security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
889efd1663f0781e110f32e8e81e88a311e6c500
blue-team-tools/rules/windows/registry/registry_set
T
History
Josh 9bde39e17d Merge PR #4668 from @joshnck - Remove SOFTWARE registry key prefix 
update: Potential Persistence Via MyComputer Registry Keys - Remove `SOFTWARE` registry key anchor to increase coverage for `WOW6432Node` cases

---------

Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
2024-01-11 12:04:04 +01:00
..
registry_set_add_load_service_in_safe_mode.yml
Merge PR #4524 from @wagga40 - Fix Typos In Metadata Fields
2023-10-28 13:15:09 +02:00
registry_set_add_port_monitor.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_aedebug_persistence.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_allow_rdp_remote_assistance_feature.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_amsi_com_hijack.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_asep_reg_keys_modification_classes.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_asep_reg_keys_modification_common.yml
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18 11:53:44 +02:00
registry_set_asep_reg_keys_modification_currentcontrolset.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_asep_reg_keys_modification_currentversion_nt.yml
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18 11:53:44 +02:00
registry_set_asep_reg_keys_modification_currentversion.yml
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18 11:53:44 +02:00
registry_set_asep_reg_keys_modification_internet_explorer.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_asep_reg_keys_modification_office.yml
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18 11:53:44 +02:00
registry_set_asep_reg_keys_modification_session_manager.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_asep_reg_keys_modification_system_scripts.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_asep_reg_keys_modification_winsock2.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_asep_reg_keys_modification_wow6432node_classes.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_asep_reg_keys_modification_wow6432node.yml
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18 11:53:44 +02:00
registry_set_bginfo_custom_db.yml
fix: apply suggestions from code review
2023-08-18 15:15:26 +02:00
registry_set_bginfo_custom_vbscript.yml
fix: apply suggestions from code review
2023-08-18 15:15:26 +02:00
registry_set_bginfo_custom_wmi_query.yml
fix: apply suggestions from code review
2023-08-18 15:15:26 +02:00
registry_set_blackbyte_ransomware.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_bypass_uac_using_delegateexecute.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_bypass_uac_using_eventviewer.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_bypass_uac_using_silentcleanup_task.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_change_rdp_port.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_change_security_zones.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_change_sysmon_driver_altitude.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_change_winevt_channelaccess.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_chrome_extension.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_clickonce_trust_prompt.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_cobaltstrike_service_installs.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_comhijack_sdclt.yml
Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements
2023-10-04 19:06:57 +02:00
registry_set_crashdump_disabled.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_creation_service_susp_folder.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_creation_service_uncommon_folder.yml
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18 11:53:44 +02:00
registry_set_custom_file_open_handler_powershell_execution.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_cve_2020_1048_new_printer_port.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_cve_2022_30190_msdt_follina.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_dbgmanageddebugger_persistence.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_defender_exclusions.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_desktop_background_change.yml
Merge PR #4633 from @slincoln-aiq - New Rules Related To Desktop Background Change
2023-12-21 11:44:52 +01:00
registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.yml
Merge PR #4662 from @nasbench - Updated and added new rules
2024-01-10 20:14:20 +01:00
registry_set_dhcp_calloutdll.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disable_administrative_share.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disable_autologger_sessions.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disable_defender_firewall.yml
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18 11:53:44 +02:00
registry_set_disable_function_user.yml
Merge PR #4568 from @CrimpSec - Adding two registry modifications detections
2023-11-20 13:19:09 +01:00
