security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
87879f69cfdfa1e759c69cda797c8dfd4c8bb2dd
blue-team-tools/rules/windows/registry/registry_set
T
History
Qasim Qlf 4938f9b44c Rename registry_set_persistance_xll.yml to registry_set_persistence_xll.yml 
Updated persistance to persistence
2023-01-30 14:33:49 +05:00
..
registry_set_add_load_service_in_safe_mode.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_add_port_monitor.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_aedebug_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_allow_rdp_remote_assistance_feature.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_amsi_com_hijack.yml
feat: updates and enhancements
2023-01-04 17:49:32 +01:00
registry_set_asep_reg_keys_modification_classes.yml
fix: fp found in testing
2023-01-18 18:41:07 +01:00
registry_set_asep_reg_keys_modification_common.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_currentcontrolset.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_currentversion_nt.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_currentversion.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_internet_explorer.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_asep_reg_keys_modification_office.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_session_manager.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_asep_reg_keys_modification_system_scripts.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_asep_reg_keys_modification_winsock2.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_asep_reg_keys_modification_wow6432node_classes.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_asep_reg_keys_modification_wow6432node.yml
fix: fp found in testing
2023-01-19 18:47:11 +01:00
registry_set_blackbyte_ransomware.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_bypass_uac_using_delegateexecute.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_bypass_uac_using_eventviewer.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_bypass_uac_using_silentcleanup_task.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_change_rdp_port.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_change_security_zones.yml
feat: updates and enhancements
2023-01-06 16:35:34 +01:00
registry_set_change_sysmon_driver_altitude.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_change_winevt_channelaccess.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_chrome_extension.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_cobaltstrike_service_installs.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_comhijack_sdclt.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_crashdump_disabled.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_creation_service_susp_folder.yml
Update rules/windows/registry/registry_set/registry_set_creation_service_susp_folder.yml
2022-12-03 09:09:51 +01:00
registry_set_creation_service_uncommon_folder.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_custom_file_open_handler_powershell_execution.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_cve_2020_1048_new_printer_port.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_cve_2021_31979_cve_2021_33771_exploits.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_cve_2022_30190_msdt_follina.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
registry_set_dbgmanageddebugger_persistence.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_defender_exclusions.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_dhcp_calloutdll.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_administrative_share.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_disable_autologger_sessions.yml
fix: small metadata fixes
2023-01-18 23:30:40 +01:00
registry_set_disable_defender_firewall.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_disable_function_user.yml
Rule Dev
2022-11-18 11:15:28 +01:00
registry_set_disable_macroruntimescanscope.yml
Apply suggestions from code review
2022-10-25 15:17:50 +02:00
registry_set_disable_microsoft_office_security_features.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_disable_privacy_settings_experience.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_security_center_notifications.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_system_restore.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_uac_registry.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_windows_defender_service.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_windows_firewall.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disable_winevt_logging.yml
fix: small metadata fixes
2023-01-18 23:30:40 +01:00
registry_set_disabled_exploit_guard_net_protection_on_ms_defender.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disabled_microsoft_defender_eventlog.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disabled_pua_protection_on_microsoft_defender.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disabled_tamper_protection_on_microsoft_defender.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disallowrun_execution.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_disk_cleanup_handler_autorun_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_dns_over_https_enabled.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_dns_serverlevelplugindll.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_dot_net_etw_tamper.yml
fix: add dword version
2022-12-09 19:44:44 +01:00
registry_set_enabling_cor_profiler_env_variables.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_enabling_turnoffcheck.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_evtx_file_key_tamper.yml
fix: update evtx tamper rules
2023-01-02 15:25:19 +01:00
registry_set_exploit_guard_susp_allowed_apps.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_fax_change_service_user.yml
Fix invalid field cast or name (#3841)
2022-12-30 11:46:21 +01:00
registry_set_fax_dll_persistance.yml
Fix invalid field cast or name (#3841)
2022-12-30 11:46:21 +01:00
