security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
Files
362f4e4e603a4ade05c0bfac2274f1dafa5bb28e
blue-team-tools/rules-deprecated/windows
T
History
Nasreddine Bencherchali 2ef681291a feat: more rules updates
2023-02-14 19:30:18 +01:00
..
file_event_win_hktl_createminidump.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
file_event_win_susp_clr_logs.yml
feat: updates and enhancements
2023-01-06 16:35:34 +01:00
image_load_side_load_scm.yml
feat: more rules updates
2023-02-14 19:30:18 +01:00
image_load_susp_winword_wmidll_load.yml
Update modified last change
2023-01-02 08:44:46 +01:00
posh_pm_powercat.yml
feat: update and merge some pwsh rules
2023-01-20 17:07:23 +01:00
posh_ps_access_to_chrome_login_data.yml
Update modified last change
2023-01-02 08:44:46 +01:00
posh_ps_azurehound_commands.yml
feat: updates and enhancements
2023-01-02 14:49:45 +01:00
posh_ps_invoke_nightmare.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
powershell_suspicious_download.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
powershell_suspicious_invocation_generic.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
powershell_suspicious_invocation_specific.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
powershell_syncappvpublishingserver_exe.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_access_win_in_memory_assembly_execution.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_credential_acquisition_registry_hive_dumping.yml
feat: update and enhancements
2023-02-07 13:55:14 +01:00
proc_creation_win_indirect_cmd.yml
feat: updates and enhancements
2023-01-04 17:49:32 +01:00
proc_creation_win_indirect_command_execution_forfiles.yml
fix: status
2023-01-04 17:55:48 +01:00
proc_creation_win_invoke_obfuscation_via_use_rundll32.yml
Update proc_creation_win_invoke_obfuscation_via_use_rundll32.yml
2022-12-30 09:53:25 +01:00
proc_creation_win_lolbas_execution_of_wuauclt.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_lolbins_by_office_applications.yml
feat: additional updates and fixes
2023-02-04 21:06:47 +01:00
proc_creation_win_mal_ryuk.yml
feat: multiple updates and fixes
2023-02-03 02:22:28 +01:00
proc_creation_win_mavinject_proc_inj.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_win_msdt_diagcab.yml
feat: update and enhancements
2023-02-07 13:55:14 +01:00
proc_creation_win_nslookup_pwsh_download_cradle.yml
fix: add missing modified field
2022-12-14 10:32:11 +01:00
proc_creation_win_office_from_proxy_executing_regsvr32_payload2.yml
feat: general updates and fixes
2022-12-02 23:16:03 +01:00
proc_creation_win_office_from_proxy_executing_regsvr32_payload.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_office_spawning_wmi_commandline.yml
feat: additional updates and fixes
2023-02-04 21:06:47 +01:00
proc_creation_win_possible_applocker_bypass.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_powershell_amsi_bypass_pattern_nov22.yml
feat: even more updates
2023-02-03 20:17:09 +01:00
proc_creation_win_powershell_base64_invoke_susp_cmdlets.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_win_powershell_base64_listing_shadowcopy.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_win_powershell_bitsjob.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_powershell_xor_encoded_command.yml
fix: revert related field for deprecated rules
2023-01-31 11:25:07 +01:00
proc_creation_win_reg_dump_sam.yml
Update proc_creation_win_reg_dump_sam.yml
2023-02-04 22:48:10 +01:00
proc_creation_win_renamed_powershell.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_win_renamed_psexec.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_win_renamed_rundll32.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
proc_creation_win_susp_bitstransfer.yml
fix: some issues
2023-01-11 11:18:54 +01:00
proc_creation_win_susp_cmd_exectution_via_wmi.yml
Update proc_creation_win_susp_cmd_exectution_via_wmi.yml
2023-01-20 06:45:38 +01:00
proc_creation_win_susp_run_folder.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_wmic_execution_via_office_process.yml
feat: additional updates and fixes
2023-02-04 21:06:47 +01:00
proc_creation_win_wmic_remote_command.yml
feat: update wmic rules
2023-02-14 19:30:18 +01:00
proc_creation_win_wmic_remote_service.yml
feat: update wmic rules
2023-02-14 19:30:18 +01:00
process_creation_syncappvpublishingserver_exe.yml
Update modified last change
2023-01-02 08:44:46 +01:00
registry_add_sysinternals_sdelete_registry_keys.yml
Merge branch 'registry-rules-update' of https://github.com/nasbench/sigma into registry-rules-update
2023-02-08 11:40:56 +01:00
registry_event_asep_reg_keys_modification.yml
Update modified last change
2023-01-02 08:44:46 +01:00
registry_set_abusing_windows_telemetry_for_persistence.yml
Update modified last change
2023-01-02 08:44:46 +01:00
registry_set_add_hidden_user.yml
feat: updates and fixes
2023-01-26 22:42:56 +01:00
registry_set_silentprocessexit.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
sysmon_accessing_winapi_in_powershell_credentials_dumping.yml
Refractor (#3794)
2022-12-18 21:00:14 +01:00
sysmon_dcom_iertutil_dll_hijack.yml
fix: resolves #4015
2023-02-07 14:33:56 +01:00
sysmon_mimikatz_detection_lsass.yml
Update modified last change
2023-01-02 08:44:46 +01:00
sysmon_rclone_execution.yml
Update modified last change
2023-01-02 08:44:46 +01:00
win_dsquery_domain_trust_discovery.yml
fix: add missing modified and small fixes to selections
2023-02-04 11:44:33 +01:00
win_lateral_movement_condrv.yml
Update modified last change
2023-01-02 08:44:46 +01:00
win_security_lolbas_execution_of_nltest.yml
feat: multiple updates and fixes
2023-02-03 02:22:28 +01:00
win_susp_esentutl_activity.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
win_susp_rclone_exec.yml
Update modified last change
2023-01-02 08:44:46 +01:00
win_susp_vssadmin_ntds_activity.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00