registry_set_disable_macroruntimescanscope.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disable_privacy_settings_experience.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disable_security_center_notifications.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disable_system_restore.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disable_uac_registry.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disable_windows_defender_service.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disable_windows_firewall.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disable_winevt_logging.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disabled_exploit_guard_net_protection_on_ms_defender.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disabled_microsoft_defender_eventlog.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disabled_pua_protection_on_microsoft_defender.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disabled_tamper_protection_on_microsoft_defender.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disallowrun_execution.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_disk_cleanup_handler_autorun_persistence.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_dns_over_https_enabled.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_dns_server_level_plugin_dll.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_dot_net_etw_tamper.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_enabling_cor_profiler_env_variables.yml
Merge PR #4594 from @bohops - updating cor profiler rule
2023-11-27 08:53:45 +01:00
registry_set_enabling_turnoffcheck.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_evtx_file_key_tamper.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_exploit_guard_susp_allowed_apps.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_fax_change_service_user.yml
Merge PR #4533 from @nasbench - Promote experimental rules
2023-11-02 10:48:45 +01:00
registry_set_fax_dll_persistance.yml
Merge PR #4533 from @nasbench - Promote experimental rules
2023-11-02 10:48:45 +01:00
registry_set_file_association_exefile.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_hangs_debugger_persistence.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_hhctrl_persistence.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_hidden_extention.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_hide_file.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_hide_function_user.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_hide_scheduled_task_via_index_tamper.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_ie_security_zone_protocol_defaults_downgrade.yml
Merge PR #4406 from @nasbench - Multiple Updates & Additions
2023-09-07 11:42:15 +02:00
registry_set_ime_non_default_extension.yml
Merge PR #4586 from @X-Junior - suspicious WUSA and IME registry keys
2023-11-28 14:33:15 +01:00
registry_set_ime_suspicious_paths.yml
Merge PR #4586 from @X-Junior - suspicious WUSA and IME registry keys
2023-11-28 14:33:15 +01:00
registry_set_install_root_or_ca_certificat.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_internet_explorer_disable_first_run_customize.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_legalnotice_susp_message.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_lolbin_onedrivestandaloneupdater.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_lsa_disablerestrictedadmin.yml
Merge PR #4631 from @nasbench - add rules related to CISA aa23-347a advisory and other updates
2023-12-18 16:46:46 +01:00
registry_set_lsass_usermode_dumping.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_mal_adwind.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_mal_blue_mockingbird.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_net_cli_ngenassemblyusagelog.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_netsh_help_dll_persistence_susp_location.yml
Merge PR #4602 from @nasbench - Update Netsh DLL Helper Abuse Rules
2023-11-28 16:24:00 +01:00
registry_set_netsh_helper_dll_potential_persistence.yml
Merge PR #4602 from @nasbench - Update Netsh DLL Helper Abuse Rules
2023-11-28 16:24:00 +01:00
registry_set_new_application_appcompat.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_new_network_provider.yml
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18 11:53:44 +02:00
registry_set_odbc_driver_registered_susp.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_odbc_driver_registered.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_office_access_vbom_tamper.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_office_disable_protected_view_features.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_office_enable_dde.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_office_outlook_enable_load_macro_provider_on_boot.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_office_outlook_enable_macro_execution.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_office_outlook_enable_unsafe_client_mail_rules.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_office_outlook_security_settings.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_office_trust_record_susp_location.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_office_trusted_location_uncommon.yml
Merge PR #4464 from @phantinuss - Update Goodlog Test
2023-09-29 14:33:55 +02:00
registry_set_office_vba_warnings_tamper.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_app_cpmpat_layer_registerapprestart.yml
Merge PR #4662 from @nasbench - Updated and added new rules
2024-01-10 20:14:20 +01:00
registry_set_persistence_app_paths.yml
Merge PR #4524 from @wagga40 - Fix Typos In Metadata Fields
2023-10-28 13:15:09 +02:00
registry_set_persistence_appx_debugger.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_autodial_dll.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_chm.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_com_hijacking_susp_locations.yml
Merge PR #4524 from @wagga40 - Fix Typos In Metadata Fields
2023-10-28 13:15:09 +02:00
registry_set_persistence_comhijack_psfactorybuffer.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_custom_protocol_handler.yml
Merge PR #4524 from @wagga40 - Fix Typos In Metadata Fields
2023-10-28 13:15:09 +02:00
registry_set_persistence_event_viewer_events_asp.yml
Update ATT&CK Techniques and Tactics (#4096)
2023-03-10 01:21:42 +01:00
registry_set_persistence_globalflags.yml
chore: remove author
2023-06-05 23:27:44 +02:00
