security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
3f452692961e664e240f5fae2bddf36d91ea4f3e
blue-team-tools/rules/linux
T
History
Anton Kutepov 3f45269296 Merge branch 'oscd' 
B
B
B
B
A
2021-03-02 22:58:41 +03:00
..
auditd
Merge branch 'oscd'
2021-03-02 22:58:41 +03:00
modsecurity
Fixed my git issue
2020-09-13 22:03:04 -06:00
at_command.yml
Update at_command.yml
2020-10-16 22:49:40 +03:00
lnx_apt_equationgroup_lnx.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
lnx_base64_decode.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_binary_padding.yml
fix indentation
2020-10-19 18:19:38 +03:00
lnx_buffer_overflows.yml
fixed various spelling errors all over rules and source code
2021-02-24 14:43:13 +00:00
lnx_change_file_time_attr.yml
fix nelwines
2020-10-19 16:44:18 +03:00
lnx_chattr_immutable_removal.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
lnx_clamav.yml
restore original rule
2020-11-30 01:31:00 +01:00
lnx_clear_logs.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_dd_delete_file.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
lnx_file_and_directory_discovery.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_file_copy.yml
Update lnx_file_copy.yml
2020-10-15 22:53:20 -03:00
lnx_file_deletion.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_file_or_folder_permissions.yml
fixed various spelling errors all over rules and source code
2021-02-24 14:43:13 +00:00
lnx_find_cred_in_files.yml
fix newlines
2020-10-19 16:45:42 +03:00
lnx_install_root_certificate.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_local_account.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_local_groups.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_network_service_scanning.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_password_policy_discovery.yml
Update lnx_password_policy_discovery.yml
2020-10-16 22:52:15 +03:00
lnx_pers_systemd_reload.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
lnx_process_discovery.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_proxy_connection.yml
restore original rule
2020-11-30 01:32:06 +01:00
lnx_remote_system_discovery.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_schedule_task_job_cron.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_security_software_discovery.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_security_tools_disabling.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_setgid_setuid.yml
restore the rule
2020-11-28 18:53:13 +01:00
lnx_shell_clear_cmd_history.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
lnx_shell_priv_esc_prep.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
lnx_shell_susp_commands.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
lnx_shell_susp_log_entries.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
lnx_shell_susp_rev_shells.yml
fixed various spelling errors all over rules and source code
2021-02-24 14:43:13 +00:00
lnx_shellshock.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
lnx_space_after_filename_.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
lnx_split_file_into_pieces.yml
fix wrong tactic
2020-10-19 17:16:22 +03:00
lnx_ssh_cve_2018_15473.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
lnx_sudo_cve_2019_14287.yml
restore the original file
2020-11-29 21:32:46 +01:00
lnx_susp_failed_logons_single_source.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
lnx_susp_guacamole.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
lnx_susp_histfile_operations.yml
additional shells for both rules fix
2020-10-17 02:33:32 +03:00
lnx_susp_jexboss.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
lnx_susp_named.yml
Update lnx_susp_named.yml
2020-11-29 21:31:54 +01:00
lnx_susp_ssh.yml
restore the original file
2020-11-29 21:30:50 +01:00
lnx_susp_vsftp.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
lnx_system_info_discovery.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_system_network_connections_discovery.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_system_network_discovery.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
lnx_system_shutdown_reboot.yml
fix newlines
2020-10-19 16:42:43 +03:00
macos_applescript.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_base64_decode.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_binary_padding.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_change_file_time_attr.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_clear_system_logs.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_create_account.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_create_hidden_account.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_creds_from_keychain.yml
Changed selections and condition
2020-11-27 19:23:31 +01:00
macos_disable_security_tools.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_emond_launch_daemon.yml
Sigma rule
2020-10-23 10:16:59 +02:00
macos_file_and_directory_discovery.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_find_cred_in_files.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_gui_input_capture.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_local_account.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_local_groups.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_network_service_scanning.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_network_sniffing.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_remote_system_discovery.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_schedule_task_job_cron.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_screencapture.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_security_software_discovery.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_split_file_into_pieces.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_startup_items.yml
update syntax a bit to re-run the test
2020-10-20 17:31:00 +02:00
macos_susp_histfile_operations.yml
added fish to macos rule
2020-10-17 02:37:21 +03:00
macos_system_network_connections_discovery.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_system_network_discovery.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_system_shutdown_reboot.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_xattr_gatekeeper_bypass.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00