Logo
Explore Help
Sign In
security-tools/blue-team-tools
1
0
Fork 0
You've already forked blue-team-tools
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
91cc97d0996552b25fca2abc38fb1e27cccf1a50
blue-team-tools/rules/windows
T
History
Bhabesh Rai cc9ac2ddcf Added rule for PowerView's malicious cmdlets
2021-05-25 21:04:32 +05:45
..
builtin
Update win_moriya_rootkit.yml
2021-05-06 15:24:21 +02:00
deprecated
fix: buggy rule
2020-05-23 18:32:02 +02:00
driver_load
att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other
2020-08-25 01:09:17 +02:00
file_event
Added rules for successful exploitation fo CVE-2021-26857/8 in Exchannge
2021-03-03 12:46:50 +05:45
image_load
Update the azure image_load rule to be a generic sysmon rule
2020-12-23 16:29:49 -05:00
malware
more AV event and suspicious commands
2021-01-07 17:54:19 +01:00
network_connection
added missing ATT&CK v6.3 IDs with comments and removed unnecessary "modified" attributes
2020-08-25 23:51:22 +00:00
other
fix reference field + add test for references in plural form
2020-11-27 10:17:45 +01:00
powershell
Added rule for PowerView's malicious cmdlets
2021-05-25 21:04:32 +05:45
process_access
Split up cmstp rule into 3 separate rules and remove duplicates
2020-12-23 12:17:39 -05:00
process_creation
Preserved creation date
2021-05-11 19:17:32 +05:45
registry_event
Added Stealthy Office Persistence via VSTO
2021-01-10 17:54:17 +05:45
sysmon
Fixed too many spaces after hyphen error
2021-05-05 12:48:29 +05:45
Powered by Gitea Version: 1.26.1 Page: 127ms Template: 9ms
Auto
English
Bahasa Indonesia Deutsch English Español Français Gaeilge Italiano Latviešu Magyar nyelv Nederlands Polski Português de Portugal Português do Brasil Suomi Svenska Türkçe Čeština Ελληνικά Български Русский Українська فارسی മലയാളം 日本語 简体中文 繁體中文(台灣) 繁體中文(香港) 한국어
Licenses API