security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
76fece654a136b608ad5d628bdef3d3a656fe5be
blue-team-tools/rules/windows/builtin/system
T
History
Nasreddine Bencherchali 4b9075e557 feat: new rules related to service creation 
New service creation rules related to remote software tools
2022-11-28 12:09:00 +01:00
..
win_system_application_sysmon_crash.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_apt_carbonpaper_turla.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_apt_chafer_mar18_system.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
win_system_apt_stonedrill.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_apt_turla_service_png.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_cobaltstrike_service_installs.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
win_system_defender_disabled.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_eventlog_cleared.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_hack_smbexec.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_invoke_obfuscation_clip_services.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
win_system_invoke_obfuscation_obfuscated_iex_services.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
win_system_invoke_obfuscation_stdin_services.yml
fix: update rules to not use regex
2022-11-18 11:16:13 +01:00
win_system_invoke_obfuscation_var_services.yml
fix: update rules to not use regex
2022-11-18 11:16:13 +01:00
win_system_invoke_obfuscation_via_compress_services.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_invoke_obfuscation_via_rundll_services.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_invoke_obfuscation_via_stdin_services.yml
fix: update rules to not use regex
2022-11-18 11:16:13 +01:00
win_system_invoke_obfuscation_via_use_clip_services.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_invoke_obfuscation_via_use_mshta_services.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_invoke_obfuscation_via_use_rundll32_services.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_invoke_obfuscation_via_var_services.yml
fix: update rules to not use regex
2022-11-18 11:16:13 +01:00
win_system_kdcsvc_rc4_downgrade.yml
rule: kerberos rc4 rule
2022-11-09 09:31:31 +01:00
win_system_krbrelayup_service_installation.yml
revert: changes in krbrelay service rule
2022-11-09 09:33:37 +01:00
win_system_lpe_indicators_tabtip.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_lsasrv_ntlmv1.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_mal_creddumper.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_moriya_rootkit.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_ntfs_vuln_exploit.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_pcap_drivers.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_possible_zerologon_exploitation_using_wellknown_tools.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_powershell_script_installed_as_service.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_quarkspwdump_clearing_hive_access_history.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_rare_service_installs.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_rdp_potential_cve_2019_0708.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_service_install_anydesk.yml
feat: new rules related to service creation
2022-11-28 12:09:00 +01:00
win_system_service_install_hacktools.yml
Rename Service Install Rules
2022-10-26 23:17:02 +02:00
win_system_service_install_mesh_agent.yml
feat: new rules related to service creation
2022-11-28 12:09:00 +01:00
win_system_service_install_netsupport_manager.yml
New Rules
2022-10-31 20:59:33 +01:00
win_system_service_install_paexec.yml
Fix typo in selection
2022-10-27 00:12:58 +02:00
win_system_service_install_pdqdeploy_runner.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_service_install_pdqdeploy.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_service_install_psexec.yml
Rename Service Install Rules
2022-10-26 23:17:02 +02:00
win_system_service_install_remote_utilities.yml
New Rules
2022-10-31 20:59:33 +01:00
win_system_service_install_sliver.yml
Rename Service Install Rules
2022-10-26 23:17:02 +02:00
win_system_service_install_susp_double_ampersand.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_service_install_tacticalrmm.yml
feat: new rules related to service creation
2022-11-28 12:09:00 +01:00
win_system_susp_dhcp_config_failed.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_susp_dhcp_config.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_susp_eventlog_cleared.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_susp_proceshacker.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_susp_rtcore64_service_install.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_susp_sam_dump.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_susp_service_installation_folder_pattern.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_susp_service_installation_folder.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_susp_service_installation_script.yml
feat: add missing /r to cmd
2022-11-18 13:45:01 +01:00
win_system_susp_service_installation.yml
fix: FPs in testing environment
2022-11-14 08:54:47 +01:00
win_system_susp_system_update_error.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_susp_vuln_cve_2022_21919_or_cve_2021_34484.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_system_service_installation_by_unusal_client.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_tap_driver_installation.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_volume_shadow_copy_mount.yml
Order yaml field
2022-10-25 11:08:51 +02:00
win_system_vul_cve_2020_1472.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_vul_cve_2021_42278_or_cve_2021_42287.yml
Optimize selection
2022-10-31 20:57:48 +01:00