security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
2cecd0e6ef7ddecbf81ce5f01b2205ccfdcbb414
blue-team-tools/rules/windows/file_event
T
History
frack113 171edbd1bc Merge pull request #2694 from frack113/Red_20220213 
Windows Redcannary
2022-02-14 06:34:20 +01:00
..
file_event_advanced_ip_scanner.yml
split global rules
2021-09-11 20:30:32 +02:00
file_event_apt_unidentified_nov_18.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
file_event_cve_2021_31979_cve_2021_33771_exploits.yml
Add cve tags
2021-10-25 18:40:50 +02:00
file_event_cve_2021_41379_msi_lpe.yml
rule: file creation LPE CVE-2021-41379
2021-11-22 14:15:51 +01:00
file_event_hack_dumpert.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
file_event_hktl_createminidump.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
file_event_hktl_nppspy.yml
NPPSpy file creation rule
2021-11-29 16:03:03 +01:00
file_event_iso_file_recent.yml
refactor: extended .iso rule
2022-02-11 14:15:51 +01:00
file_event_lsass_dump.yml
refactor: lsass dump filename IOC pattern
2022-02-06 14:26:55 +01:00
file_event_mal_adwind.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
file_event_mal_octopus_scanner.yml
Order rules
2022-01-20 22:06:55 +01:00
file_event_mal_vhd_download.yml
Fix detection
2021-10-29 08:21:41 +02:00
file_event_mimikatz_kirbi_file_creation.yml
fix: date field
2021-11-09 16:52:19 +01:00
file_event_mimimaktz_memssp_log_file.yml
Update file_event_mimimaktz_memssp_log_file.yml
2021-12-20 12:51:27 +01:00
file_event_moriya_rootkit.yml
split global win_moriya_rootkit.yml
2021-09-21 15:18:25 +02:00
file_event_pingback_backdoor.yml
Split global sysmon rules
2021-09-09 16:11:41 +02:00
file_event_sam_dump.yml
refactor: sam hive dump filename rule
2022-02-11 12:16:40 +01:00
file_event_script_creation_by_office_using_file_ext.yml
fix: several FPs against a fresh installed Windows with example applications and basic user interaction
2022-02-09 17:47:22 +01:00
file_event_susp_ntds_dit.yml
rules: ntds.dit write, minimized msedge
2022-01-12 11:32:12 +01:00
file_event_susp_system_interactive_powershell.yml
rule: PowerShell as SYSTEM
2021-12-07 07:03:48 +01:00
file_event_susp_task_write.yml
feat: check for the existence of a description field
2022-01-12 12:55:49 +01:00
file_event_susp_teamviewer_remote_session.yml
Update file_event_susp_teamviewer_remote_session.yml
2022-01-31 06:24:02 +01:00
file_event_tool_psexec.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
file_event_uac_bypass_winsat.yml
fix duplicate name file
2021-09-20 09:31:04 +02:00
file_event_uac_bypass_wmp.yml
fix duplicate name file
2021-09-20 09:31:04 +02:00
file_event_win_cscript_wscript_dropper.yml
Fix condition
2022-01-11 20:51:57 +01:00
file_event_win_shell_write_susp_directory.yml
refactor: change all " of them" expressions
2022-01-11 10:59:57 +01:00
file_event_winrm_awl_bypass.yml
fix filename
2021-09-22 16:21:07 +02:00
file_event_wmiprvse_wbemcomn_dll_hijack.yml
Split global sysmon rules
2021-09-09 16:11:41 +02:00
sysmon_creation_system_file.yml
allow fp from wbengine
2022-02-07 16:58:58 +00:00
sysmon_cred_dump_tools_dropped_files.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_cve_2021_26858_msexchange.yml
rule: file creation LPE CVE-2021-41379
2021-11-22 14:15:51 +01:00
sysmon_detect_powerup_dllhijacking.yml
Corrected Rules - Logsource
2021-09-13 10:16:02 +05:30
sysmon_ghostpack_safetykatz.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_lsass_memory_dump_file_creation.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_office_persistence.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_outlook_newform.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45
sysmon_pcre_net_temp_file.yml
Fix selection with only 1 element
2021-08-14 09:54:27 +02:00
sysmon_powershell_exploit_scripts.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_powershell_startup_shortcuts.yml
Update sysmon_powershell_startup_shortcuts.yml
2021-10-24 16:07:40 -04:00
sysmon_quarkspw_filedump.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_redmimicry_winnti_filedrop.yml
Change status for old rules
2021-11-27 11:33:14 +01:00
sysmon_startup_folder_file_write.yml
Change status for old rules
2021-11-27 11:33:14 +01:00
sysmon_susp_adsi_cache_usage.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_susp_clr_logs.yml
Adding two more process, additional references, information about Cobalt Strike etc.
