security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
2cecd0e6ef7ddecbf81ce5f01b2205ccfdcbb414
blue-team-tools/rules/windows/registry_event
T
History
frack113 470ca979b4 Fix FP binary
2022-02-20 11:31:08 +01:00
..
registry_event_abusing_windows_telemetry_for_persistence.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
registry_event_apt_chafer_mar18.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
registry_event_apt_pandemic.yml
split sysmon_apt_pandemic
2021-09-12 09:42:11 +02:00
registry_event_cve_2021_31979_cve_2021_33771_exploits.yml
Add cve tags
2021-10-25 18:14:03 +02:00
registry_event_defender_disabled.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
registry_event_defender_exclusions.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
registry_event_defender_realtime_protection_disabled.yml
Create new rule for detecting Microsfot Defender Tampering via Registry
2021-10-18 10:07:44 +04:00
registry_event_dns_serverlevelplugindll.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
registry_event_mal_adwind.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
registry_event_mal_azorult.yml
Order rules
2022-01-20 22:06:55 +01:00
registry_event_mal_blue_mockingbird.yml
Order rules
2022-01-20 22:06:55 +01:00
registry_event_mal_flowcloud.yml
Order rules
2022-01-20 22:06:55 +01:00
registry_event_mal_netwire.yml
Order rules
2022-01-20 22:06:55 +01:00
registry_event_mal_ursnif.yml
Order rules
2022-01-20 22:06:55 +01:00
registry_event_mstsc_history_cleared.yml
refactor: change all " of them" expressions
2022-01-11 10:59:57 +01:00
registry_event_net_ntlm_downgrade.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
registry_event_stickykey_like_backdoor.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
registry_event_sysinternals_eula_accepted.yml
split sysinternals eula and uac bypass
2021-09-12 09:38:05 +02:00
registry_event_uac_bypass_eventvwr.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
registry_event_uac_bypass_winsat.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
registry_event_uac_bypass_wmp.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
sysmon_apt_leviathan.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_apt_oceanlotus_registry.yml
Update sysmon_apt_oceanlotus_registry
2021-09-17 19:50:30 +02:00
sysmon_asep_reg_keys_modification_classes.yml
fix: filter MS Office
2022-02-16 16:31:13 +01:00
sysmon_asep_reg_keys_modification_common.yml
fix: filter known software
2022-02-16 16:31:12 +01:00
sysmon_asep_reg_keys_modification_currentcontrolset.yml
fix: exclude cutepdf writer
2022-02-16 16:31:12 +01:00
sysmon_asep_reg_keys_modification_currentversion_nt.yml
fix: filter MS Office and Dropbox
2022-02-16 16:31:12 +01:00
sysmon_asep_reg_keys_modification_currentversion.yml
fix: remove unneded escape for "
2022-02-16 16:31:13 +01:00
sysmon_asep_reg_keys_modification_internet_explorer.yml
fix: remove trailing \
2022-02-16 16:31:12 +01:00
sysmon_asep_reg_keys_modification_office.yml
fix: exclude known office addins
2022-02-16 16:31:12 +01:00
sysmon_asep_reg_keys_modification_session_manager.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
sysmon_asep_reg_keys_modification_system_scripts.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
sysmon_asep_reg_keys_modification_winsock2.yml
fix: exclude msiexec from SysWOW64
2022-02-16 16:31:12 +01:00
sysmon_asep_reg_keys_modification_wow6432node_classes.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
sysmon_asep_reg_keys_modification_wow6432node_currentversion.yml
fix: known FP
2022-02-16 16:31:13 +01:00
sysmon_asep_reg_keys_modification_wow6432node.yml
fix: filter known software
2022-02-16 16:31:12 +01:00
sysmon_asep_reg_keys_modification.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_bypass_via_wsreset.yml
Change status for old rules
2021-11-27 11:33:14 +01:00
sysmon_cmstp_execution_by_registry.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_cobaltstrike_service_installs.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45
