security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
83387d2ca9b84bf5f9bb8ab3916d28f9dda8f788
blue-team-tools/rules/linux/process_creation
T
History
Nasreddine Bencherchali 498cc55a86 Triple Cross Rules
2022-07-05 15:58:22 +01:00
..
proc_creation_lnx_at_command.yml
Mitre Update
2022-05-26 18:39:42 +02:00
proc_creation_lnx_base64_decode.yml
refactor condition
2022-06-03 15:35:24 +02:00
proc_creation_lnx_bpftrace_unsafe_option_usage.yml
chore: test rules: reactivate single value list check
2022-05-10 17:13:04 +02:00
proc_creation_lnx_cat_sudoers.yml
rule: Linux cmdline rules
2022-06-21 08:26:23 +02:00
proc_creation_lnx_clear_logs.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_clear_syslog.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_clipboard_collection.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_crypto_mining.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_cve_2022_26134_atlassian_confluence.yml
refactor: rule level adjustments - critical to high
2022-06-18 17:43:22 +02:00
proc_creation_lnx_dd_file_overwrite.yml
fix(rule): lnx_dd_file_overwrite /bin symlinks
2022-06-06 09:27:27 -05:00
proc_creation_lnx_doas_execution.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_file_and_directory_discovery.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_file_deletion.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_install_root_certificate.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_local_account.yml
chore: test rules: reactivate single value list check
2022-05-10 17:13:04 +02:00
proc_creation_lnx_local_groups.yml
chore: test rules: reactivate single value list check
2022-05-10 17:13:04 +02:00
proc_creation_lnx_network_service_scanning.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_nohup.yml
Update proc_creation_lnx_nohup.yml
2022-06-07 10:35:08 +02:00
proc_creation_lnx_omigod_scx_runasprovider_executescript.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_process_discovery.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_python_pty_spawn.yml
fix: avoid regex, not actually needed
2022-06-03 14:55:09 +02:00
proc_creation_lnx_remote_system_discovery.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_schedule_task_job_cron.yml
chore: test rules: reactivate single value list check
2022-05-10 17:13:04 +02:00
proc_creation_lnx_security_software_discovery.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_security_tools_disabling.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_susp_chmod_directories.yml
Create proc_creation_lnx_susp_chmod_directories.yml
2022-06-03 19:24:02 -04:00
proc_creation_lnx_susp_history_delete.yml
fix: missing upper tick
2022-06-22 07:07:38 +02:00
proc_creation_lnx_susp_history_recon.yml
Update proc_creation_lnx_susp_history_recon.yml
2022-06-22 07:05:03 +02:00
proc_creation_lnx_susp_interactive_bash.yml
rules: suspicious linux patterns
2022-03-14 12:01:52 +01:00
proc_creation_lnx_susp_java_children.yml
Quick Update
2022-06-03 08:31:53 +01:00
proc_creation_lnx_susp_pipe_shell.yml
rules: suspicious linux patterns
2022-03-14 12:01:52 +01:00
proc_creation_lnx_susp_recon_indicators.yml
fix: two rules
2022-06-21 17:45:50 +02:00
proc_creation_lnx_system_info_discovery.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_system_network_connections_discovery.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_system_network_discovery.yml
Normalization of rule names
2022-02-22 11:16:31 +01:00
proc_creation_lnx_triple_cross_rootkit_execve_hijack.yml
Triple Cross Rules
2022-07-05 15:58:22 +01:00
proc_creation_lnx_triple_cross_rootkit_install.yml
Triple Cross Rules
2022-07-05 15:58:22 +01:00
proc_creation_lnx_webshell_detection.yml
chore: reduce rule level
2022-06-03 12:17:33 +02:00