security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
89e28d65d2ee34efac05da53128fe2d596550e9a
blue-team-tools/rules/windows/powershell/powershell_script
T
History
Qasim Qlf 2c4ea3761a Update and rename posh_ps_copy_item_system32.yml to posh_ps_copy_item_system_directory.yml
2022-10-20 14:31:48 +05:00
..
posh_ps_access_to_browser_login_data.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_accessing_win_api.yml
fix: FPs noticed with THOR
2022-09-29 13:51:09 +02:00
posh_ps_add_dnsclient_rule.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
posh_ps_adrecon_execution.yml
Update posh_ps_adrecon_execution.yml
2022-09-06 17:19:46 +02:00
posh_ps_apt_silence_eda.yml
refactor: move few apt rules to categories, del 'apt' folder
2022-10-14 11:44:49 +02:00
posh_ps_as_rep_roasting.yml
changed mitre id from process to user discovery
2022-10-19 16:10:47 +02:00
posh_ps_automated_collection.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_azurehound_commands.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_capture_screenshots.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_cl_invocation_lolscript_count.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_cl_invocation_lolscript.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_cl_mutexverifiers_lolscript_count.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_cl_mutexverifiers_lolscript.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_clear_powershell_history.yml
chore: test rules: check for all modifier with single item
2022-05-11 11:06:09 +02:00
posh_ps_clearing_windows_console_history.yml
Add missing definition fields and references
2022-07-07 19:13:01 +01:00
posh_ps_cmdlet_scheduled_task.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_copy_item_system_directory.yml
Update and rename posh_ps_copy_item_system32.yml to posh_ps_copy_item_system_directory.yml
2022-10-20 14:31:48 +05:00
posh_ps_cor_profiler.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_create_local_user.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_create_volume_shadow_copy.yml
Windows Redcannary
2022-01-12 20:27:56 +01:00
posh_ps_data_compressed.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_detect_vm_env.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_directorysearcher.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_directoryservices_accountmanagement.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_disable_psreadline_command_history.yml
fix: line endings, level, description, fp
2022-08-25 08:45:39 +02:00
posh_ps_disable_windowsoptionalfeature.yml
Update posh_ps_disable_windowsoptionalfeature.yml
2022-09-11 19:29:15 +02:00
posh_ps_dnscat_execution.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_dump_password_windows_credential_manager.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_enable_psremoting.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_enable_windowsoptionalfeature.yml
Add posh_ps_enable_windowsoptionalfeature
2022-09-11 19:43:54 +02:00
posh_ps_enumerate_password_windows_credential_manager.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_etw_trace_evasion.yml
Fix Error
2022-06-28 22:40:42 +01:00
posh_ps_file_and_directory_discovery.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_get_acl_service.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_get_adreplaccount.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_get_childitem_bookmarks.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_hotfix_enum.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_icmp_exfiltration.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_import_module_susp_dirs.yml
refactor: some changes
2022-07-11 19:55:54 +02:00
posh_ps_invoke_command_remote.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_invoke_dnsexfiltration.yml
Update posh_ps_invoke_dnsexfiltration.yml
2022-08-29 07:44:46 +02:00
posh_ps_invoke_nightmare.yml
Fix typo and Update Rule
2022-06-01 15:54:40 +01:00
posh_ps_invoke_obfuscation_clip.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_obfuscation_obfuscated_iex.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_invoke_obfuscation_stdin.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_obfuscation_var.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_obfuscation_via_compress.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
posh_ps_invoke_obfuscation_via_rundll.yml
Refactor regex
2022-03-08 19:07:37 +01:00
posh_ps_invoke_obfuscation_via_stdin.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_obfuscation_via_use_clip.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_obfuscation_via_use_mhsta.yml
Refactor regex
2022-03-07 19:08:30 +01:00
posh_ps_invoke_obfuscation_via_use_rundll32.yml
Refactor regex
2022-03-08 19:07:37 +01:00
posh_ps_invoke_obfuscation_via_var.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_keylogging.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_localuser.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_malicious_commandlets.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_malicious_keywords.yml
Add missing definition fields and references
2022-07-07 19:13:01 +01:00
posh_ps_memorydump_getstoragediagnosticinfo.yml
refactor condition
2022-06-03 15:35:24 +02:00
posh_ps_modify_group_policy_settings.yml
Add t1484.001
2022-08-19 19:12:40 +02:00
posh_ps_msxml_com.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_nishang_malicious_commandlets.yml
Update posh_ps_nishang_malicious_commandlets.yml
2022-08-29 18:53:22 +02:00
posh_ps_ntfs_ads_access.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_office_comobject_registerxll.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_potential_invoke_mimikatz.yml
New Rules: transformed elastic to sigma rules
2022-09-28 16:45:22 +02:00
posh_ps_powerview_malicious_commandlets.yml
Add %tmp% env variable
2022-09-13 10:49:14 +02:00
posh_ps_prompt_credentials.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_psasyncshell.yml
Create posh_ps_psasyncshell.yml
2022-10-04 20:57:15 +02:00
posh_ps_psattack.yml
