security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
359292e572a7d80ec88e9371146e5726117eb50d
blue-team-tools/rules/linux/process_creation
T
History
kidrek 359292e572 Merge PR #4396 from @kidrek - Add New Rules Related To ESXCLI Usage 
new: ESXi Network Configuration Discovery Via ESXCLI
new: ESXi Admin Permission Assigned To Account Via ESXCLI
new: ESXi Storage Information Discovery Via ESXCLI
new: ESXi System Information Discovery Via ESXCLI
new: ESXi VM List Discovery Via ESXCLI
new: ESXi VM Kill Via ESXCLI
new: ESXi VSAN Information Discovery Via ESXCLI

---------

Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
2023-09-06 11:42:23 +02:00
..
proc_creation_lnx_at_command.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_base64_decode.yml
feat: add new linux rules
2022-12-29 11:17:42 +01:00
proc_creation_lnx_base64_execution.yml
feat: add rules related to Barracuda ESG exploitation
2023-06-18 22:14:57 +02:00
proc_creation_lnx_base64_shebang_cli.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_bash_interactive_shell.yml
feat: add new rules related to linux reverse shells (#4166)
2023-04-25 11:03:11 +02:00
proc_creation_lnx_bpf_kprob_tracing_enabled.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_bpftrace_unsafe_option_usage.yml
change status to test
2023-01-27 06:48:34 +01:00
proc_creation_lnx_capa_discovery.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_cat_sudoers.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_chattr_immutable_removal.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_clear_logs.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_clear_syslog.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_clipboard_collection.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_cp_passwd_or_shadow_tmp.yml
feat: apply suggestions from code review
2023-01-31 17:11:18 +01:00
proc_creation_lnx_crontab_enumeration.yml
feat: new linux rules related to GobRAT malware (#4272)
2023-06-02 15:49:43 +02:00
proc_creation_lnx_crontab_removal.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_crypto_mining.yml
Merge PR #4392 from @tjgeorgen - Update MITRE Tags
2023-08-28 16:53:27 +02:00
proc_creation_lnx_curl_usage.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_cve_2022_26134_atlassian_confluence.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_cve_2022_33891_spark_shell_command_injection.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_dd_file_overwrite.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_disable_ufw.yml
feat: new rules from blackberry
2023-01-31 00:38:06 +01:00
proc_creation_lnx_doas_execution.yml
Linux rules update
2022-09-16 09:22:57 +02:00
proc_creation_lnx_esxcli_network_discovery.yml
Merge PR #4396 from @kidrek - Add New Rules Related To ESXCLI Usage
2023-09-06 11:42:23 +02:00
proc_creation_lnx_esxcli_permission_change_admin.yml
Merge PR #4396 from @kidrek - Add New Rules Related To ESXCLI Usage
2023-09-06 11:42:23 +02:00
proc_creation_lnx_esxcli_storage_discovery.yml
Merge PR #4396 from @kidrek - Add New Rules Related To ESXCLI Usage
2023-09-06 11:42:23 +02:00
proc_creation_lnx_esxcli_system_discovery.yml
Merge PR #4396 from @kidrek - Add New Rules Related To ESXCLI Usage
2023-09-06 11:42:23 +02:00
proc_creation_lnx_esxcli_vm_discovery.yml
Merge PR #4396 from @kidrek - Add New Rules Related To ESXCLI Usage
2023-09-06 11:42:23 +02:00
proc_creation_lnx_esxcli_vm_kill.yml
Merge PR #4396 from @kidrek - Add New Rules Related To ESXCLI Usage
2023-09-06 11:42:23 +02:00
proc_creation_lnx_esxcli_vsan_discovery.yml
Merge PR #4396 from @kidrek - Add New Rules Related To ESXCLI Usage
2023-09-06 11:42:23 +02:00
proc_creation_lnx_file_and_directory_discovery.yml
Title modified in several rules (#3728)
2022-11-25 15:34:38 +01:00
proc_creation_lnx_file_deletion.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_grep_os_arch_discovery.yml
feat: new linux rules related to GobRAT malware (#4272)
2023-06-02 15:49:43 +02:00
proc_creation_lnx_groupdel.yml
Add rule delete group or user (#3822)
2022-12-27 11:21:14 +01:00
proc_creation_lnx_gtfobin_apt.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_gtfobin_vim.yml
fix: typos in multiple rules (#4011)
2023-02-06 13:53:23 +01:00
proc_creation_lnx_hack_tools.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_install_root_certificate.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_install_suspicioua_packages.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_iptables_flush_ufw.yml
feat: new rules from blackberry
2023-01-31 00:38:06 +01:00
proc_creation_lnx_kill_process.yml
feat: new rule related to process termination using kill (#4112)
2023-03-20 22:04:26 +01:00
proc_creation_lnx_local_account.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
proc_creation_lnx_local_groups.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
proc_creation_lnx_malware_gobrat_grep_payload_discovery.yml
feat: new linux rules related to GobRAT malware (#4272)
2023-06-02 15:49:43 +02:00
proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.yml
fix: update rules for tests
2023-06-19 09:24:18 +02:00
proc_creation_lnx_mkfifo_named_pipe_creation.yml
feat: add rules related to Barracuda ESG exploitation
2023-06-18 22:14:57 +02:00
