security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
Files
760597da11cd5cfde39b64de06efa8175e98ce7a
blue-team-tools/deprecated/windows
T
History
Fukusuke Takahashi 8ff9cd8d20 Merge PR #4958 from @fukusuket - Update unreachable/broken references 
chore: Credential Dumping Tools Accessing LSASS Memory
chore: Potential MFA Bypass Using Legacy Client Authentication
chore: Possible DC Shadow Attack
chore: Potential Privileged System Service Operation - SeLoadDriverPrivilege
chore: Remote Thread Creation In Uncommon Target Image
chore: RDP File Creation From Suspicious Application
chore: Suspicious PROCEXP152.sys File Created In TMP
chore: Outbound Network Connection Initiated By Microsoft Dialer
chore: NTFS Alternate Data Stream
chore: PowerShell Get-Process LSASS in ScriptBlock
chore: Windows Firewall Profile Disabled
chore: Potentially Suspicious GrantedAccess Flags On LSASS
chore: HackTool - PCHunter Execution
chore: Mstsc.EXE Execution With Local RDP File
chore: Suspicious Mstsc.EXE Execution With Local RDP File
chore: Mstsc.EXE Execution From Uncommon Parent
chore: PowerShell Get-Process LSASS
chore: LSASS Access From Program In Potentially Suspicious Folder
chore: Uncommon GrantedAccess Flags On LSASS 

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
Thanks: @fukusuket
2024-08-10 01:23:58 +02:00
..
create_remote_thread_win_susp_remote_thread_target.yml
feat: more updates
2023-05-05 17:52:47 +02:00
driver_load_win_mal_creddumper.yml
Merge PR #4577 from @nasbench - Multiple Fixes & Updates
2023-12-21 21:04:18 +01:00
driver_load_win_mal_poortry_driver.yml
Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements
2023-10-04 19:06:57 +02:00
driver_load_win_powershell_script_installed_as_service.yml
Merge PR #4577 from @nasbench - Multiple Fixes & Updates
2023-12-21 21:04:18 +01:00
driver_load_win_vuln_avast_anti_rootkit_driver.yml
Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements
2023-10-04 19:06:57 +02:00
driver_load_win_vuln_dell_driver.yml
Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements
2023-10-04 19:06:57 +02:00
driver_load_win_vuln_drivers_names.yml
Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements
2023-10-04 19:06:57 +02:00
driver_load_win_vuln_gigabyte_driver.yml
Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements
2023-10-04 19:06:57 +02:00
driver_load_win_vuln_hw_driver.yml
Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements
2023-10-04 19:06:57 +02:00
driver_load_win_vuln_lenovo_driver.yml
Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements
2023-10-04 19:06:57 +02:00
file_event_win_access_susp_teams.yml
Merge PR #4920 from @fornotes - Update file_access based rules
2024-07-22 18:53:48 +02:00
file_event_win_access_susp_unattend_xml.yml
Merge PR #4920 from @fornotes - Update file_access based rules
2024-07-22 18:53:48 +02:00
file_event_win_crackmapexec_patterns.yml
Merge PR #4762 from @nasbench - Fix false positives found in testing
2024-03-11 16:58:55 +01:00
file_event_win_hktl_createminidump.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
file_event_win_lsass_memory_dump_file_creation.yml
Merge PR #4406 from @nasbench - Multiple Updates & Additions
2023-09-07 11:42:15 +02:00
file_event_win_mimikatz_memssp_log_file.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
file_event_win_susp_clr_logs.yml
Merge PR #4940 from @fukusuket - Update unreachable references blog.menasec[.]net
2024-07-31 10:16:56 +02:00
image_load_alternate_powershell_hosts_moduleload.yml
feat: more updates
2023-06-01 23:22:35 +02:00
image_load_side_load_advapi32.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
image_load_side_load_scm.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
image_load_side_load_svchost_dlls.yml
Merge PR #4662 from @nasbench - Updated and added new rules
2024-01-10 20:14:20 +01:00
image_load_susp_uncommon_image_load.yml
Merge PR #4679 from @swachchhanda000 - Suspicious unsigned DLL Loaded by RunDLL32/RegSvr32
2024-01-22 11:40:10 +01:00
image_load_susp_winword_wmidll_load.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
net_connection_win_binary_github_com.yml
Merge PR #4754 from @qasimqlf - Update ATT&CK mapping for multiple rules
2024-03-06 17:33:49 +01:00
net_connection_win_reddit_api_non_browser_access.yml
Merge PR #4702 from @nasbench - Rule tuning and updates
2024-02-12 12:29:36 +01:00
net_connection_win_susp_epmap.yml
Merge PR #4762 from @nasbench - Fix false positives found in testing
2024-03-11 16:58:55 +01:00
pipe_created_psexec_pipes_artifacts.yml
feat: rules update
2023-08-07 16:09:21 +02:00
posh_pm_powercat.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
posh_ps_access_to_chrome_login_data.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
posh_ps_azurehound_commands.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
posh_ps_cl_invocation_lolscript.yml
feat: update cl diag script rules
2023-08-17 19:26:21 +02:00
posh_ps_cl_mutexverifiers_lolscript.yml
