blue-team-tools

proc_creation_macos_add_to_admin_group.yml

feat: new rule proc_creation_macos_add_to_admin_group.yml (#4121 )

2023-03-21 11:29:42 +01:00

proc_creation_macos_applescript.yml

Update from review

2023-02-01 18:30:45 +01:00

proc_creation_macos_base64_decode.yml

Update Title (#3731 )

2022-11-27 19:19:27 +01:00

proc_creation_macos_binary_padding.yml

fix: remove unnecessary filter

2023-02-17 21:36:54 +01:00

proc_creation_macos_change_file_time_attr.yml

feat: updates multiple mitre tech/sub-tech/tactics (#3913 )

2023-01-12 17:04:38 +01:00

proc_creation_macos_clear_system_logs.yml

Order yaml field 4 (#3628 )

2022-10-25 09:30:05 +02:00

proc_creation_macos_clipboard_data_via_osascript.yml

New Rule for T1115 macOS (#3988 )

2023-01-31 14:32:08 +01:00

proc_creation_macos_create_account.yml

Update proc_creation_macos_create_account.yml (#4052 )

2023-02-20 14:13:06 +01:00

proc_creation_macos_create_hidden_account.yml

Order yaml field 4 (#3628 )

2022-10-25 09:30:05 +02:00

proc_creation_macos_creds_from_keychain.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_macos_disable_security_tools.yml

Order yaml field 4 (#3628 )

2022-10-25 09:30:05 +02:00

proc_creation_macos_dsenableroot_enable_root_account.yml

feat: update metadata & logic

2023-08-22 14:34:20 +02:00

proc_creation_macos_file_and_directory_discovery.yml

Title modified in several rules (#3728 )

2022-11-25 15:34:38 +01:00

proc_creation_macos_find_cred_in_files.yml

Order yaml field 4 (#3628 )

2022-10-25 09:30:05 +02:00

proc_creation_macos_gui_input_capture.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

proc_creation_macos_installer_susp_child_process.yml

fix: add missing space + rename file

2023-02-21 23:29:47 +01:00

proc_creation_macos_jxa_in_memory_execution.yml

fix: filename

2023-01-31 12:53:04 +01:00

proc_creation_macos_local_account.yml

Update Title (#3733 )

2022-11-28 06:43:17 +01:00

proc_creation_macos_local_groups.yml

Update Title (#3733 )

2022-11-28 06:43:17 +01:00

proc_creation_macos_network_service_scanning.yml

Order yaml field 4 (#3628 )

2022-10-25 09:30:05 +02:00

proc_creation_macos_network_sniffing.yml

Update Title (#3731 )

2022-11-27 19:19:27 +01:00

proc_creation_macos_office_susp_child_processes.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_macos_osacompile_runonly_execution.yml

fix: add ref and update description

2023-02-01 17:23:36 +01:00

proc_creation_macos_payload_decoded_and_decrypted.yml

new rules: Sigma rules based on Elastic rules (#3632 )

2022-10-28 10:13:44 +02:00

proc_creation_macos_persistence_via_plistbuddy.yml

feat: more updates and fixes

2023-02-28 15:22:25 +01:00

proc_creation_macos_remote_system_discovery.yml

Order yaml field 4 (#3628 )

2022-10-25 09:30:05 +02:00

proc_creation_macos_schedule_task_job_cron.yml

Update Title (#3733 )

2022-11-28 06:43:17 +01:00

proc_creation_macos_screencapture.yml

Order yaml field 4 (#3628 )

2022-10-25 09:30:05 +02:00

proc_creation_macos_security_software_discovery.yml

Update Title (#3733 )

2022-11-28 06:43:17 +01:00

proc_creation_macos_space_after_filename.yml

update logsource

2023-01-04 18:52:24 +01:00

proc_creation_macos_split_file_into_pieces.yml

Order yaml field 4 (#3628 )

2022-10-25 09:30:05 +02:00

proc_creation_macos_susp_browser_child_process.yml

feat: new macos rule Suspicious Browser Child Process (#4053 )

2023-04-05 14:58:09 +02:00

proc_creation_macos_susp_execution_macos_script_editor.yml

feat: add new linux rules

2022-12-29 11:17:42 +01:00

proc_creation_macos_susp_find_execution.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_macos_susp_histfile_operations.yml

Order yaml field 4 (#3628 )

2022-10-25 09:30:05 +02:00

proc_creation_macos_susp_macos_firmware_activity.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_creation_macos_suspicious_applet_behaviour.yml

feat: new rule proc_creation_macos_suspicious_applet_behaviour.yml (#4126 )

2023-04-03 12:27:17 +02:00

proc_creation_macos_sysadminctl_enable_guest_account.yml

Create proc_creation_macos_enable_guest_account.yml (#4054 )

2023-02-20 14:13:52 +01:00

proc_creation_macos_system_network_connections_discovery.yml

feat: add new linux rules

2022-12-29 11:17:42 +01:00

proc_creation_macos_system_network_discovery.yml

fix: remove folder start

2022-12-29 11:32:37 +01:00

proc_creation_macos_system_shutdown_reboot.yml

Update Title (#3731 )

2022-11-27 19:19:27 +01:00

proc_creation_macos_wizardupdate_malware_infection.yml

new rules: Sigma rules based on Elastic rules (#3632 )

2022-10-28 10:13:44 +02:00

proc_creation_macos_xattr_gatekeeper_bypass.yml

Order yaml field 4 (#3628 )

2022-10-25 09:30:05 +02:00

proc_creation_macos_xcsset_malware_infection.yml

new rules: Sigma rules based on Elastic rules (#3632 )

2022-10-28 10:13:44 +02:00