security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
46559388e054e1aff3d7b3d8f41ebead2b690b21
blue-team-tools/rules/windows/process_access
T
History
secDre4mer 46559388e0 Merge PR #4750 from @secDre4mer - Fix false positive with Potential Credential Dumping Activity Via LSASS rule 
fix: Potential Credential Dumping Activity Via LSASS - remove legitimate access mask
2024-03-02 02:28:29 +01:00
..
proc_access_win_cmstp_execution_by_access.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_hktl_generic_access.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_hktl_handlekatz_lsass_access.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_hktl_littlecorporal_generated_maldoc.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_hktl_sysmonente.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_lsass_dump_comsvcs_dll.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_lsass_dump_keyword_image.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_lsass_memdump.yml
Merge PR #4750 from @secDre4mer - Fix false positive with Potential Credential Dumping Activity Via LSASS rule
2024-03-02 02:28:29 +01:00
proc_access_win_lsass_python_based_tool.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_lsass_remote_access_trough_winrm.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_lsass_seclogon_access.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_lsass_susp_access_flag.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_lsass_werfault.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_lsass_whitelisted_process_names.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_susp_direct_ntopenprocess_call.yml
Merge PR #4577 from @nasbench - Multiple Fixes & Updates
2023-12-21 21:04:18 +01:00
proc_access_win_susp_invoke_patchingapi.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_susp_shellcode_injection.yml
Merge PR #4681 from @nasbench - Add Missing Ref & Tags
2024-01-29 13:37:20 +01:00
proc_access_win_svchost_credential_dumping.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_svchost_susp_access_request.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_uac_bypass_editionupgrademanagerobj.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_uac_bypass_wow64_logger.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00