registry_set_file_association_exefile.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_hangs_debugger_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_hhctrl_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_hidden_extention.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_hide_file.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_hide_function_user.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_hide_scheduled_task_via_index_tamper.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_install_root_or_ca_certificat.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_lolbin_onedrivestandaloneupdater.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_lsa_disablerestrictedadmin.yml
fix: add related metadata
2023-01-13 17:21:21 +01:00
registry_set_lsass_usermode_dumping.yml
fix: enhance rules related to Lsass-Shtinkering
2022-12-08 11:02:56 +01:00
registry_set_mal_adwind.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_mal_blue_mockingbird.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_net_cli_ngenassemblyusagelog.yml
Apply suggestions from code review
2022-11-18 15:43:08 +01:00
registry_set_new_application_appcompat.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_new_network_provider.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_office_enable_dde.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_office_security.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_outlook_c2_registry_key.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_outlook_registry_todaypage.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_outlook_registry_webview.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_outlook_security.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_persistence_app_paths.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_appx_debugger.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_autodial_dll.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_chm.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_com_hijacking_susp_locations.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_custom_protocol_handler.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_globalflags.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_ie.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_ifilter.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_lsa_extension.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_mpnotify.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_mycomputer.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_natural_language.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_office_vsto.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_scrobj_dll.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_search_order.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_shim_databases.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_persistence_typed_paths.yml
fix: some issues
2023-01-11 11:18:54 +01:00
registry_set_persistence_xll.yml
Rename registry_set_persistance_xll.yml to registry_set_persistence_xll.yml
2023-01-30 14:33:49 +05:00
registry_set_policies_associations_tamper.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_policies_attachments_tamper.yml
feat: updates and enhancements
2023-01-11 01:03:52 +01:00
registry_set_powershell_as_service.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_powershell_execution_policy.yml
fix: apply suggestions from code review
2023-01-12 10:36:13 +01:00
registry_set_powershell_in_run_keys.yml
fix: reposition selection for readability
2023-01-20 09:46:24 +01:00
registry_set_powershell_logging_disabled.yml
fix: optimize pwsh reg logging tamper rule
2023-01-21 12:28:28 +01:00
registry_set_renamed_sysinternals_eula_accepted.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_rpcrt4_etw_tamper.yml
fix: typos and errors
2022-12-09 19:15:35 +01:00
registry_set_scr_file_executed_by_rundll32.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_servicedll_hijack.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_services_etw_tamper.yml
fix: typos and errors
2022-12-09 19:15:35 +01:00
registry_set_set_nopolicies_user.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_sip_persistence.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_sophos_av_tamaper.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_special_accounts.yml
feat: updates and fixes
2023-01-26 22:42:56 +01:00
registry_set_suppress_defender_notifications.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_susp_keyboard_layout_load.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_susp_pendingfilerenameoperations.yml
Fix test errors
2023-01-27 15:09:43 +01:00
registry_set_susp_printer_driver.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_susp_reg_persist_explorer_run.yml
fix: broken single item lists
2022-12-08 16:23:58 +01:00
registry_set_susp_run_key_img_folder.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_susp_service_installed.yml
fix: fix fp found in testing
2022-12-07 02:25:52 +01:00
registry_set_susp_user_shell_folders.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_suspicious_env_variables.yml
feat: add more suspicious cases
2022-12-21 00:18:44 +01:00
registry_set_taskcache_entry.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_telemetry_persistence.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_terminal_server_suspicious.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_terminal_server_tampering.yml
Update Title (#3731)
2022-11-27 19:19:27 +01:00
registry_set_timeproviders_dllname.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_treatas_persistence.yml
fix: separate selection and add missing modified
2023-01-06 17:41:01 +01:00
registry_set_turn_on_dev_features.yml
feat: add new reg variant of dev mode
2023-01-12 15:05:53 +01:00
registry_set_uac_bypass_eventvwr.yml
Title modified in several rules (#3728)
2022-11-25 15:34:38 +01:00
registry_set_uac_bypass_sdclt.yml
refactor: rule with ??? causing issues in some backends
2022-12-01 14:02:15 +01:00
registry_set_uac_bypass_winsat.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_uac_bypass_wmp.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_vbs_payload_stored.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_wab_dllpath_reg_change.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_wdigest_enable_uselogoncredential.yml
change status to test
2023-01-27 06:48:34 +01:00
registry_set_windows_defender_tamper.yml
fix: FPs noticed in Nextron testing CI
2022-12-05 17:39:42 +01:00
registry_set_winlogon_allow_multiple_tssessions.yml
Order yaml field
2022-10-26 06:16:55 +02:00
registry_set_winlogon_notify_key.yml
change status to test
2023-01-27 06:48:34 +01:00