feat: update cl diag script rules
2023-08-17 19:26:21 +02:00
posh_ps_dnscat_execution.yml
Merge PR #4681 from @nasbench - Add Missing Ref & Tags
2024-01-29 13:37:20 +01:00
posh_ps_file_and_directory_discovery.yml
Merge PR #4577 from @nasbench - Multiple Fixes & Updates
2023-12-21 21:04:18 +01:00
posh_ps_invoke_nightmare.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
posh_ps_susp_gwmi.yml
Merge PR #4577 from @nasbench - Multiple Fixes & Updates
2023-12-21 21:04:18 +01:00
powershell_suspicious_download.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
powershell_suspicious_invocation_generic.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
powershell_suspicious_invocation_specific.yml
refactor: use 1 of selection_*
2023-05-04 14:23:08 +09:00
powershell_syncappvpublishingserver_exe.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_access_win_in_memory_assembly_execution.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_access_win_lazagne_cred_dump_lsass_access.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_lsass_susp_access.yml
Merge PR #4958 from @fukusuket - Update unreachable/broken references
2024-08-10 01:23:58 +02:00
proc_access_win_pypykatz_cred_dump_lsass_access.yml
Merge PR #4597 from @nasbench - Update Process Access Rules
2023-12-04 01:14:15 +01:00
proc_access_win_susp_invoke_patchingapi.yml
Merge PR #4862 from @frack113 - Add Uncommon Process Access Rights For Target Image
2024-05-27 14:23:52 +02:00
proc_creation_win_apt_apt29_thinktanks.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_dragonfly.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_gallium.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_hurricane_panda.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_lazarus_activity_apr21.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_lazarus_loader.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_muddywater_dnstunnel.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_ta505_dropper.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_certutil_susp_execution.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_cmd_read_contents.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_cmd_redirect_to_stream.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_credential_acquisition_registry_hive_dumping.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_cscript_vbs.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_execution_mssql_xp_cmdshell_stored_procedure.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_indirect_cmd.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_indirect_command_execution_forfiles.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_invoke_obfuscation_via_rundll.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_invoke_obfuscation_via_use_rundll32.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_lolbas_execution_of_wuauclt.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_lolbin_findstr.yml
Merge PR #4564 from @nasbench - Fix Further FPs Found In Testing
2023-11-15 15:35:43 +01:00
proc_creation_win_lolbin_office.yml
feat: new rules & updates (#4328)
2023-07-13 10:01:05 +02:00
proc_creation_win_lolbin_rdrleakdiag.yml
fix: merge rules and update detection
2023-04-24 19:24:19 +02:00
proc_creation_win_lolbins_by_office_applications.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_mal_ryuk.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_malware_trickbot_recon_activity.yml
chore: move rules to new folders (#4205)
2023-05-02 23:17:57 +02:00
proc_creation_win_mavinject_proc_inj.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_msdt_diagcab.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_new_service_creation.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_nslookup_pwsh_download_cradle.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_odbcconf_susp_exec.yml
feat: add/update rules related to odbcconf (#4228)
2023-05-23 14:08:56 +02:00
proc_creation_win_office_from_proxy_executing_regsvr32_payload2.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_office_from_proxy_executing_regsvr32_payload.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_office_spawning_wmi_commandline.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_possible_applocker_bypass.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_amsi_bypass_pattern_nov22.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_base64_invoke_susp_cmdlets.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_base64_listing_shadowcopy.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_base64_shellcode.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_bitsjob.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_service_modification.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_xor_encoded_command.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_reg_dump_sam.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_regsvr32_anomalies.yml
feat: update more regsvr32
