security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
67cf2bc4d1ca64bab9d8d79a7588ddb26cd16725
blue-team-tools/rules/windows/builtin/security
T
History
Nasreddine Bencherchali f2643c6043 Merge pull request #3940 from mbabinski/master 
feat: add external remote service logon from public IP rule.
2023-01-31 11:04:50 +01:00
..
win_security_aadhealth_mon_agent_regkey_access.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_aadhealth_svc_agent_regkey_access.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_access_token_abuse.yml
Remove mitre url
2023-01-10 18:09:04 +01:00
win_security_account_backdoor_dcsync_rights.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_account_discovery.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_ad_object_writedac_access.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_ad_replication_non_machine_account.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_ad_user_enumeration.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_adcs_certificate_template_configuration_vulnerability_eku.yml
Promotion rules (#3821)
2022-12-27 12:29:10 +01:00
win_security_adcs_certificate_template_configuration_vulnerability.yml
Promotion rules (#3821)
2022-12-27 12:29:10 +01:00
win_security_add_remove_computer.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_admin_logon.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_admin_rdp_login.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_admin_share_access.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_alert_active_directory_user_control.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_alert_ad_user_backdoors.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_alert_enable_weak_encryption.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_alert_ruler.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_apt_chafer_mar18_security.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
win_security_apt_slingshot.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
win_security_apt_wocao.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
win_security_atsvc_task.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_camera_microphone_access.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_cobaltstrike_service_installs.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
win_security_dce_rpc_smb_spoolss_named_pipe.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_dcom_iertutil_dll_hijack.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
win_security_dcsync.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_defender_bypass.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_device_installation_blocked.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_diagtrack_eop_default_login_username.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_disable_event_logging.yml
feat: new rules and fixes (#3759)
2022-12-06 12:13:20 +01:00
win_security_dot_net_etw_tamper.yml
feat: add two new rules
2022-12-20 23:44:44 +01:00
win_security_dpapi_domain_backupkey_extraction.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_dpapi_domain_masterkey_backup_attempt.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_event_log_cleared.yml
Promotion rules (#3821)
2022-12-27 12:29:10 +01:00
win_security_exploit_cve_2021_1675_printspooler_security.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_external_device.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_global_catalog_enumeration.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_gpo_scheduledtasks.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_group_modification_logging.yml
feat: filename test enhancements (#3812)
2022-12-23 09:25:16 +01:00
win_security_hidden_user_creation.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_hybridconnectionmgr_svc_installation.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_impacket_psexec.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_impacket_secretdump.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_invoke_obfuscation_clip_services_security.yml
fix: rename links from old repo to SigmaHQ
2022-12-27 21:05:16 +01:00
win_security_invoke_obfuscation_obfuscated_iex_services_security.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
win_security_invoke_obfuscation_stdin_services_security.yml
fix: rename links from old repo to SigmaHQ
2022-12-27 21:05:16 +01:00
win_security_invoke_obfuscation_var_services_security.yml
fix: rename links from old repo to SigmaHQ
2022-12-27 21:05:16 +01:00
win_security_invoke_obfuscation_via_compress_services_security.yml
fix: rename links from old repo to SigmaHQ
2022-12-27 21:05:16 +01:00
win_security_invoke_obfuscation_via_rundll_services_security.yml
fix: rename links from old repo to SigmaHQ
2022-12-27 21:05:16 +01:00
win_security_invoke_obfuscation_via_stdin_services_security.yml
fix: rename links from old repo to SigmaHQ
2022-12-27 21:05:16 +01:00
win_security_invoke_obfuscation_via_use_clip_services_security.yml
fix: rename links from old repo to SigmaHQ
2022-12-27 21:05:16 +01:00
win_security_invoke_obfuscation_via_use_mshta_services_security.yml
fix: rename links from old repo to SigmaHQ
2022-12-27 21:05:16 +01:00
win_security_invoke_obfuscation_via_use_rundll32_services_security.yml
fix: rename links from old repo to SigmaHQ
2022-12-27 21:05:16 +01:00
win_security_invoke_obfuscation_via_var_services_security.yml
fix: rename links from old repo to SigmaHQ
2022-12-27 21:05:16 +01:00
win_security_iso_mount.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_lm_namedpipe.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_lolbas_execution_of_nltest.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_lsass_access_non_system_account.yml
fix: FPs noticed with Aurora
2022-11-13 20:26:03 +01:00
win_security_mal_creddumper.yml
Update Title (#3739)
2022-11-30 11:44:15 +01:00
win_security_mal_service_installs.yml
Add missing definition section for EID 4697
2022-10-10 10:22:46 +02:00
win_security_mal_wceaux_dll.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_metasploit_authentication.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_metasploit_or_impacket_smb_psexec_service_install.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml
Update Title (#3739)
2022-11-30 11:44:15 +01:00
win_security_net_ntlm_downgrade.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_net_share_obj_susp_desktop_ini.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_new_or_renamed_user_account_with_dollar_sign.yml
Minor Fix
2022-11-22 18:13:34 +05:00
win_security_not_allowed_rdp_access.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_overpass_the_hash.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_pass_the_hash_2.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_petitpotam_network_share.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_petitpotam_susp_tgt_request.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_possible_dc_shadow.yml
fix: rename links from old repo to SigmaHQ
