frack113 ab450e5782 Merge pull request #2458 from frack113/redcanary_20211216 ...

Windows Redcanary T1518.001 discovery

2021-12-16 22:47:23 +01:00

..

powershell_accessing_win_api.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_adrecon_execution.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_automated_collection.yml

feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*'

2021-12-02 14:47:39 +01:00

powershell_azurehound_commands.yml

Create powershell_azurehound_commands.yml

2021-10-23 18:27:36 -05:00

powershell_cl_invocation_lolscript_count.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_cl_invocation_lolscript.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_cl_mutexverifiers_lolscript_count.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_cl_mutexverifiers_lolscript.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_clearing_windows_console_history.yml

Update powershell_clearing_windows_console_history.yml

2021-11-26 09:18:37 -06:00

powershell_create_local_user.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_data_compressed.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_detect_vm_env.yml

feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*'

2021-12-02 14:47:39 +01:00

powershell_dnscat_execution.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_icmp_exfiltration.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_invoke_nightmare.yml

Add MITTRE Technique

2021-11-20 10:56:41 +01:00

powershell_invoke_obfuscation_clip_in_scriptblocktext.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_invoke_obfuscation_obfuscated_iex_in_scriptblocktext.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_invoke_obfuscation_stdin_in_scriptblocktext.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_invoke_obfuscation_var_in_scriptblocktext.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_invoke_obfuscation_via_compress_in_scriptblocktext.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_invoke_obfuscation_via_rundll_in_scriptblocktext.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_invoke_obfuscation_via_stdin_in_scriptblocktext.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_invoke_obfuscation_via_use_clip_in_scriptblocktext.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_invoke_obfuscation_via_use_mhsta_in_scriptblocktext.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_invoke_obfuscation_via_use_rundll32_in_scriptblocktext.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_invoke_obfuscation_via_var_in_scriptblocktext.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_keylogging.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_malicious_commandlets.yml

adding missing :

2021-12-01 23:14:57 +00:00

powershell_malicious_keywords.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_memorydump_getstoragediagnosticinfo.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_nishang_malicious_commandlets.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_ntfs_ads_access.yml

feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*'

2021-12-02 14:47:39 +01:00

powershell_powerview_malicious_commandlets.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_prompt_credentials.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_ps_file_and_directory_discovery.yml

Windows redcannary

2021-12-15 19:36:16 +01:00

powershell_ps_get_childitem_bookmarks.yml

Rename powershell_ps_get_childitem_bookmarks

2021-12-13 12:04:00 +01:00

powershell_ps_security_software_discovery.yml

fix space

2021-12-16 10:41:07 +01:00

powershell_ps_suspicious_ad_group_reco.yml

Windows redcannary

2021-12-15 19:36:16 +01:00

powershell_ps_suspicious_local_group_reco.yml

fix space

2021-12-12 12:25:05 +01:00

powershell_ps_suspicious_smb_share_reco.yml

Windows redcannary

2021-12-15 19:36:16 +01:00

powershell_psattack.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_set_policies_to_unsecure_level.yml

fix: FPs

2021-11-26 14:42:21 +01:00

powershell_shellcode_b64.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_shellintel_malicious_commandlets.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_software_discovery.yml

Fix category and EventID

2021-11-12 12:18:44 +01:00

powershell_store_file_in_alternate_data_stream.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_susp_zip_compress_in_scriptblocktext.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_suspicious_download_in_scriptblocktext.yml

cleanup list

2021-10-18 14:52:35 +02:00

powershell_suspicious_export_pfxcertificate.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_suspicious_getprocess_lsass.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_suspicious_invocation_generic_in_scriptblocktext.yml

feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*'

2021-12-02 14:47:39 +01:00

powershell_suspicious_invocation_specific_in_scripblocktext.yml

add ps_script verison

2021-10-18 14:13:29 +02:00

powershell_suspicious_keywords.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_suspicious_mail_acces.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_suspicious_mounted_share_deletion.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_suspicious_recon.yml

feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*'

2021-12-02 14:47:39 +01:00

powershell_suspicious_win32_pnpentity.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_suspicious_windowstyle.yml

add powershell_suspicious_windowstyle

2021-10-20 13:57:24 +02:00

powershell_syncappvpublishingserver_exe_in_scriptblocktext.yml

Missing status in rules (#2284)

2021-11-19 22:32:26 +01:00

powershell_timestomp.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_trigger_profiles.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_web_request.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_windows_firewall_profile_disabled.yml

Add MITTRE Technique

2021-11-20 10:56:41 +01:00

powershell_winlogon_helper_dll.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_wmi_persistence.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

powershell_wmimplant.yml

change to category: ps_script

2021-10-16 08:18:49 +02:00

win_root_certificate_installed.yml

Order rules

2021-12-04 10:07:07 +01:00