security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
957ba042f01dab4634ff2cccf881160d92ef9963
blue-team-tools/rules/windows
T
History
frack113 957ba042f0 Merge pull request #2203 from OTRF/feature/Sysmon-v1330-Rules 
Unsupported rules now possible with Sysmonv13.30
2021-10-28 06:25:35 +02:00
..
builtin
Add cve tags
2021-10-25 18:40:50 +02:00
create_remote_thread
fix condition operator case
2021-09-10 13:51:52 +02:00
create_stream_hash
Merging upstream updates
2021-07-01 12:18:30 +05:45
deprecated
Create win_susp_rclone_exec.yml
2021-10-24 11:02:55 -05:00
dns_query
split global sysmon_regsvr32_network_activity.yml
2021-09-21 10:33:47 +02:00
driver_load
Add cve tags
2021-10-25 18:40:50 +02:00
file_delete
Add cve tags
2021-10-25 18:40:50 +02:00
file_event
Merge pull request #2195 from frack113/cve_attack
2021-10-26 10:40:13 +02:00
image_load
Add cve tags
2021-10-25 18:40:50 +02:00
malware
Update registry_event_mal_netwire.yml
2021-10-19 18:23:42 -04:00
network_connection
Merge branch 'master' into rule-devel
2021-10-26 22:03:55 +02:00
other
fix: change modifed date
2021-10-13 14:22:48 +02:00
pipe_created
Adding some additional details about sysmon config and also way to test detection.
2021-10-25 21:30:33 +02:00
powershell
Create powershell_azurehound_commands.yml
2021-10-23 18:27:36 -05:00
process_access
Merge pull request #2179 from frack113/fix_sysmon_in_memory_assembly_execution
2021-10-23 10:11:08 +02:00
process_creation
Merge pull request #2203 from OTRF/feature/Sysmon-v1330-Rules
2021-10-28 06:25:35 +02:00
raw_access_thread
Fix selection with only 1 element
2021-08-14 09:54:27 +02:00
registry_event
Add cve tags
2021-10-25 18:14:03 +02:00
sysmon
fix filename
2021-09-22 16:27:05 +02:00
wmi_event
fix: tags for WMI / execution / persistence
2021-09-01 16:34:50 +02:00
process_creation_stordiag_execution.yml
fix typo error
2021-10-24 09:08:20 +02:00