GtUGtHGtNDtEUaE 782f0f524e Merge PR #4945 from @GtUGtHGtNDtEUaE - Fix typo in field name for rules leveraging EID 5145 ...

fix: Remote Task Creation via ATSVC Named Pipe - Fixed field name from `Accesses` to `AccessList`
fix: Persistence and Execution at Scale via GPO Scheduled Task - Fixed field name from `Accesses` to `AccessList`
fix: Remote Service Activity via SVCCTL Named Pipe - Fixed field name from `Accesses` to `AccessList`

2024-08-01 22:46:23 +02:00

..

account_management

Merge PR #4888 from @nasbench - Add multiple new rules, updates and fixes

2024-07-17 11:04:05 +02:00

object_access

Merge PR #4664 from @danielgottt - Windows Filtering Platform Blocked Connection From EDR Agent Binary

2024-01-11 08:56:17 +01:00

win_security_aadhealth_mon_agent_regkey_access.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_aadhealth_svc_agent_regkey_access.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_account_backdoor_dcsync_rights.yml

Merge PR #4727 from @frack113 - Refactor the condition field to align with the standard

2024-02-26 21:51:24 +01:00

win_security_account_discovery.yml

Merge PR #4940 from @fukusuket - Update unreachable references blog.menasec[.]net

2024-07-31 10:16:56 +02:00

win_security_ad_object_writedac_access.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

win_security_ad_replication_non_machine_account.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_ad_user_enumeration.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_adcs_certificate_template_configuration_vulnerability_eku.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_security_adcs_certificate_template_configuration_vulnerability.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_security_add_remove_computer.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_admin_share_access.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_alert_active_directory_user_control.yml

fix:F multiple 404 links in references (#4332)

2023-06-26 10:10:04 +01:00

win_security_alert_ad_user_backdoors.yml

Merge PR #4738 from @nasbench - Small fixes and metadata updates

2024-02-26 22:01:53 +01:00

win_security_alert_enable_weak_encryption.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_alert_ruler.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_atsvc_task.yml

Merge PR #4945 from @GtUGtHGtNDtEUaE - Fix typo in field name for rules leveraging EID 5145

2024-08-01 22:46:23 +02:00

win_security_audit_log_cleared.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

win_security_camera_microphone_access.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_security_cobaltstrike_service_installs.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_security_codeintegrity_check_failure.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_dce_rpc_smb_spoolss_named_pipe.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_security_dcom_iertutil_dll_hijack.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

win_security_dcsync.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_device_installation_blocked.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_disable_event_auditing_critical.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

win_security_disable_event_auditing.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

win_security_dot_net_etw_tamper.yml

feat: add two new rules

2022-12-20 23:44:44 +01:00

win_security_dpapi_domain_backupkey_extraction.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

win_security_dpapi_domain_masterkey_backup_attempt.yml

fix: tune more fp

2023-03-15 12:00:20 +01:00

win_security_external_device.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_gpo_scheduledtasks.yml

Merge PR #4945 from @GtUGtHGtNDtEUaE - Fix typo in field name for rules leveraging EID 5145

2024-08-01 22:46:23 +02:00

win_security_hidden_user_creation.yml

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00

win_security_hktl_edr_silencer.yml

Merge PR #4697 from @frack113 - Fix errors in rule status and logsource

2024-01-31 00:56:01 +01:00

win_security_hktl_nofilter.yml

Merge PR #4638 from @st0pp3r - HackTool NoFilter Execution

2024-01-10 10:57:10 +01:00

win_security_hybridconnectionmgr_svc_installation.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_security_impacket_psexec.yml

Merge PR #4940 from @fukusuket - Update unreachable references blog.menasec[.]net

2024-07-31 10:16:56 +02:00

win_security_impacket_secretdump.yml

Merge PR #4940 from @fukusuket - Update unreachable references blog.menasec[.]net

2024-07-31 10:16:56 +02:00

win_security_invoke_obfuscation_clip_services_security.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

win_security_invoke_obfuscation_obfuscated_iex_services_security.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

win_security_invoke_obfuscation_stdin_services_security.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

win_security_invoke_obfuscation_var_services_security.yml

Merge PR #4803 from @frack113 - Update regex based rules

2024-04-15 16:37:15 +02:00

win_security_invoke_obfuscation_via_compress_services_security.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

win_security_invoke_obfuscation_via_rundll_services_security.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

win_security_invoke_obfuscation_via_stdin_services_security.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

win_security_invoke_obfuscation_via_use_clip_services_security.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

win_security_invoke_obfuscation_via_use_mshta_services_security.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

win_security_invoke_obfuscation_via_use_rundll32_services_security.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

win_security_invoke_obfuscation_via_var_services_security.yml

Merge PR #4803 from @frack113 - Update regex based rules

2024-04-15 16:37:15 +02:00

win_security_iso_mount.yml

Merge PR #4560 from @nasbench - Fix FP Found In Testing & Other Rule Updates

2023-11-10 17:32:28 +01:00

win_security_lm_namedpipe.yml

fix: fp found in testing

2023-03-14 23:58:04 +01:00

win_security_lsass_access_non_system_account.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

win_security_mal_creddumper.yml

feat: rules update

2023-08-07 16:09:21 +02:00

win_security_mal_wceaux_dll.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_security_metasploit_authentication.yml

