frack113 691dca6fd2 Merge PR #4808 from @frack113 - FP Bad practice GPO ...

fix: Windows Binaries Write Suspicious Extensions - Add new filter for when "bat" or "powershell" scripts are written via GPO to run at startup.

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

2024-04-15 13:43:35 +02:00

..

file_event_win_access_susp_teams.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_access_susp_unattend_xml.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

file_event_win_adsi_cache_creation_by_uncommon_tool.yml

Merge PR #4491 from @nasbench - Rule Updates & Fixes

2023-10-23 10:35:57 +02:00

file_event_win_advanced_ip_scanner.yml

Update Title (#3739)

2022-11-30 11:44:15 +01:00

file_event_win_anydesk_artefact.yml

change status to test

2023-01-27 06:48:34 +01:00

file_event_win_anydesk_writing_susp_binaries.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_aspnet_temp_files.yml

fix: apply suggestions from code review

2023-08-18 15:15:26 +02:00

file_event_win_bloodhound_collection.yml

Merge PR #4700 from @nasbench - Promote older rules status from experimental to test

2024-02-01 02:09:31 +01:00

file_event_win_create_evtx_non_common_locations.yml

Merge PR #4774 from @nasbench - Fix and update multiple rules

2024-03-26 19:09:21 +01:00

file_event_win_create_non_existent_dlls.yml

Merge PR #4662 from @nasbench - Updated and added new rules

2024-01-10 20:14:20 +01:00

file_event_win_creation_new_shim_database.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

file_event_win_creation_scr_binary_file.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_creation_system_file.yml

Merge PR #4774 from @nasbench - Fix and update multiple rules

2024-03-26 19:09:21 +01:00

file_event_win_creation_unquoted_service_path.yml

change status to test

2023-01-27 06:48:34 +01:00

file_event_win_cred_dump_tools_dropped_files.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

file_event_win_cscript_wscript_dropper.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_csexec_service.yml

feat: rules update

2023-08-07 16:09:21 +02:00

file_event_win_csharp_compile_artefact.yml

fix: add missing modified

2023-02-17 22:52:09 +01:00

file_event_win_dcom_iertutil_dll_hijack.yml

Refractor (#3794)

2022-12-18 21:00:14 +01:00

file_event_win_dll_sideloading_space_path.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_dump_file_susp_creation.yml

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

file_event_win_errorhandler_persistence.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_exchange_webshell_drop_suspicious.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_exchange_webshell_drop.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_gotoopener_artefact.yml

change status to test

2023-01-27 06:48:34 +01:00

file_event_win_hktl_crackmapexec_indicators.yml

Merge PR #4762 from @nasbench - Fix false positives found in testing

2024-03-11 16:58:55 +01:00

file_event_win_hktl_dumpert.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file_event_win_hktl_hivenightmare_file_exports.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

file_event_win_hktl_inveigh_artefacts.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_hktl_mimikatz_files.yml

feat: updates and fixes

2023-02-17 17:51:44 +01:00

file_event_win_hktl_nppspy.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_hktl_powerup_dllhijacking.yml

feat: updates and fixes

2023-02-17 17:51:44 +01:00

file_event_win_hktl_quarkspw_filedump.yml

feat: updates and fixes

2023-02-17 17:51:44 +01:00

file_event_win_hktl_remote_cred_dump.yml

Merge PR #4533 from @nasbench - Promote experimental rules

2023-11-02 10:48:45 +01:00

file_event_win_hktl_safetykatz.yml

feat: updates and fixes

2023-02-17 17:51:44 +01:00

file_event_win_initial_access_dll_search_order_hijacking.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

file_event_win_install_teamviewer_desktop.yml

change status to test

2023-01-27 06:48:34 +01:00

file_event_win_iphlpapi_dll_sideloading.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_iso_file_mount.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_iso_file_recent.yml

Merge PR #4392 from @tjgeorgen - Update MITRE Tags

2023-08-28 16:53:27 +02:00

file_event_win_lolbin_gather_network_info_script_output.yml

Merge PR #4727 from @frack113 - Refactor the condition field to align with the standard

2024-02-26 21:51:24 +01:00

file_event_win_lsass_default_dump_file_names.yml

Merge PR #4443 from @Neo23x0 - Fix Null Edge Case & Add New String

2023-09-13 20:50:09 +02:00

file_event_win_lsass_shtinkering.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_lsass_werfault_dump.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_mal_adwind.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

file_event_win_mal_octopus_scanner.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_msdt_susp_directories.yml

chore: promote older rules status from experimental to test (#4651)

2024-01-01 09:00:51 +01:00

file_event_win_net_cli_artefact.yml

chore: promote older rules status from experimental to test (#4651)

2024-01-01 09:00:51 +01:00

file_event_win_new_files_in_uncommon_appdata_folder.yml

chore: promote older rules status from experimental to test (#4651)

