security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4989d43ae97015f8113aed2efcd49d288b8fec21
blue-team-tools/rules/windows/powershell/powershell_classic
T
History
Vasiliy Burov 92fd446b7d Merge PR #4859 from @vburov - Update casing of Win32_ShadowCopy for multiple rules 
chore: update casing of `Win32_ShadowCopy` for multiple rules

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
2024-05-27 14:33:46 +02:00
..
posh_pc_abuse_nslookup_with_dns_records.yml
Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field
2023-10-28 12:43:58 +02:00
posh_pc_delete_volume_shadow_copies.yml
Merge PR #4859 from @vburov - Update casing of Win32_ShadowCopy for multiple rules
2024-05-27 14:33:46 +02:00
posh_pc_downgrade_attack.yml
Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field
2023-10-28 12:43:58 +02:00
posh_pc_exe_calling_ps.yml
Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field
2023-10-28 12:43:58 +02:00
posh_pc_powercat.yml
Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field
2023-10-28 12:43:58 +02:00
posh_pc_remote_powershell_session.yml
Merge PR #4659 from @nasbench - Reduce Remote PowerShell Session (PS Classic) Level
2024-01-03 23:30:21 +01:00
posh_pc_remotefxvgpudisablement_abuse.yml
feat: new rules, updates and goofy guineapig stuff (#4229)
2023-05-15 15:53:39 +02:00
posh_pc_renamed_powershell.yml
Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field
2023-10-28 12:43:58 +02:00
posh_pc_susp_download.yml
Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field
2023-10-28 12:43:58 +02:00
posh_pc_susp_get_nettcpconnection.yml
Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field
2023-10-28 12:43:58 +02:00
posh_pc_susp_zip_compress.yml
Merge PR #4631 from @nasbench - add rules related to CISA aa23-347a advisory and other updates
2023-12-18 16:46:46 +01:00
posh_pc_tamper_windows_defender_set_mp.yml
Merge PR #4663 from @slincoln-aiq - Update Disable Windows Defender Features Rules
2024-01-10 19:24:20 +01:00
posh_pc_wsman_com_provider_no_powershell.yml
Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field
2023-10-28 12:43:58 +02:00
posh_pc_xor_commandline.yml
Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field
2023-10-28 12:43:58 +02:00