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00

win_security_metasploit_or_impacket_smb_psexec_service_install.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

win_security_net_ntlm_downgrade.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_security_net_share_obj_susp_desktop_ini.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_security_new_or_renamed_user_account_with_dollar_sign.yml

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00

win_security_not_allowed_rdp_access.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_security_password_policy_enumerated.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_pcap_drivers.yml

chore: rename folders

2023-04-14 16:55:41 +02:00

win_security_petitpotam_network_share.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

win_security_petitpotam_susp_tgt_request.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

win_security_possible_dc_shadow.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

win_security_powershell_script_installed_as_service.yml

Update Title (#3739)

2022-11-30 11:44:15 +01:00

win_security_protected_storage_service_access.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

win_security_rdp_reverse_tunnel.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

win_security_register_new_logon_process_by_rubeus.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_registry_permissions_weakness_check.yml

Merge PR #4942 from @nasbench - promote older rules status from experimental to test

2024-08-01 10:26:14 +02:00

win_security_remote_powershell_session.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

win_security_replay_attack_detected.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_sam_registry_hive_handle_request.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

win_security_scm_database_handle_failure.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

win_security_scm_database_privileged_operation.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

win_security_service_install_remote_access_software.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

win_security_service_installation_by_unusal_client.yml

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00

win_security_smb_file_creation_admin_shares.yml

fix:F multiple 404 links in references (#4332)

2023-06-26 10:10:04 +01:00

win_security_susp_add_domain_trust.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_susp_add_sid_history.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_computer_name.yml

Merge PR #4533 from @nasbench - Promote experimental rules

2023-11-02 10:48:45 +01:00

win_security_susp_dsrm_password_change.yml

Merge PR #4903 from @nischalkhadgi62 - Add Directory Service Restore Mode(DSRM) Registry Value Tampering

2024-07-11 23:18:19 +02:00

win_security_susp_failed_logon_reasons.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_susp_kerberos_manipulation.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_susp_ldap_dataexchange.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_security_susp_local_anon_logon_created.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_logon_explicit_credentials.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

win_security_susp_lsass_dump_generic.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

win_security_susp_lsass_dump.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_net_recon_activity.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_security_susp_opened_encrypted_zip_filename.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

win_security_susp_opened_encrypted_zip_outlook.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

win_security_susp_opened_encrypted_zip.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

win_security_susp_outbound_kerberos_connection.yml

Merge PR #4771 from @frack113 - Fix false positive found in testing

2024-03-18 12:00:59 +01:00

win_security_susp_possible_shadow_credentials_added.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

win_security_susp_psexec.yml

Merge PR #4940 from @fukusuket - Update unreachable references blog.menasec[.]net

2024-07-31 10:16:56 +02:00

win_security_susp_raccess_sensitive_fext.yml

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00

win_security_susp_rc4_kerberos.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

win_security_susp_scheduled_task_creation.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_susp_scheduled_task_delete_or_disable.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_susp_scheduled_task_update.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_susp_sdelete.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_susp_time_modification.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_svcctl_remote_service.yml

Merge PR #4945 from @GtUGtHGtNDtEUaE - Fix typo in field name for rules leveraging EID 5145

2024-08-01 22:46:23 +02:00

win_security_syskey_registry_access.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

win_security_sysmon_channel_reference_deletion.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_security_tap_driver_installation.yml

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00

win_security_teams_suspicious_objectaccess.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

win_security_transf_files_with_cred_data_via_network_shares.yml

chore: remove unnecessary provider_name filter for security log

2023-02-27 13:04:39 +01:00

win_security_user_added_to_local_administrators.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

win_security_user_creation.yml

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00

win_security_user_driver_loaded.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_user_logoff.yml

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

win_security_vssaudit_secevent_source_registration.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

win_security_windows_defender_exclusions_registry_modified.yml

Merge PR #4564 from @nasbench - Fix Further FPs Found In Testing

2023-11-15 15:35:43 +01:00

win_security_windows_defender_exclusions_write_access.yml

Merge PR #4564 from @nasbench - Fix Further FPs Found In Testing

2023-11-15 15:35:43 +01:00

win_security_windows_defender_exclusions_write_deleted.yml

Merge PR #4564 from @nasbench - Fix Further FPs Found In Testing

2023-11-15 15:35:43 +01:00

win_security_wmi_persistence.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_security_wmiprvse_wbemcomn_dll_hijack.yml

chore: remove unnecessary provider_name filter for security log

2023-02-27 13:04:39 +01:00

win_security_workstation_was_locked.yml

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00