blue-team-tools

win_anydesk_service_installation.yml

New Rules

2022-08-12 13:44:16 +01:00

win_apt_carbonpaper_turla.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_apt_chafer_mar18_system.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_apt_stonedrill.yml

fix: ServiceFileName in 7045 events

2022-03-22 14:41:25 +01:00

win_apt_turla_service_png.yml

fix: unlikely --> Unlikely

2022-03-16 14:16:10 +01:00

win_cobaltstrike_service_installs.yml

Order rules

2021-12-04 10:07:07 +01:00

win_eventlog_cleared.yml

Making a derived detection for system/application/security event logs being cleared, vs any in general. fp due to custom applications clearing their eventlog

2022-05-17 18:49:54 +00:00

win_hack_smbexec.yml

refactor condition

2022-06-03 15:35:24 +02:00

win_invoke_obfuscation_clip_services.yml

fix: Service Installation 7045 field confusion

2022-03-21 11:10:03 +01:00

win_invoke_obfuscation_obfuscated_iex_services.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

win_invoke_obfuscation_stdin_services.yml

Order rules

2021-12-04 10:07:07 +01:00

win_invoke_obfuscation_var_services.yml

Order rules

2021-12-04 10:07:07 +01:00

win_invoke_obfuscation_via_compress_services.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

win_invoke_obfuscation_via_rundll_services.yml

Refactor regex

2022-03-07 19:08:30 +01:00

win_invoke_obfuscation_via_stdin_services.yml

Order rules

2021-12-04 10:07:07 +01:00

win_invoke_obfuscation_via_use_clip_services.yml

some fixes and refactoring

2022-04-26 15:32:56 +02:00

win_invoke_obfuscation_via_use_mshta_services.yml

refactor: reduced mshta service rule

2022-07-05 16:01:46 +02:00

win_invoke_obfuscation_via_use_rundll32_services.yml

Refactor regex

2022-03-07 19:08:30 +01:00

win_invoke_obfuscation_via_var_services.yml

Order rules

2021-12-04 10:07:07 +01:00

win_krbrelayup_service_installation.yml

Update Wildcard + Int to Str fields

2022-10-05 23:15:20 +02:00

win_lpe_indicators_tabtip.yml

docs: adding comments for the params

2022-10-07 10:56:15 +02:00

win_lsasrv_ntlmv1.yml

fix: FPs with new NTLMv1 rule

2022-05-02 16:32:18 +02:00

win_mal_creddumper.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_meterpreter_or_cobaltstrike_getsystem_service_installation.yml

fix: unescaped double back slashes

2022-02-01 15:57:15 +01:00

win_moriya_rootkit.yml

fix: none --> Unknown

2022-03-16 14:19:21 +01:00

win_ntfs_vuln_exploit.yml

refactor: rule level adjustments - critical to high

2022-06-18 17:43:22 +02:00

win_pcap_drivers.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

win_possible_zerologon_exploitation_using_wellknown_tools.yml

String 2 Int for EventIDs

2022-04-26 15:12:42 +02:00

win_powershell_script_installed_as_service.yml

refactor condition

2022-06-03 15:35:24 +02:00

win_quarkspwdump_clearing_hive_access_history.yml

refactor: proposed changes from issue #2917

2022-04-14 16:57:30 +02:00

win_rare_service_installs.yml

fix: Service Installation 7045 field confusion

2022-03-21 11:10:03 +01:00

win_rdp_potential_cve_2019_0708.yml

fix: FPs noticed with Aurora

2022-02-21 18:43:18 +01:00

win_service_hacktools.yml

fix: Service Installation 7045 field confusion

2022-03-21 11:10:03 +01:00

win_service_install_pdqdeploy_runner.yml

Update win_service_install_pdqdeploy_runner.yml

2022-08-29 07:31:18 +02:00

win_service_install_pdqdeploy.yml

PDQDeploy Rules

2022-07-22 23:52:34 +01:00

win_service_install_susp_double_ampersand.yml

rule: new services with two ampersands

2022-07-05 16:02:06 +02:00

win_sliver_service_installs.yml

refactor: removed unfitting tags

2022-08-26 20:53:54 +02:00

win_susp_dhcp_config_failed.yml

refactor: rule level adjustments - critical to high

2022-06-18 17:43:22 +02:00

win_susp_dhcp_config.yml

refactor: rule level adjustments - critical to high

2022-06-18 17:43:22 +02:00

win_susp_proceshacker.yml

Order rules

2021-12-04 10:07:07 +01:00

win_susp_rtcore64_service_install.yml

Updates+New Rules

2022-08-31 09:39:16 +02:00

win_susp_sam_dump.yml

refactor: proposed changes from issue #2917

2022-04-14 16:57:30 +02:00

win_susp_service_installation_folder_pattern.yml

add modified and date

2022-03-24 15:57:47 -04:00

win_susp_service_installation_folder.yml

new susp service installation rules

2022-03-18 16:08:40 +01:00

win_susp_service_installation_script.yml

Add '/k' option to CMD rules

2022-08-24 12:48:23 +01:00

win_susp_service_installation.yml

fix: FPs in prod environment

2022-05-02 16:44:15 +02:00

win_susp_system_update_error.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

win_susp_vuln_cve_2022_21919_or_cve_2021_34484.yml

Update win_susp_vuln_cve_2022_21919_or_cve_2021_34484.yml

2022-08-18 18:17:30 +02:00

win_system_application_sysmon_crash.yml

Update Wildcard + Int to Str fields

2022-10-05 23:15:20 +02:00

win_system_defender_disabled.yml

Update rules

2022-08-01 16:02:07 +01:00

win_system_susp_eventlog_cleared.yml

Re-adding accidently removed entry

2022-05-19 17:16:39 +00:00

win_tap_driver_installation.yml

Order rules

2021-12-04 10:07:07 +01:00

win_tool_psexec.yml

fix: Service Installation 7045 field confusion

2022-03-21 11:10:03 +01:00

win_volume_shadow_copy_mount.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

win_vul_cve_2020_1472.yml

Order rules

2021-12-04 10:07:07 +01:00

win_vul_cve_2021_42278_or_cve_2021_42287.yml

docs: removed tracking info from reference link

2021-12-27 11:52:16 +01:00