security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
2cecd0e6ef7ddecbf81ce5f01b2205ccfdcbb414
blue-team-tools/.github/workflows/known-FPs.csv
T
phantinuss 0c473a3e77 workflow: evaluate findings, exclude known FPs
2022-02-21 11:01:44 +01:00

962 B
Raw Blame History

1RuleIdRuleNameMatchString
28e5e38e4-5350-4c0b-895a-e872ce0dd54fMsiexec Initiated Connection.*
3ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94Suspicious WSMAN Provider Image Loadssvchost\.exe
4db809f10-56ce-4420-8c86-d6a7d793c79cRaw Disk Access Using Illegitimate Toolspython-3
5db809f10-56ce-4420-8c86-d6a7d793c79cRaw Disk Access Using Illegitimate Toolstarget\.exe
696f697b0-b499-4e5d-9908-a67bec11cdb6Removal of Potential COM Hijacking Registry Keyssharepointclient
796f697b0-b499-4e5d-9908-a67bec11cdb6Removal of Potential COM Hijacking Registry Keysodopen
8e28a5a99-da44-436d-b7a0-2afc20a5f413Whoami ExecutionWindowsPowerShell
98ac03a65-6c84-4116-acad-dc1558ff7a77Sysmon Configuration Changesysmon-intense\.xml
104358e5a5-7542-4dcb-b9f3-87667371839bISO or Image Mount Indicator in Recent Files_Office_Professional_Plus_
1136480ae1-a1cb-4eaa-a0d6-29801d7e9142Renamed BinaryWinRAR
1273bba97f-a82d-42ce-b315-9182e76c57b1Imports Registry Key From a FileEvernote
Reference in New Issue View Git Blame Copy Permalink