2024-01-01 09:00:51 +01:00

file_event_win_new_scr_file.yml

Merge PR #4447 from @Uglybeard - Fix Typo In File Name

2023-09-18 15:00:18 +02:00

file_event_win_notepad_plus_plus_persistence.yml

Merge PR #4533 from @nasbench - Promote experimental rules

2023-11-02 10:48:45 +01:00

file_event_win_ntds_dit_creation.yml

Merge PR #4745 from @nasbench - Promote older rules status from experimental to test

2024-03-01 15:38:35 +01:00

file_event_win_ntds_dit_uncommon_parent_process.yml

fix: apply suggestions from code review

2023-05-09 16:04:24 +02:00

file_event_win_ntds_dit_uncommon_process.yml

feat: more updates

2023-05-05 17:52:47 +02:00

file_event_win_ntds_exfil_tools.yml

feat: more updates

2023-05-05 17:52:47 +02:00

file_event_win_office_addin_persistence.yml

feat: updates and fixes

2023-02-23 12:49:44 +01:00

file_event_win_office_macro_files_created.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_office_macro_files_downloaded.yml

Merge PR #4745 from @nasbench - Promote older rules status from experimental to test

2024-03-01 15:38:35 +01:00

file_event_win_office_macro_files_from_susp_process.yml

chore: promote older rules status from experimental to test (#4651)

2024-01-01 09:00:51 +01:00

file_event_win_office_onenote_files_in_susp_locations.yml

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

file_event_win_office_onenote_susp_dropped_files.yml

chore: promote older rules status from experimental to test (#4651)

2024-01-01 09:00:51 +01:00

file_event_win_office_outlook_macro_creation.yml

fix: duplicate ids and small updates

2023-02-08 19:36:55 +01:00

file_event_win_office_outlook_newform.yml

chore: promote older rules status from experimental to test (#4651)

2024-01-01 09:00:51 +01:00

file_event_win_office_outlook_susp_macro_creation.yml

fix: duplicate ids and small updates

2023-02-08 19:36:55 +01:00

file_event_win_office_publisher_files_in_susp_locations.yml

chore: promote older rules status from experimental to test (#4651)

2024-01-01 09:00:51 +01:00

file_event_win_office_startup_persistence.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

file_event_win_office_susp_file_extension.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

file_event_win_office_uncommon_file_startup.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

file_event_win_pcre_net_temp_file.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_perflogs_susp_files.yml

Merge PR #4745 from @nasbench - Promote older rules status from experimental to test

2024-03-01 15:38:35 +01:00

file_event_win_powershell_drop_binary_or_script.yml

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

file_event_win_powershell_drop_powershell.yml

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

file_event_win_powershell_exploit_scripts.yml

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00

file_event_win_powershell_module_creation.yml

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

file_event_win_powershell_module_susp_creation.yml

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

file_event_win_powershell_module_uncommon_creation.yml

Merge PR #4491 from @nasbench - Rule Updates & Fixes

2023-10-23 10:35:57 +02:00

file_event_win_powershell_startup_shortcuts.yml

chore: promote older rules status from experimental to test (#4651)

2024-01-01 09:00:51 +01:00

file_event_win_ps_script_policy_test_creation_by_uncommon_process.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

file_event_win_rclone_config_files.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file_event_win_rdp_file_susp_creation.yml

Merge PR #4745 from @nasbench - Promote older rules status from experimental to test

2024-03-01 15:38:35 +01:00

file_event_win_redmimicry_winnti_filedrop.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_remcom_service.yml

fix: duplicate ids and missing selections

2023-08-10 11:20:34 +02:00

file_event_win_remote_access_tools_screenconnect_artefact.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

file_event_win_remote_access_tools_screenconnect_remote_file.yml

Merge PR from #4736 @RG9n - Add/Update ScreenConnect RMM Related Rules

2024-02-26 16:55:58 +01:00

file_event_win_ripzip_attack.yml

Merge PR #4533 from @nasbench - Promote experimental rules

2023-11-02 10:48:45 +01:00

file_event_win_sam_dump.yml

Merge PR #4533 from @nasbench - Promote experimental rules

2023-11-02 10:48:45 +01:00

file_event_win_sed_file_creation.yml

Merge PR #4718 from @qasimqlf - Update ATT&CK Mapping For Some Rules

2024-02-26 17:09:30 +01:00

file_event_win_shell_write_susp_directory.yml

Merge PR #4700 from @nasbench - Promote older rules status from experimental to test