sysmon_comhijack_sdclt.yml
Change status for old rules
2021-11-27 11:33:14 +01:00
sysmon_cve_2020_1048.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
sysmon_dhcp_calloutdll.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_disable_microsoft_office_security_features.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45
sysmon_disable_security_events_logging_adding_reg_key_minint.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_disable_wdigest_credential_guard.yml
Change status for old rules
2021-11-27 11:33:14 +01:00
sysmon_disabled_exploit_guard_network_protection_on_microsoft_defender.yml
Create sysmon_disabled_exploit_guard_network_protection_on_microsoft_defender.yml
2021-08-04 19:11:00 -05:00
sysmon_disabled_pua_protection_on_microsoft_defender.yml
Update sysmon_disabled_pua_protection_on_microsoft_defender.yml
2021-08-04 17:00:34 -05:00
sysmon_disabled_tamper_protection_on_microsoft_defender.yml
Create sysmon_disabled_tamper_protection_on_microsoft_defender.yml
2021-08-04 19:08:10 -05:00
sysmon_dns_over_https_enabled.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
sysmon_enabling_cor_profiler_env_variables.yml
Change status for old rules
2021-11-27 11:33:14 +01:00
sysmon_esentutl_volume_shadow_copy_service_keys.yml
Update sysmon_esentutl_volume_shadow_copy_service_keys.yml
2021-12-08 17:25:03 +01:00
sysmon_etw_disabled.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
sysmon_hack_wce_reg.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_hybridconnectionmgr_svc_installation.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
sysmon_logon_scripts_userinitmprlogonscript_reg.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_modify_screensaver_binary_path.yml
Change status for old rules
2021-11-27 11:33:14 +01:00
sysmon_narrator_feedback_persistance.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_new_application_appcompat.yml
Change status for old rules
2021-11-27 11:33:14 +01:00
sysmon_new_dll_added_to_appcertdlls_registry_key.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_new_dll_added_to_appinit_dlls_registry_key.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_office_test_regadd.yml
fix TargetObject HK
2021-09-13 13:16:16 +02:00
sysmon_office_vsto_persistence.yml
fix: several FPs against a fresh installed Windows with example applications and basic user interaction
2022-02-09 17:47:22 +01:00
sysmon_powershell_as_service.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
sysmon_rdp_registry_modification.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
sysmon_rdp_settings_hijack.yml
Added InitialProgram registry key for RDP/TS
2021-12-31 14:12:02 +01:00
sysmon_redmimicry_winnti_reg.yml
Change status for old rules
2021-11-27 11:33:14 +01:00
sysmon_reg_office_security.yml
Update sysmon_reg_office_security.yml
2022-02-17 08:15:25 +01:00
sysmon_reg_silentprocessexit_lsass.yml
Missing status in rules (#2284)
2021-11-19 22:32:26 +01:00
sysmon_reg_silentprocessexit.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
sysmon_reg_vbs_payload_stored.yml
fix: several FPs against a fresh installed Windows with example applications and basic user interaction
2022-02-09 17:47:22 +01:00
sysmon_registry_add_local_hidden_user.yml
Change double quote to quote
2022-01-06 14:02:35 +01:00
sysmon_registry_persistence_key_linking.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_registry_persistence_search_order.yml
fix: several FPs against a fresh installed Windows with example applications and basic user interaction 2
2022-02-10 16:12:17 +01:00
sysmon_registry_susp_printer_driver.yml
fix: several FPs against a fresh installed Windows with example applications and basic user interaction
2022-02-09 17:47:22 +01:00
sysmon_registry_trust_record_modification.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_removal_amsi_registry_key.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45
sysmon_removal_com_hijacking_registry_key.yml
Change status for old rules