fix: remove penetration test as valid false positive reason
2022-03-16 14:33:18 +01:00
posh_ps_remote_session_creation.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_remove_item_path.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_request_kerberos_ticket.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_root_certificate_installed.yml
Big Update
2022-09-09 15:02:31 +02:00
posh_ps_run_from_mount_diskimage.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_security_software_discovery.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_send_mailmessage.yml
fix: FPs with Azure hosts
2022-09-26 23:52:48 +02:00
posh_ps_sensitive_file_discovery.yml
fix pass
2022-09-16 20:04:55 +02:00
posh_ps_set_policies_to_unsecure_level.yml
fix: fixing multiple FPs with the use of VSCode
2022-09-10 11:42:44 +02:00
posh_ps_shellcode_b64.yml
refactor: rule level adjustments - critical to high
2022-06-18 17:43:22 +02:00
posh_ps_shellintel_malicious_commandlets.yml
Fix typo and Update Rule
2022-06-01 15:54:40 +01:00
posh_ps_software_discovery.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_store_file_in_alternate_data_stream.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_ad_group_reco.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_clear_eventlog.yml
Create posh_ps_susp_clear_eventlog.yml
2022-09-13 10:02:36 +02:00
posh_ps_susp_directory_enum.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_download.yml
Add missing definition fields and references
2022-07-07 19:13:01 +01:00
posh_ps_susp_execute_batch_script.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_export_pfxcertificate.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
posh_ps_susp_extracting.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_follina_execution.yml
New Rule (https://twitter.com/nas_bench/status/1537919885031772161)
2022-06-21 19:13:53 +01:00
posh_ps_susp_get_adcomputer.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_get_addefaultdomainpasswordpolicy.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_get_adgroup.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_get_current_user.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_get_gpo.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_get_process.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_getprocess_lsass.yml
refactor condition
2022-06-03 15:35:24 +02:00
posh_ps_susp_gettypefromclsid.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_gwmi.yml
Renamed suspicious in filenames to susp
2022-05-19 09:37:04 +02:00
posh_ps_susp_hyper_v_condlet.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_invocation_generic.yml
Add missing definition fields and references
2022-07-07 19:13:01 +01:00
posh_ps_susp_invocation_specific.yml
Renamed suspicious in filenames to susp
2022-05-19 09:37:04 +02:00
posh_ps_susp_invoke_webrequest_useragent.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_iofilestream.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_keywords.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_local_group_reco.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_mail_acces.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_mount_diskimage.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_mounted_share_deletion.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_networkcredential.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_new_psdrive.yml
Update backslash
2022-08-13 09:59:31 +02:00
posh_ps_susp_proxy_scripts.yml
New Rules
2022-07-11 10:22:45 +01:00
posh_ps_susp_recon_export.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_remove_adgroupmember.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_smb_share_reco.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_ssl_keyword.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_start_process.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_unblock_file.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_wallpaper.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_win32_pnpentity.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_win32_shadowcopy_deletion.yml
New Rules: transformed elastic to sigma rules
2022-09-28 16:45:22 +02:00
posh_ps_susp_win32_shadowcopy.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_windowstyle.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_susp_write_eventlog.yml
Update posh_ps_susp_write_eventlog.yml
2022-08-29 07:39:53 +02:00
posh_ps_susp_zip_compress.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_syncappvpublishingserver_exe.yml
Add missing definition fields and references
2022-07-07 19:13:01 +01:00
posh_ps_tamper_defender_remove_mppreference.yml
Update posh_ps_tamper_defender_remove_mppreference.yml
2022-08-05 18:45:44 +01:00
posh_ps_tamper_defender.yml
Update PowerShell + other rules
2022-08-05 17:10:41 +01:00
posh_ps_test_netconnection.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_timestomp.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_trigger_profiles.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_upload.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_using_set_service_to_hide_services.yml
Update posh_ps_using_set_service_to_hide_services.yml
2022-10-18 20:13:45 +02:00
posh_ps_web_request.yml
fix: condition
2022-09-27 10:30:34 +02:00
posh_ps_win32_product_install_msi.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_win_defender_exclusions_added.yml
fix: fixed rules after review
2022-10-04 10:06:15 +02:00
posh_ps_windows_firewall_profile_disabled.yml
Updated rule 488b44e7-3781-4a71-888d-c95abfacf44d
2022-10-11 12:39:40 +02:00
posh_ps_winlogon_helper_dll.yml
Update selections and indentation
2022-07-07 20:13:45 +01:00
posh_ps_wmi_persistence.yml
Update Ref+Selection
2022-07-11 14:11:53 +01:00
posh_ps_wmi_unquoted_service_search.yml
Update posh_ps_wmi_unquoted_service_search.yml
2022-10-14 00:51:21 +02:00
posh_ps_wmimplant.yml
Add missing definition fields and references
2022-07-07 19:13:01 +01:00
posh_ps_xml_iex.yml
Add missing definition fields and references
2022-07-07 19:13:01 +01:00