security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
6efbdfa9e7b41844dbdad0e4413de2e9878bdfd2
blue-team-tools/rules/windows/registry/registry_set
T
History
frack113 6efbdfa9e7 Channel disable during installation
2022-07-04 17:17:32 +02:00
..
registry_set_abusing_windows_telemetry_for_persistence.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_add_load_service_in_safe_mode.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_add_port_monitor.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_asep_reg_keys_modification_classes.yml
fix: Aurora FPs / NVidia driver update
2022-06-04 12:44:51 +02:00
registry_set_asep_reg_keys_modification_common.yml
fix: FPs from fresh Windows install
2022-04-06 16:09:53 +02:00
registry_set_asep_reg_keys_modification_currentcontrolset.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_asep_reg_keys_modification_currentversion_nt.yml
fix: FPs noticed with Aurora
2022-04-28 20:40:19 +02:00
registry_set_asep_reg_keys_modification_currentversion.yml
fix: FPs in testing environment
2022-06-27 08:47:27 +02:00
registry_set_asep_reg_keys_modification_internet_explorer.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_asep_reg_keys_modification_office.yml
fix: FP with AVG anti virus
2022-06-13 13:30:21 +02:00
registry_set_asep_reg_keys_modification_session_manager.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_asep_reg_keys_modification_system_scripts.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_asep_reg_keys_modification_winsock2.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_asep_reg_keys_modification_wow6432node_classes.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_asep_reg_keys_modification_wow6432node.yml
fix: FPs from fresh Windows install
2022-04-06 16:09:53 +02:00
registry_set_blackbyte_ransomware.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_bypass_uac_using_delegateexecute.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_bypass_uac_using_eventviewer.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_bypass_uac_using_silentcleanup_task.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_change_rdp_port.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_change_security_zones.yml
fix: FPs from fresh Windows install
2022-04-06 16:09:53 +02:00
registry_set_chrome_extension.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_cobaltstrike_service_installs.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_comhijack_sdclt.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_creation_service_susp_folder.yml
rule: service binaries in suspicious folders
2022-05-02 20:54:04 +02:00
registry_set_creation_service_temp_folder.yml
rule: service binaries in suspicious folders
2022-05-02 20:54:04 +02:00
registry_set_creation_service_uncommon_folder.yml
fix: FPs with Zoom
2022-05-05 07:54:16 +02:00
registry_set_custom_file_open_handler_powershell_execution.yml
Update registry_set_custom_file_open_handler_powershell_execution.yml
2022-06-11 10:40:04 -04:00
registry_set_cve_2020_1048_new_printer_port.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_cve_2022_30190_msdt_follina.yml
Create registry_set_cve_2022_30190_msdt_follina.yml
2022-05-31 12:07:37 +07:00
registry_set_defender_disabled.yml
doc: change titles to avoid duplicates
2022-05-04 11:30:30 +02:00
registry_set_defender_exclusions.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_defender_realtime_protection_disabled.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_dhcp_calloutdll.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_disable_administrative_share.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_disable_defender_firewall.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_disable_fonction_user.yml
Update registry_set_disable_fonction_user.yml
2022-06-03 21:58:28 +01:00
registry_set_disable_microsoft_office_security_features.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_disable_system_restore.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_disable_uac_registry.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_disable_winevt_logging.yml
Channel disable during installation
2022-07-04 17:17:32 +02:00
registry_set_disabled_exploit_guard_net_protection_on_ms_defender.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_disabled_pua_protection_on_microsoft_defender.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_disabled_tamper_protection_on_microsoft_defender.yml
fix: FPs found in win2022 domain controller baseline
2022-04-21 10:48:59 +02:00
registry_set_dns_over_https_enabled.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_enabling_cor_profiler_env_variables.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_enabling_turnoffcheck.yml
Update registry_set_enabling_turnoffcheck.yml
2022-06-15 11:49:38 -04:00
registry_set_etw_disabled.yml
refactor: rule level adjustments - critical to high
2022-06-18 17:43:22 +02:00
registry_set_file_association_exefile.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_globalflags_persistence.yml
refactor: rule level adjustments - critical to high
2022-06-18 17:43:22 +02:00
registry_set_hidden_extention.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_hide_file.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_hide_fonction_user.yml
chore: test rules: warn on errors or invalid FP reasons
2022-05-09 16:07:55 +02:00
registry_set_ie_persistence.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_install_root_or_ca_certificat.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_lolbin_onedrivestandaloneupdater.yml
Renamed LOLBIN rules + Other
2022-06-12 23:59:25 +01:00
registry_set_mal_adwind.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_mal_blue_mockingbird.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_new_application_appcompat.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_office_enable_dde.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_office_security.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_office_vsto_persistence.yml
fix: FP with AVG anti virus
2022-06-13 13:30:21 +02:00
registry_set_outlook_c2_registry_key.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_outlook_registry_todaypage.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_outlook_registry_webview.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_outlook_security.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_persistence_search_order.yml
chore: test rules: reactivate single value list check
2022-05-10 17:13:04 +02:00
registry_set_powershell_as_service.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_powershell_in_run_keys.yml
chore: test rules: warn on errors or invalid FP reasons
2022-05-09 16:07:55 +02:00
registry_set_powershell_logging_disabled.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_rdp_registry_modification.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_rdp_settings_hijack.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_scr_file_executed_by_rundll32.yml
fix: lowercase false positive
2022-05-12 21:56:46 +02:00
registry_set_set_nopolicies_user.yml
chore: test rules: warn on errors or invalid FP reasons
2022-05-09 16:07:55 +02:00
registry_set_set_servicedll.yml
fix: FPs found in win2022 domain controller baseline
2022-04-21 10:48:59 +02:00
registry_set_shim_databases_persistence.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_silentprocessexit.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_susp_keyboard_layout_load.yml
Renamed suspicious in filenames to susp
2022-05-19 09:37:04 +02:00
registry_set_susp_printer_driver.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_susp_reg_persist_explorer_run.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_susp_run_key_img_folder.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_susp_service_installed.yml
chore: test rules: reactivate single value list check
2022-05-10 17:13:04 +02:00
registry_set_taskcache_entry.yml
fix: FP found in testing environment
2022-05-23 16:45:27 +02:00
registry_set_telemetry_persistence.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_timeproviders_dllname.yml
Update registry_set_timeproviders_dllname.yml
2022-06-21 16:32:21 +02:00
registry_set_uac_bypass_eventvwr.yml
refactor: rule level adjustments - critical to high
2022-06-18 17:43:22 +02:00
registry_set_uac_bypass_sdclt.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_uac_bypass_winsat.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_uac_bypass_wmp.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_vbs_payload_stored.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_wab_dllpath_reg_change.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_wdigest_enable_uselogoncredential.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_winlogon_notify_key.yml
Order registry
2022-04-04 15:45:32 +02:00