blue-team-tools

sysmon_ads_executable.yml

Rule: ADS with executable

2018-06-03 02:08:57 +02:00

sysmon_bitsadmin_download.yml

Cleaning up empty list items

2018-01-28 02:36:39 +03:00

sysmon_bypass_squiblytwo.yml

Moved and renamed rule

2018-04-18 16:53:11 +02:00

sysmon_cmdkey_recon.yml

Create cmdkey recon rule

2018-03-08 13:25:05 -05:00

sysmon_dhcp_calloutdll.yml

Cleaning up empty list items

2018-01-28 02:36:39 +03:00

sysmon_dns_serverlevelplugindll.yml

Simplified rule conditions with new condition constructs

2018-03-06 23:14:43 +01:00

sysmon_exploit_cve_2015_1641.yml

Rule: CVE-2015-1641

2018-02-22 16:59:40 +01:00

sysmon_exploit_cve_2017_0261.yml

Lowered severity of rule - prone to false positives

2018-02-22 16:59:11 +01:00

sysmon_exploit_cve_2017_8759.yml

Fixed file names "vuln" > "exploit"

2018-02-22 13:29:19 +01:00

sysmon_exploit_cve_2017_11882.yml

Cleaning up empty list items

2018-01-28 02:36:39 +03:00

sysmon_lethalHTA.yml

MSHTA spwaned by SVCHOST as seen in LethalHTA

2018-07-06 19:52:58 +02:00

sysmon_mal_namedpipes.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

sysmon_malware_backconnect_ports.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

sysmon_malware_script_dropper.yml

Added field names to first rules

2017-09-12 23:54:04 +02:00

sysmon_malware_verclsid_shellcode.yml

Simplified rule conditions with new condition constructs

2018-03-06 23:14:43 +01:00

sysmon_mimikatz_detection_lsass.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

sysmon_mimikatz_inmemory_detection.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

sysmon_mshta_spawn_shell.yml

Fieldname case: Commandline -> CommandLine

2018-03-25 23:08:28 +02:00

sysmon_office_macro_cmd.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

sysmon_office_shell.yml

Added msiexec to rule in order to cover new threats

2018-04-12 09:12:50 +02:00

sysmon_outlook_shell.yml

Rule: Outlook spawning shells to detect Turla like C&C via Outlook

2018-03-10 09:04:11 +01:00

sysmon_password_dumper_lsass.yml

Adjusted rules to the new specs reg "not null" usage

2018-06-28 09:30:31 +02:00

sysmon_plugx_susp_exe_locations.yml

Cleaning up empty list items

2018-01-28 02:36:39 +03:00

sysmon_powershell_download.yml

Added field names to first rules

2017-09-12 23:54:04 +02:00

sysmon_powershell_exploit_scripts.yml

Known powershell scripts names for exploitation

2018-07-04 17:24:18 +02:00

sysmon_powershell_network_connection.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

sysmon_powershell_suspicious_parameter_variation.yml

Simplified rule conditions with new condition constructs

2018-03-06 23:14:43 +01:00

sysmon_powersploit_schtasks.yml

Added additional options

2018-06-23 15:54:31 +02:00

sysmon_quarkspw_filedump.yml

Various rule fixes

2018-03-27 14:35:49 +02:00

sysmon_rundll32_net_connections.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

sysmon_shell_spawn_susp_program.yml

Improved shell spawning rule

2018-04-11 20:09:42 +02:00

sysmon_stickykey_like_backdoor.yml

Several rule updates

2018-03-19 16:36:15 +01:00

sysmon_susp_certutil_command.yml

Fixed bugs

2018-06-27 09:20:41 +02:00

sysmon_susp_cmd_http_appdata.yml

Change "reference" to "references" to match new schema

2018-01-28 02:12:19 +03:00

sysmon_susp_control_dll_load.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

sysmon_susp_driver_load.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_susp_exec_folder.yml

Cleaning up empty list items

2018-01-28 02:36:39 +03:00

sysmon_susp_execution_path_webserver.yml

Added field names to first rules

2017-09-12 23:54:04 +02:00

sysmon_susp_execution_path.yml

Added field names to first rules

2017-09-12 23:54:04 +02:00

sysmon_susp_image_load.yml

user subTee was removed from Twitter

2018-07-04 17:29:05 +02:00

sysmon_susp_mmc_source.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

sysmon_susp_net_execution.yml

Rule fixes

2018-06-27 18:47:52 +02:00

sysmon_susp_ping_hex_ip.yml

Rule: Ping hex IP address

2018-03-23 17:00:00 +01:00

sysmon_susp_powershell_parent_combo.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

sysmon_susp_powershell_rundll32.yml

Rule: Powershell remote thread creation in Rundll32

2018-06-25 15:23:19 +02:00

sysmon_susp_prog_location_network_connection.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

sysmon_susp_recon_activity.yml

Added field names to first rules

2017-09-12 23:54:04 +02:00

sysmon_susp_regsvr32_anomalies.yml

Fieldname case: Commandline -> CommandLine

2018-03-25 23:08:28 +02:00

sysmon_susp_run_key_img_folder.yml

Rule: New RUN Key Pointing to Suspicious Folder

2017-10-17 16:19:56 +02:00

sysmon_susp_schtask_creation.yml

Added field names to first rules

2017-09-12 23:54:04 +02:00

sysmon_susp_script_execution.yml

Massive Title Cleanup

2018-01-27 10:57:30 +01:00

sysmon_susp_svchost.yml

fix: typo in rule description

2018-07-03 05:05:44 -06:00

sysmon_susp_taskmgr_localsystem.yml

Rule: Suspicious taskmgr as LOCAL_SYSTEM

2018-03-19 16:36:39 +01:00

sysmon_susp_taskmgr_parent.yml

Several rule updates

2018-03-19 16:36:15 +01:00

sysmon_susp_tscon_localsystem.yml

Rules: tscon.exe anomalies

2018-03-17 19:14:13 +01:00

sysmon_susp_tscon_rdp_redirect.yml

Improved tscon rule

2018-03-20 10:54:04 +01:00

sysmon_susp_vssadmin_ntds_activity.yml

Cleaning up empty list items

2018-01-28 02:36:39 +03:00

sysmon_susp_wmi_execution.yml

Cleaning up empty list items

2018-01-28 02:36:39 +03:00

sysmon_system_exe_anomaly.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

sysmon_uac_bypass_eventvwr.yml

Cleaning up empty list items

2018-01-28 02:36:39 +03:00

sysmon_uac_bypass_sdclt.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

sysmon_vul_java_remote_debugging.yml

Massive Title Cleanup

2018-01-27 10:57:30 +01:00

sysmon_webshell_detection.yml

Added field names to first rules

2017-09-12 23:54:04 +02:00

sysmon_webshell_spawn.yml

Massive Title Cleanup

2018-01-27 10:57:30 +01:00

sysmon_win_binary_github_com.yml

Change All "str" references to be "list"to mach schema update

2018-01-28 02:24:16 +03:00

sysmon_win_reg_persistence.yaml

Improved rule to provide support for for old sysmon \REGISTRY syntax

2018-04-11 20:15:17 +02:00

sysmon_wmi_persistence_commandline_event_consumer.yml

WMI persistence rules derived from blog article

2018-03-07 23:05:10 +01:00

sysmon_wmi_persistence_script_event_consumer_write.yml

Renamed rule

2018-03-20 15:04:11 +01:00