BlueTeamOps 976d994cee Updated to include additional tools ...

Expanded the list of Linux tools that may be used to obtain volume meta info and also included the auditd.
Removed specific switches for tools as those tools and debugfs exec within that time period will be rare.

2022-12-25 07:57:18 +11:00

..

lnx_auditd_alter_bash_profile.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_audio_capture.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

lnx_auditd_auditing_config_change.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_binary_padding.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

lnx_auditd_bpfdoor_file_accessed.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_bpfdoor_port_redirect.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_capabilities_discovery.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_change_file_time_attr.yml

Update title (#3734)

2022-11-29 07:36:45 +01:00

lnx_auditd_chattr_immutable_removal.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

lnx_auditd_clipboard_collection.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

lnx_auditd_clipboard_image_collection.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_coinminer.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_create_account.yml

fix: typo in comment

2022-12-20 22:28:49 +01:00

lnx_auditd_cve_2021_3156_sudo_buffer_overflow_brutforce.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

lnx_auditd_cve_2021_3156_sudo_buffer_overflow.yml

Refractor (#3794)

2022-12-18 21:00:14 +01:00

lnx_auditd_cve_2021_4034.yml

fix: typo in near operator

2022-12-22 16:08:21 +01:00

lnx_auditd_data_compressed.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_data_exfil_wget.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_dd_delete_file.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_debugfs_usage.yml

Updated to include additional tools

2022-12-25 07:57:18 +11:00

lnx_auditd_disable_system_firewall.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_file_or_folder_permissions.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_find_cred_in_files.yml

Update title (#3734)

2022-11-29 07:36:45 +01:00

lnx_auditd_hidden_files_directories.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

lnx_auditd_hidden_zip_files_steganography.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

lnx_auditd_keylogging_with_pam_d.yml

Refractor (#3794)

2022-12-18 21:00:14 +01:00

lnx_auditd_ld_so_preload_mod.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_load_module_insmod.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_logging_config_change.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_masquerading_crond.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_network_service_scanning.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

lnx_auditd_network_sniffing.yml

Refractor (#3794)

2022-12-18 21:00:14 +01:00

lnx_auditd_omigod_scx_runasprovider_executeshellcommand.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

lnx_auditd_password_policy_discovery.yml

Refractor (#3794)

2022-12-18 21:00:14 +01:00

lnx_auditd_pers_systemd_reload.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_screencapture_import.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_screencaputre_xwd.yml

Refractor (#3794)

2022-12-18 21:00:14 +01:00

lnx_auditd_split_file_into_pieces.yml

Update title (#3734)

2022-11-29 07:36:45 +01:00

lnx_auditd_steghide_embed_steganography.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

lnx_auditd_steghide_extract_steganography.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

lnx_auditd_susp_c2_commands.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_susp_cmds.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_susp_exe_folders.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_susp_histfile_operations.yml

Update title (#3734)

2022-11-29 07:36:45 +01:00

lnx_auditd_system_info_discovery2.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

lnx_auditd_system_info_discovery.yml

Refractor (#3794)

2022-12-18 21:00:14 +01:00

lnx_auditd_system_shutdown_reboot.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

lnx_auditd_systemd_service_creation.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_unzip_hidden_zip_files_steganography.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

lnx_auditd_user_discovery.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_web_rce.yml

fix: fix #1972

2022-11-17 00:53:00 +01:00