security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
7b90c00a4520f618eefa2f08247f8c84466f446c
blue-team-tools/deprecated/windows
T
History
Nasreddine Bencherchali e0a2d52671 Merge pull request #4218 from nasbench/fin7-rules 
feat: updates and new rules related to fin7
2023-05-09 16:14:26 +02:00
..
create_remote_thread_win_susp_remote_thread_target.yml
feat: more updates
2023-05-05 17:52:47 +02:00
file_event_win_hktl_createminidump.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
file_event_win_mimikatz_memssp_log_file.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
file_event_win_susp_clr_logs.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
image_load_side_load_advapi32.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
image_load_side_load_scm.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
image_load_susp_winword_wmidll_load.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
net_connection_win_binary_github_com.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
posh_pm_powercat.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
posh_ps_access_to_chrome_login_data.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
posh_ps_azurehound_commands.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
posh_ps_invoke_nightmare.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
powershell_suspicious_download.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
powershell_suspicious_invocation_generic.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
powershell_suspicious_invocation_specific.yml
refactor: use 1 of selection_*
2023-05-04 14:23:08 +09:00
powershell_syncappvpublishingserver_exe.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_access_win_in_memory_assembly_execution.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_apt29_thinktanks.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_dragonfly.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_gallium.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_hurricane_panda.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_lazarus_activity_apr21.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_lazarus_loader.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_muddywater_dnstunnel.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_apt_ta505_dropper.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_certutil_susp_execution.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_cmd_read_contents.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_cmd_redirect_to_stream.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_credential_acquisition_registry_hive_dumping.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_cscript_vbs.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_execution_mssql_xp_cmdshell_stored_procedure.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_indirect_cmd.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_indirect_command_execution_forfiles.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_invoke_obfuscation_via_rundll.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_invoke_obfuscation_via_use_rundll32.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_lolbas_execution_of_wuauclt.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_lolbin_rdrleakdiag.yml
fix: merge rules and update detection
2023-04-24 19:24:19 +02:00
proc_creation_win_lolbins_by_office_applications.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_mal_ryuk.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_malware_trickbot_recon_activity.yml
chore: move rules to new folders (#4205)
2023-05-02 23:17:57 +02:00
proc_creation_win_mavinject_proc_inj.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_msdt_diagcab.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_new_service_creation.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_nslookup_pwsh_download_cradle.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_office_from_proxy_executing_regsvr32_payload2.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_office_from_proxy_executing_regsvr32_payload.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_office_spawning_wmi_commandline.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_possible_applocker_bypass.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_amsi_bypass_pattern_nov22.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_base64_invoke_susp_cmdlets.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_base64_listing_shadowcopy.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_base64_shellcode.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_bitsjob.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_service_modification.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_powershell_xor_encoded_command.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_reg_dump_sam.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_renamed_paexec.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_renamed_powershell.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_renamed_psexec.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_renamed_rundll32.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_root_certificate_installed.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_run_from_zip.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_sc_delete_av_services.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_schtasks_user_temp.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_service_stop.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_susp_bitstransfer.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_susp_cmd_exectution_via_wmi.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_susp_commandline_chars.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_susp_run_folder.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_susp_squirrel_lolbin.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_sysinternals_psexec_service_execution.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_sysinternals_psexesvc_start.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_whoami_as_system.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_winword_dll_load.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_wmic_execution_via_office_process.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_wmic_remote_command.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
proc_creation_win_wmic_remote_service.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
process_creation_syncappvpublishingserver_exe.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
registry_add_sysinternals_sdelete_registry_keys.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
registry_event_asep_reg_keys_modification.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
registry_set_abusing_windows_telemetry_for_persistence.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
registry_set_add_hidden_user.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
registry_set_silentprocessexit.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
sysmon_accessing_winapi_in_powershell_credentials_dumping.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
sysmon_dcom_iertutil_dll_hijack.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
sysmon_mimikatz_detection_lsass.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
sysmon_rclone_execution.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_dsquery_domain_trust_discovery.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_lateral_movement_condrv.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_security_group_modification_logging.yml
chore: move rules to new folders (#4205)
2023-05-02 23:17:57 +02:00
win_security_lolbas_execution_of_nltest.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_susp_esentutl_activity.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_susp_rclone_exec.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00
win_susp_vssadmin_ntds_activity.yml
chore: remove contrib folder + rename folders
2023-04-23 15:42:01 +02:00