blue-team-tools

Files

T

tr0mb1r 4faa757e3c ClickOnce rule added

Unsigned Module Loaded by ClickOnce Application added, based on the article:
https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5

2023-06-08 09:24:42 +04:00

application

remove duplicate reference urls

2023-04-18 11:03:07 -04:00

category

feat: map antivirus categoriy to Windows Defender logs

2023-05-19 14:27:56 +02:00

cloud

Update rules/cloud/okta/okta_fastpass_phishing_detection.yml

2023-05-10 01:18:00 -05:00

compliance

feat: filename test enhancements (#3812 )

2022-12-23 09:25:16 +01:00

linux

feat: new linux rules related to GobRAT malware (#4272 )

2023-06-02 15:49:43 +02:00

macos

feat: new macos rule Suspicious Browser Child Process (#4053 )

2023-04-05 14:58:09 +02:00

network

Fix logsource

2023-05-26 13:51:07 +02:00

web

chore: update rules from r-dns to cs-host

2023-05-18 23:03:23 +02:00

windows

ClickOnce rule added

2023-06-08 09:24:42 +04:00

README.md

chore: move more rules

2023-04-21 15:01:48 +02:00

README.md

TBD