2021-11-17 22:37:23 +01:00
sysmon_susp_desktop_ini.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_susp_pfx_file_creation.yml
Change status for old rules
2021-11-27 11:33:14 +01:00
sysmon_susp_procexplorer_driver_created_in_tmp_folder.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_suspicious_powershell_profile_create.yml
Change status for old rules
2021-11-27 11:33:14 +01:00
sysmon_tsclient_filewrite_startup.yml
Change status for old rules
2021-11-27 11:33:14 +01:00
sysmon_uac_bypass_consent_comctl32.yml
chore: move level/falsepositives to bottom
2021-09-02 14:55:17 +02:00
sysmon_uac_bypass_dotnet_profiler.yml
chore: move level/falsepositives to bottom
2021-09-02 14:55:17 +02:00
sysmon_uac_bypass_ieinstal.yml
chore: move level/falsepositives to bottom
2021-09-02 14:55:17 +02:00
sysmon_uac_bypass_msconfig_gui.yml
chore: move level/falsepositives to bottom
2021-09-02 14:55:17 +02:00
sysmon_uac_bypass_ntfs_reparse_point.yml
chore: move level/falsepositives to bottom
2021-09-02 14:55:17 +02:00
sysmon_webshell_creation_detect.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_wmi_persistence_script_event_consumer_write.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
win_cve_2021_1675_printspooler.yml
fix: print driver FP
2021-12-01 14:14:53 +01:00
win_fe_access_susp_unattend_xml.yml
Windows Redcannary
2021-12-19 11:20:42 +01:00
win_fe_anydesk_artefact.yml
Windows Redcannary
2022-02-12 15:53:13 +01:00
win_fe_creation_new_shim_database.yml
fix: typo
2022-01-20 10:45:30 +01:00
win_fe_creation_scr_binary_file.yml
fix: typo
2022-01-20 10:45:30 +01:00
win_fe_creation_unquoted_service_path.yml
fix: typo
2022-01-20 10:45:30 +01:00
win_fe_csharp_compile_artefact.yml
Update win_fe_csharp_compile_artefact.yml
2022-01-09 16:11:54 +01:00
win_fe_gotoopener_artefact.yml
Windows Redcannary
2022-02-13 11:04:00 +01:00
win_fe_install_teamviewer_desktop.yml
Add windows redcannary rules
2022-01-28 16:12:38 +01:00
win_fe_macro_file.yml
Windows Redcannary
2022-01-23 16:37:59 +01:00
win_fe_screenconnect_artefact.yml
Windows Redcannary
2022-02-13 11:04:00 +01:00
win_fe_susp_colorcpl.yml
add win_fe_susp_colorcpl
2022-01-21 14:16:35 +01:00
win_fe_susp_desktop_txt.yml
Update win_fe_susp_desktop_txt.yml
2021-12-28 12:03:11 +01:00
win_fe_writing_local_admin_share.yml
fix: typo
2022-01-20 10:45:30 +01:00
win_file_winword_cve_2021_40444.yml
add missing MITRE Techniques
2021-11-20 12:26:01 +01:00
win_hivenightmare_file_exports.yml
Add cve tags
2021-10-25 18:40:50 +02:00
win_outlook_c2_macro_creation.yml
fix tags
2021-08-24 12:36:31 +02:00
win_rclone_exec_file.yml
Remove unneeded EventID
2021-10-04 21:25:57 +02:00
win_susp_desktopimgdownldr_file.yml
Change status for old rules
2021-11-27 11:33:14 +01:00