2022-12-27 21:05:16 +01:00
win_security_powershell_script_installed_as_service.yml
Update Title (#3739)
2022-11-30 11:44:15 +01:00
win_security_protected_storage_service_access.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_rare_schtasks_creations.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_rdp_bluekeep_poc_scanner.yml
Promotion rules (#3821)
2022-12-27 12:29:10 +01:00
win_security_rdp_localhost_login.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_rdp_reverse_tunnel.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_register_new_logon_process_by_rubeus.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_remote_powershell_session.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_replay_attack_detected.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_sam_registry_hive_handle_request.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_samaccountname_spoofing_cve_2021_42287.yml
Promotion rules (#3821)
2022-12-27 12:29:10 +01:00
win_security_scheduled_task_deletion.yml
fix: filter fp found in testing
2023-01-20 11:39:08 +01:00
win_security_scm_database_handle_failure.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_scm_database_privileged_operation.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_scrcons_remote_wmi_scripteventconsumer.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_service_install_remote_access_software.yml
fix: exclude teamviewer fp & reduce severity
2022-12-23 20:50:38 +01:00
win_security_service_installation_by_unusal_client.yml
update logsource
2023-01-04 18:52:24 +01:00
win_security_smb_file_creation_admin_shares.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_successful_external_remote_rdp_login.yml
fix: apply suggestions from code review 2
2023-01-31 10:57:41 +01:00
win_security_successful_external_remote_smb_login.yml
fix: apply suggestions from code review 2
2023-01-31 10:57:41 +01:00
win_security_susp_add_domain_trust.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_add_sid_history.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_codeintegrity_check_failure.yml
fix: update description
2022-12-07 22:34:56 +01:00
win_security_susp_computer_name.yml
update logsource
2023-01-04 18:52:24 +01:00
win_security_susp_dsrm_password_change.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_eventlog_cleared.yml
change status to test
2023-01-27 06:48:34 +01:00
win_security_susp_failed_logon_reasons.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_susp_failed_logon_source.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
win_security_susp_failed_logons_explicit_credentials.yml
Update win_security_susp_failed_logons_explicit_credentials.yml
2023-01-28 07:53:37 +01:00
win_security_susp_failed_logons_single_process.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_failed_logons_single_source2.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
win_security_susp_failed_logons_single_source_kerberos2.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_failed_logons_single_source_kerberos3.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_failed_logons_single_source_kerberos.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_failed_logons_single_source_ntlm2.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_failed_logons_single_source_ntlm.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_failed_logons_single_source.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_failed_remote_logons_single_source.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_kerberos_manipulation.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_susp_krbrelayup.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_ldap_dataexchange.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_susp_local_anon_logon_created.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_logon_explicit_credentials.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_logon_newcredentials.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_lsass_dump_generic.yml
fix: FPs noticed with Aurora
2022-11-13 20:26:03 +01:00
win_security_susp_lsass_dump.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_multiple_files_renamed_or_deleted.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_susp_net_recon_activity.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_susp_opened_encrypted_zip_filename.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_opened_encrypted_zip_outlook.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_opened_encrypted_zip.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_susp_outbound_kerberos_connection.yml
Update Title (#3739)
2022-11-30 11:44:15 +01:00
win_security_susp_possible_shadow_credentials_added.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_susp_psexec.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_susp_raccess_sensitive_fext.yml
fix: rename links from old repo to SigmaHQ
2022-12-27 21:05:16 +01:00
win_security_susp_rc4_kerberos.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_susp_rottenpotato.yml
fix: updated targetUserName and ipAddress
2022-12-22 14:16:25 +05:00
win_security_susp_samr_pwset.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_susp_scheduled_task_creation.yml
fix: fix unused selection
2022-12-08 11:57:40 +01:00
win_security_susp_scheduled_task_delete.yml
feat: new rules and updates
2023-01-17 01:00:44 +01:00
win_security_susp_scheduled_task_update.yml
feat: new rules and fixes (#3759)
2022-12-06 12:13:20 +01:00
win_security_susp_sdelete.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_susp_time_modification.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_susp_wmi_login.yml
Rename security rules
2022-10-14 08:53:50 +02:00
win_security_svcctl_remote_service.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_syskey_registry_access.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_sysmon_channel_reference_deletion.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_tap_driver_installation.yml
Update Title (#3739)
2022-11-30 11:44:15 +01:00
win_security_teams_suspicious_objectaccess.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_transf_files_with_cred_data_via_network_shares.yml
fix: rename links from old repo to SigmaHQ
2022-12-27 21:05:16 +01:00
win_security_user_added_to_local_administrators.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.yml
Promotion rules (#3821)
2022-12-27 12:29:10 +01:00
win_security_user_creation.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_user_driver_loaded.yml
fix: filter fp found in testing
2023-01-20 11:39:08 +01:00
win_security_user_logoff.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_vssaudit_secevent_source_registration.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_wmi_persistence.yml
Update Title (#3739)
2022-11-30 11:44:15 +01:00
win_security_wmiprvse_wbemcomn_dll_hijack.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_security_workstation_was_locked.yml
feat: filename test enhancements (#3812)
2022-12-23 09:25:16 +01:00