
Merge PR #5176 from @GtUGtHGtNDtEUaE - Update rules covering EventID 4660
2025-01-31 18:08:59 +01:00
win_security_metasploit_authentication.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_metasploit_or_impacket_smb_psexec_service_install.yml
Merge PR #5769 from @nasbench - fix keywords rule and remove the fields field
2025-11-24 09:54:29 +01:00
win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_net_ntlm_downgrade.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_net_share_obj_susp_desktop_ini.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_new_or_renamed_user_account_with_dollar_sign.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_not_allowed_rdp_access.yml
Merge PR #5769 from @nasbench - fix keywords rule and remove the fields field
2025-11-24 09:54:29 +01:00
win_security_password_policy_enumerated.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_pcap_drivers.yml
Merge PR #5769 from @nasbench - fix keywords rule and remove the fields field
2025-11-24 09:54:29 +01:00
win_security_petitpotam_network_share.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_petitpotam_susp_tgt_request.yml
Merge PR #5451 from @frack113 - chore: cleanup metadata
2025-06-04 13:33:36 +02:00
win_security_possible_dc_shadow.yml
Merge PR #5395 from @david-syk - Update MITRE ATT&CK tags
2025-05-20 23:05:21 +02:00
win_security_powershell_script_installed_as_service.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_protected_storage_service_access.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_rdp_reverse_tunnel.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_register_new_logon_process_by_rubeus.yml
Merge PR #5041 from @Koifman - Update tags for Register new Logon Process by Rubeus
2024-12-19 18:41:14 +01:00
win_security_registry_permissions_weakness_check.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_remote_powershell_session.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_replay_attack_detected.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_sam_registry_hive_handle_request.yml
Merge PR #5769 from @nasbench - fix keywords rule and remove the fields field
2025-11-24 09:54:29 +01:00
win_security_scm_database_handle_failure.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_scm_database_privileged_operation.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_sdelete_potential_secure_deletion.yml
Merge PR #5125 from @randomaccess3 - Update Potential Secure Deletion with SDelete
2024-12-14 21:55:43 +02:00
win_security_service_install_remote_access_software.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_service_installation_by_unusal_client.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_signal_sensitive_config_access.yml
Merge PR #5220 from @netgrain - Add File Access Of Signal Desktop Sensitive Data
2025-10-28 01:00:06 +01:00
win_security_smb_file_creation_admin_shares.yml
Merge PR #5532 from @swachchhanda000 - fix: refine detections and filters; update Account Tampering with SubStatus field
2025-10-17 08:12:25 +05:45
win_security_susp_add_domain_trust.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_susp_add_sid_history.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_susp_computer_name.yml
Merge PR #5769 from @nasbench - fix keywords rule and remove the fields field
2025-11-24 09:54:29 +01:00
win_security_susp_dsrm_password_change.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_susp_failed_logon_reasons.yml
Merge PR #5532 from @swachchhanda000 - fix: refine detections and filters; update Account Tampering with SubStatus field
2025-10-17 08:12:25 +05:45
win_security_susp_group_policy_abuse_privilege_addition.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_susp_group_policy_startup_script_added_to_gpo.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_susp_kerberos_manipulation.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_susp_ldap_dataexchange.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_susp_local_anon_logon_created.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_susp_logon_explicit_credentials.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_susp_lsass_dump_generic.yml
Merge PR #5065 from @nasbench - Promote older rules status from experimental to test
2024-11-01 10:21:04 +01:00
win_security_susp_lsass_dump.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_susp_net_recon_activity.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_susp_opened_encrypted_zip_filename.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_susp_opened_encrypted_zip_outlook.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_susp_opened_encrypted_zip.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_susp_outbound_kerberos_connection.yml
Merge PR #5395 from @david-syk - Update MITRE ATT&CK tags
2025-05-20 23:05:21 +02:00
win_security_susp_possible_shadow_credentials_added.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_susp_psexec.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_susp_raccess_sensitive_fext.yml
Merge PR #5517 from @swachchhanda000 - fix: office 365 apps related false-positives
2025-10-17 07:57:13 +05:45
win_security_susp_rc4_kerberos.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_susp_scheduled_task_creation.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_susp_scheduled_task_delete_or_disable.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_susp_scheduled_task_update.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_susp_time_modification.yml
Merge PR #5789 from @swachchhanda000 - Add fps filter observed on ARM-based Windows updates
2025-12-09 08:29:51 +05:45
win_security_svcctl_remote_service.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_syskey_registry_access.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_sysmon_channel_reference_deletion.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_tap_driver_installation.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_teams_suspicious_objectaccess.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_transf_files_with_cred_data_via_network_shares.yml
Merge PR #5520 from @swachchhanda000 - Fix Logic in some rules that were causing FPs and FNs
2025-07-14 12:04:39 +02:00
win_security_user_added_to_local_administrators.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.yml
chore: ci: bump validator version (#5722)
2025-10-23 15:43:47 +02:00
win_security_user_creation.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_user_driver_loaded.yml
Merge PR #5679 from @swachchhanda000 - chore: update evtx baseline to v0.8.2
2025-10-09 13:03:39 +02:00
win_security_user_logoff.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_vssaudit_secevent_source_registration.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_windows_defender_exclusions_registry_modified.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_windows_defender_exclusions_write_access.yml
Merge PR #5022 from @jaegeral - Fix some typos in rules metadata
2024-09-22 19:14:26 +02:00
win_security_wmi_persistence.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_wmiprvse_wbemcomn_dll_hijack.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
win_security_workstation_was_locked.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00