registry_set_persistence_ie.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_ifilter.yml
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18 11:53:44 +02:00
registry_set_persistence_lsa_extension.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_mpnotify.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_mycomputer.yml
Merge PR #4668 from @joshnck - Remove SOFTWARE registry key prefix
2024-01-11 12:04:04 +01:00
registry_set_persistence_natural_language.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_office_vsto.yml
Merge PR #4400 from @phantinuss - FP with visio.exe
2023-08-28 11:23:40 +02:00
registry_set_persistence_outlook_homepage.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_outlook_todaypage.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_reflectdebugger.yml
fix: apply suggestions from code review
2023-07-24 12:35:11 +02:00
registry_set_persistence_scrobj_dll.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_search_order.yml
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18 11:53:44 +02:00
registry_set_persistence_shim_database_susp_application.yml
Merge PR #4577 from @nasbench - Multiple Fixes & Updates
2023-12-21 21:04:18 +01:00
registry_set_persistence_shim_database_uncommon_location.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_shim_database.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_typed_paths.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_persistence_xll.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_policies_associations_tamper.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_policies_attachments_tamper.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_powershell_as_service.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_powershell_enablescripts_enabled.yml
Merge PR #4488 From @ThureinOo
2023-10-18 14:08:22 +02:00
registry_set_powershell_execution_policy.yml
Merge PR #4577 from @nasbench - Multiple Fixes & Updates
2023-12-21 21:04:18 +01:00
registry_set_powershell_in_run_keys.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_powershell_logging_disabled.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_provisioning_command_abuse.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_renamed_sysinternals_eula_accepted.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_rpcrt4_etw_tamper.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_scr_file_executed_by_rundll32.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_servicedll_hijack.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_services_etw_tamper.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_set_nopolicies_user.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_sip_persistence.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_sophos_av_tamper.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_special_accounts.yml
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00
registry_set_suppress_defender_notifications.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_susp_keyboard_layout_load.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_susp_pendingfilerenameoperations.yml
Merge PR #4611 from @nasbench - Promote Older Rules Status From experimental To test
2023-12-01 12:50:36 +01:00
registry_set_susp_printer_driver.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_susp_reg_persist_explorer_run.yml
Merge PR #4577 from @nasbench - Multiple Fixes & Updates
2023-12-21 21:04:18 +01:00
registry_set_susp_run_key_img_folder.yml
Merge PR #4577 from @nasbench - Multiple Fixes & Updates
2023-12-21 21:04:18 +01:00
registry_set_susp_service_installed.yml
Refractor registry_set rules
2023-08-17 09:03:30 +02:00
registry_set_susp_user_shell_folders.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_suspicious_env_variables.yml
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18 11:53:44 +02:00
registry_set_system_lsa_nolmhash.yml
Merge PR #4631 from @nasbench - add rules related to CISA aa23-347a advisory and other updates
2023-12-18 16:46:46 +01:00
registry_set_taskcache_entry.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_telemetry_persistence.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_terminal_server_suspicious.yml
fix: resolves #4015
2023-02-07 14:33:56 +01:00
registry_set_terminal_server_tampering.yml
Merge PR #4524 from @wagga40 - Fix Typos In Metadata Fields
2023-10-28 13:15:09 +02:00
registry_set_timeproviders_dllname.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_tls_protocol_old_version_enabled.yml
Merge PR #4406 from @nasbench - Multiple Updates & Additions
2023-09-07 11:42:15 +02:00
registry_set_treatas_persistence.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_turn_on_dev_features.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_uac_bypass_eventvwr.yml
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18 11:53:44 +02:00
registry_set_uac_bypass_sdclt.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_uac_bypass_winsat.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_uac_bypass_wmp.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_vbs_payload_stored.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_wab_dllpath_reg_change.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_wdigest_enable_uselogoncredential.yml
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18 11:53:44 +02:00
registry_set_windows_defender_tamper.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_winget_admin_settings_tampering.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_winget_enable_local_manifest.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_winlogon_allow_multiple_tssessions.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00
registry_set_winlogon_notify_key.yml
Refractor registry_set rules
2023-08-17 08:57:52 +02:00