2021-11-27 11:33:14 +01:00
sysmon_runkey_winekey.yml
Change status for old rules
2021-11-27 11:33:14 +01:00
sysmon_runonce_persistence.yml
fix: several FPs against a fresh installed Windows with example applications and basic user interaction 4
2022-02-15 16:40:04 +01:00
sysmon_ssp_added_lsa_config.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_susp_atbroker_change.yml
Missing status in rules (#2284)
2021-11-19 22:32:26 +01:00
sysmon_susp_download_run_key.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_susp_lsass_dll_load.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_susp_mic_cam_access.yml
Missing status in rules (#2284)
2021-11-19 22:32:26 +01:00
sysmon_susp_reg_persist_explorer_run.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_susp_run_key_img_folder.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_susp_service_installed.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_suspicious_keyboard_layout_load.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
sysmon_sysinternals_sdelete_registry_keys.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45
sysmon_taskcache_entry.yml
fix: several FPs against a fresh installed Windows with example applications and basic user interaction 2
2022-02-10 16:12:17 +01:00
sysmon_uac_bypass_sdclt.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_wab_dllpath_reg_change.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
sysmon_wdigest_enable_uselogoncredential.yml
fix: missing update in modified date
2022-02-01 15:59:20 +01:00
sysmon_win_reg_persistence_recycle_bin.yml
Forget the status
2021-11-27 09:07:54 +01:00
sysmon_win_reg_persistence.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
sysmon_win_reg_telemetry_persistence.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
win_outlook_c2_registry_key.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
win_outlook_registry_todaypage.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
win_outlook_registry_webview.yml
fix: several FPs against a fresh installed Windows with example applications and basic user interaction
2022-02-09 17:47:22 +01:00
win_portproxy_registry_key.yml
fix TargetObject HK
2021-09-13 13:16:16 +02:00
win_re_add_port_monitor.yml
fix: several FPs against a fresh installed Windows with example applications and basic user interaction
2022-02-09 17:47:22 +01:00
win_re_blackbyte_ransomware.yml
Add win_re_blackbyte_ransomware
2022-01-24 10:03:52 +01:00
win_re_bypass_uac_using_delegateexecute.yml
Windows redcannary
2022-01-05 19:52:52 +01:00
win_re_bypass_uac_using_eventviewer.yml
Windows redcannary
2022-01-05 19:52:52 +01:00
win_re_bypass_uac_using_silentcleanup_task.yml
Windows Redcannary
2022-01-08 09:17:56 +01:00
win_re_change_rdp_port.yml
Update win_re_change_rdp_port.yml
2022-01-02 13:32:46 +01:00
win_re_change_security_zones.yml
Redcannary windows test
2022-01-23 11:37:01 +01:00
win_re_chrome_extension.yml
Update win_re_chrome_extension.yml
2021-12-31 15:49:57 +01:00
win_re_disable_administrative_share.yml
fix empty id
2022-01-16 15:24:44 +01:00
win_re_disable_defender_firewall.yml
Microsoft Defender Firewall
2022-01-09 19:48:22 +01:00
win_re_disable_uac_registry.yml
Windows redcannary
2022-01-05 19:52:52 +01:00
win_re_hidden_extention.yml
Redcannary windows test
2022-01-23 11:37:01 +01:00
win_re_ie_persistence.yml
Fix FP binary
2022-02-20 11:31:08 +01:00
win_re_outlook_security.yml
Update win_re_outlook_security.yml
2021-12-31 15:50:39 +01:00
win_re_set_servicedll.yml
Update win_re_set_servicedll.yml
2022-02-04 23:19:36 +01:00
win_re_shim_databases_persistence.yml
Windows persistence
2021-12-30 11:58:10 +01:00
win_re_winlogon_notify_key.yml
Windows persistence
2021-12-30 11:58:10 +01:00
win_registry_file_association_exefile.yml
Improve exefile rule logic
2021-11-20 00:18:55 +01:00
win_registry_mimikatz_printernightmare.yml
Add Technique tags
2021-11-20 09:53:35 +01:00
win_registry_shell_open_keys_manipulation.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00