2023-05-26 15:59:30 +02:00
proc_creation_win_renamed_paexec.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_renamed_powershell.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_renamed_psexec.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_renamed_rundll32.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_root_certificate_installed.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_run_from_zip.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_rundll32_js_runhtmlapplication.yml
Merge PR #4719 from @joshnck - Update Rules Related To RunHTMLApplication Abuse
2024-02-26 11:37:37 +01:00
proc_creation_win_rundll32_script_run.yml
Merge PR #4719 from @joshnck - Update Rules Related To RunHTMLApplication Abuse
2024-02-26 11:37:37 +01:00
proc_creation_win_sc_delete_av_services.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_schtasks_user_temp.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_service_stop.yml
chore: fix typo of lowercase Windows in description
2023-06-21 09:52:43 +02:00
proc_creation_win_susp_bitstransfer.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_susp_cmd_exectution_via_wmi.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_susp_commandline_chars.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_susp_lolbin_non_c_drive.yml
Merge PR #4406 from @nasbench - Multiple Updates & Additions
2023-09-07 11:42:15 +02:00
proc_creation_win_susp_run_folder.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_susp_squirrel_lolbin.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_sysinternals_psexec_service_execution.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_sysinternals_psexesvc_start.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_whoami_as_system.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_winword_dll_load.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_wmic_execution_via_office_process.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_wmic_remote_command.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_wmic_remote_service.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_wuauclt_execution.yml
Merge PR #4718 from @qasimqlf - Update ATT&CK Mapping For Some Rules
2024-02-26 17:09:30 +01:00
process_creation_syncappvpublishingserver_exe.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
registry_add_sysinternals_sdelete_registry_keys.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
registry_event_asep_reg_keys_modification.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
registry_set_abusing_windows_telemetry_for_persistence.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_add_hidden_user.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_creation_service_uncommon_folder.yml
Merge PR #4783 from @nasbench - Update registry rules logic and fix some false positives
2024-03-26 13:28:49 +01:00
registry_set_disable_microsoft_office_security_features.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_malware_adwind.yml
Merge PR #4783 from @nasbench - Update registry rules logic and fix some false positives
2024-03-26 13:28:49 +01:00
registry_set_office_security.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_com_hijacking_susp_locations.yml
Merge PR #4888 from @nasbench - Add multiple new rules, updates and fixes
2024-07-17 11:04:05 +02:00
registry_set_silentprocessexit.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
sysmon_accessing_winapi_in_powershell_credentials_dumping.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
sysmon_dcom_iertutil_dll_hijack.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
sysmon_mimikatz_detection_lsass.yml
fix:F multiple 404 links in references (#4332)
2023-06-26 10:10:04 +01:00
sysmon_powershell_execution_moduleload.yml
feat: more updates
2023-06-01 23:22:35 +02:00
sysmon_rclone_execution.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_defender_disabled.yml
Merge PR #4577 from @nasbench - Multiple Fixes & Updates
2023-12-21 21:04:18 +01:00
win_dsquery_domain_trust_discovery.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_lateral_movement_condrv.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_security_event_log_cleared.yml
Merge PR #4577 from @nasbench - Multiple Fixes & Updates
2023-12-21 21:04:18 +01:00
win_security_group_modification_logging.yml
chore: move rules to new folders (#4205)
2023-05-02 23:17:57 +02:00
win_security_lolbas_execution_of_nltest.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_susp_esentutl_activity.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_susp_rclone_exec.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_susp_vssadmin_ntds_activity.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_system_service_install_susp_double_ampersand.yml
Merge PR #4577 from @nasbench - Multiple Fixes & Updates
2023-12-21 21:04:18 +01:00
win_system_susp_sam_dump.yml
Merge PR #4681 from @nasbench - Add Missing Ref & Tags
2024-01-29 13:37:20 +01:00