2024-02-01 02:09:31 +01:00

file_event_win_shell_write_susp_files_extensions.yml

Merge PR #4808 from @frack113 - FP Bad practice GPO

2024-04-15 13:43:35 +02:00

file_event_win_startup_folder_file_write.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

file_event_win_susp_colorcpl.yml

Merge PR #4533 from @nasbench - Promote experimental rules

2023-11-02 10:48:45 +01:00

file_event_win_susp_creation_by_mobsync.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_susp_default_gpo_dir_write.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_susp_desktop_ini.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_desktop_txt.yml

change status to test

2023-01-27 06:48:34 +01:00

file_event_win_susp_desktopimgdownldr_file.yml

Merge PR #4754 from @qasimqlf - Update ATT&CK mapping for multiple rules

2024-03-06 17:33:49 +01:00

file_event_win_susp_diagcab.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_susp_double_extension.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

file_event_win_susp_exchange_aspx_write.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_susp_executable_creation.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

file_event_win_susp_get_variable.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_susp_hidden_dir_index_allocation.yml

Merge PR #4476 From @phantinuss - Fix False Positives Found In Testing

2023-10-12 12:47:45 +02:00

file_event_win_susp_homoglyph_filename.yml

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

file_event_win_susp_legitimate_app_dropping_archive.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_susp_legitimate_app_dropping_exe.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

file_event_win_susp_legitimate_app_dropping_script.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

file_event_win_susp_lnk_double_extension.yml

Merge PR #4491 from @nasbench - Rule Updates & Fixes

2023-10-23 10:35:57 +02:00

file_event_win_susp_pfx_file_creation.yml

Merge PR #4727 from @frack113 - Refactor the condition field to align with the standard

2024-02-26 21:51:24 +01:00

file_event_win_susp_powershell_profile.yml

Merge PR #4503 from @nasbench - Multiple Updates & Fixes

2023-10-28 12:55:32 +02:00

file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml

feat: general fixes

2022-11-22 01:22:36 +01:00

file_event_win_susp_recycle_bin_fake_exec.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

file_event_win_susp_spool_drivers_color_drop.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_susp_startup_folder_persistence.yml

Merge PR #4611 from @nasbench - Promote Older Rules Status From experimental To test

2023-12-01 12:50:36 +01:00

file_event_win_susp_system_interactive_powershell.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_susp_task_write.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_susp_teamviewer_remote_session.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_susp_vscode_powershell_profile.yml

Merge PR #4611 from @nasbench - Promote Older Rules Status From experimental To test

2023-12-01 12:50:36 +01:00

file_event_win_susp_windows_terminal_profile.yml

Update file_event_win_susp_windows_terminal_profile.yml

2023-07-24 10:37:56 +02:00

file_event_win_susp_winsxs_binary_creation.yml

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

file_event_win_sysinternals_livekd_default_dump_name.yml

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

file_event_win_sysinternals_livekd_driver_susp_creation.yml

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

file_event_win_sysinternals_livekd_driver.yml

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

file_event_win_sysinternals_procexp_driver_susp_creation.yml

Merge PR #4745 from @nasbench - Promote older rules status from experimental to test

2024-03-01 15:38:35 +01:00

file_event_win_sysinternals_procmon_driver_susp_creation.yml

Merge PR #4745 from @nasbench - Promote older rules status from experimental to test

2024-03-01 15:38:35 +01:00

file_event_win_sysinternals_psexec_service_key.yml

chore: promote older rules status from experimental to test (#4651)

2024-01-01 09:00:51 +01:00

file_event_win_sysinternals_psexec_service.yml

feat: rules update

2023-08-07 16:09:21 +02:00

file_event_win_system32_local_folder_privilege_escalation.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_taskmgr_lsass_dump.yml

Merge PR #4493 From @swachchhanda000

2023-10-19 18:07:12 +02:00

file_event_win_tsclient_filewrite_startup.yml

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00

file_event_win_uac_bypass_consent_comctl32.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_uac_bypass_dotnet_profiler.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_uac_bypass_eventvwr.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_uac_bypass_idiagnostic_profile.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_uac_bypass_ieinstal.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_uac_bypass_msconfig_gui.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_uac_bypass_ntfs_reparse_point.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_uac_bypass_winsat.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_uac_bypass_wmp.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_vhd_download_via_browsers.yml

feat: more updates

2023-05-05 17:52:47 +02:00

file_event_win_vscode_tunnel_remote_creation_artefacts.yml

Merge PR #4463 from @citronninja - Add New Rules Related to VsCode Tunnel Usage & Abuse

2023-10-28 12:42:55 +02:00

file_event_win_vscode_tunnel_renamed_execution.yml

Merge PR #4463 from @citronninja - Add New Rules Related to VsCode Tunnel Usage & Abuse

2023-10-28 12:42:55 +02:00

file_event_win_webshell_creation_detect.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

file_event_win_werfault_dll_hijacking.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_winrm_awl_bypass.yml

revert trigger error for new test

2023-08-15 13:24:57 +02:00

file_event_win_wmi_persistence_script_event_consumer_write.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_wmiexec_default_filename.yml

Merge PR #4700 from @nasbench - Promote older rules status from experimental to test

2024-02-01 02:09:31 +01:00

file_event_win_wmiprvse_wbemcomn_dll_hijack.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

file_event_win_wpbbin_persistence.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

file_event_win_writing_local_admin_share.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00