proc_creation_lnx_mount_hidepid.yml
feat: apply suggestions from code review
2023-01-31 17:11:18 +01:00
proc_creation_lnx_netcat_reverse_shell.yml
feat: add new rules related to linux reverse shells (#4166)
2023-04-25 11:03:11 +02:00
proc_creation_lnx_network_service_scanning.yml
feat: more updates
2023-03-06 00:39:26 +01:00
proc_creation_lnx_nohup_susp_execution.yml
feat: new linux rules related to GobRAT malware (#4272)
2023-06-02 15:49:43 +02:00
proc_creation_lnx_nohup.yml
Merge PR #4392 from @tjgeorgen - Update MITRE Tags
2023-08-28 16:53:27 +02:00
proc_creation_lnx_omigod_scx_runasprovider_executescript.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_perl_reverse_shell.yml
feat: add new rules related to linux reverse shells (#4166)
2023-04-25 11:03:11 +02:00
proc_creation_lnx_php_reverse_shell.yml
feat: add new rules related to linux reverse shells (#4166)
2023-04-25 11:03:11 +02:00
proc_creation_lnx_process_discovery.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_proxy_connection.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_python_pty_spawn.yml
feat: add rules related to Barracuda ESG exploitation
2023-06-18 22:14:57 +02:00
proc_creation_lnx_python_reverse_shell.yml
feat: add new rules related to linux reverse shells (#4166)
2023-04-25 11:03:11 +02:00
proc_creation_lnx_remote_system_discovery.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_remove_package.yml
feat: new rules Linux Package Uninstall (#4098)
2023-03-13 00:04:53 +01:00
proc_creation_lnx_ruby_reverse_shell.yml
feat: add new rules related to linux reverse shells (#4166)
2023-04-25 11:03:11 +02:00
proc_creation_lnx_schedule_task_job_cron.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
proc_creation_lnx_security_software_discovery.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
proc_creation_lnx_security_tools_disabling.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
proc_creation_lnx_services_stop_and_disable.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_setgid_setuid.yml
Remove mitre url
2023-01-10 18:09:04 +01:00
proc_creation_lnx_ssm_agent_abuse.yml
Update proc_creation_lnx_ssm_agent_abuse.yml
2023-08-04 00:09:48 +02:00
proc_creation_lnx_sudo_cve_2019_14287.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_susp_chmod_directories.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_susp_container_residence_discovery.yml
Merge PR #4380 from @SethHanford - Lnx container discovery
2023-08-24 13:04:25 +02:00
proc_creation_lnx_susp_curl_fileupload.yml
fix: update curl rules flags to use regex (#4213)
2023-05-03 10:16:01 +02:00
proc_creation_lnx_susp_curl_useragent.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_susp_dockerenv_recon.yml
Merge PR #4380 from @SethHanford - Lnx container discovery
2023-08-24 13:04:25 +02:00
proc_creation_lnx_susp_execution_tmp_folder.yml
Merge PR #4392 from @tjgeorgen - Update MITRE Tags
2023-08-28 16:53:27 +02:00
proc_creation_lnx_susp_find_execution.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_susp_git_clone.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_susp_history_delete.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_susp_history_recon.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_susp_inod_listing.yml
Merge PR #4380 from @SethHanford - Lnx container discovery
2023-08-24 13:04:25 +02:00
proc_creation_lnx_susp_interactive_bash.yml
Merge PR #4392 from @tjgeorgen - Update MITRE Tags
2023-08-28 16:53:27 +02:00
proc_creation_lnx_susp_java_children.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_susp_pipe_shell.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_susp_recon_indicators.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_susp_sensitive_file_access.yml
feat: add new rule related to linux sensitive file tampering (#4263)
2023-05-30 16:23:19 +02:00
proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.yml
feat: new linux rules related to GobRAT malware (#4272)
2023-06-02 15:49:43 +02:00
proc_creation_lnx_susp_shell_script_exec_from_susp_location.yml
feat: new linux rules related to GobRAT malware (#4272)
2023-06-02 15:49:43 +02:00
proc_creation_lnx_system_info_discovery.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_system_network_connections_discovery.yml
feat: update windows firewall rules
2023-01-17 19:01:37 +01:00
proc_creation_lnx_system_network_discovery.yml
chore: split selection clause into two (#4160)
2023-04-05 05:04:54 +02:00
proc_creation_lnx_touch_susp.yml
feat: apply suggestions from code review
2023-01-31 17:11:18 +01:00
proc_creation_lnx_triple_cross_rootkit_execve_hijack.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_triple_cross_rootkit_install.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_userdel.yml
Add rule delete group or user (#3822)
2022-12-27 11:21:14 +01:00
proc_creation_lnx_usermod_susp_group.yml
fix: rule status
2022-12-21 19:23:23 +01:00
proc_creation_lnx_webshell_detection.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_lnx_wget_download_suspicious_directory.yml
feat: new linux rules related to GobRAT malware (#4272)
2023-06-02 15:49:43 +02:00
proc_creation_lnx_xterm_reverse_shell.yml
feat: add new rules related to linux reverse shells (#4166)
2023-04-25 11:03:11 +02:00