blue-team-tools

file_event_win_access_susp_teams.yml

Microsoft Teams Suspicious ObjectAccess events (#3500 )

2022-09-17 08:47:35 +02:00

file_event_win_access_susp_unattend_xml.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

file_event_win_advanced_ip_scanner.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_anydesk_artefact.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

file_event_win_apt_unidentified_nov_18.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_bloodhound_collection.yml

Rename

2022-09-08 10:26:23 +02:00

file_event_win_crackmapexec_patterns.yml

chore: harmonization of generic 'nt system' user checks

2022-05-27 15:16:31 +02:00

file_event_win_creation_new_shim_database.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

file_event_win_creation_scr_binary_file.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

file_event_win_creation_system_file.yml

Remove duplicate casing

2022-09-07 14:07:04 +02:00

file_event_win_creation_unquoted_service_path.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

file_event_win_cred_dump_tools_dropped_files.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_csharp_compile_artefact.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

file_event_win_cve_2021_1675_printspooler.yml

chore: test rules: reactivate single value list check

2022-05-10 17:13:04 +02:00

file_event_win_cve_2021_26858_msexchange.yml

refactor: rule level adjustments - critical to high

2022-06-18 17:43:22 +02:00

file_event_win_cve_2021_31979_cve_2021_33771_exploits.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_cve_2021_41379_msi_lpe.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_cve_2021_44077_poc_default_files.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

file_event_win_cve_2022_24527_lpe.yml

chore: harmonization of generic 'nt system' user checks

2022-05-27 15:16:31 +02:00

file_event_win_detect_powerup_dllhijacking.yml

New Rules + Update

2022-07-14 17:35:50 +01:00

file_event_win_dll_sideloading_space_path.yml

Sideloading DLL with space path

2022-07-31 08:36:19 +02:00

file_event_win_error_handler_cmd_persistence.yml

Update file_event_win_error_handler_cmd_persistence.yml

2022-08-10 17:45:25 +01:00

file_event_win_ghostpack_safetykatz.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_gotoopener_artefact.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

file_event_win_hack_dumpert.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_hivenightmare_file_exports.yml

refactor: rule additions

2022-05-24 15:19:25 +02:00

file_event_win_hktl_nppspy.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

file_event_win_install_teamviewer_desktop.yml

Added quotes to strings

2022-09-01 15:22:26 +02:00

file_event_win_iphlpapi_dll_sideloading.yml

Update

2022-08-15 00:22:08 +01:00

file_event_win_iso_file_mount.yml

Rename sysmon_file_event_iso.yml to file_event_win_iso_file_mount.yml

2022-07-31 13:58:55 +02:00

file_event_win_iso_file_recent.yml

chore: test rules: reactivate single value list check

2022-05-10 17:13:04 +02:00

file_event_win_legitimate_app_dropping_archive.yml

Rename

2022-09-08 10:26:23 +02:00

file_event_win_legitimate_app_dropping_exe.yml

Rename

2022-09-08 10:26:23 +02:00

file_event_win_legitimate_app_dropping_script.yml

Rename

2022-09-08 10:26:23 +02:00

file_event_win_lsass_dump.yml

Update Ref+Selection 3

2022-07-11 18:12:51 +01:00

file_event_win_lsass_memory_dump_file_creation.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_lsass_werfault_dump.yml

rule: WerFault process memory dump

2022-06-27 15:53:06 +02:00

file_event_win_macro_file.yml

New Rules + Update

2022-07-14 17:35:50 +01:00

file_event_win_mal_adwind.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_mal_octopus_scanner.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_mal_vhd_download.yml

Add "\" to "Image|endswith" modifier

2022-06-02 13:39:07 +01:00

file_event_win_mimikatz_kirbi_file_creation.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_mimimaktz_memssp_log_file.yml

refactor condition

2022-06-03 15:35:24 +02:00

file_event_win_moriya_rootkit.yml

fix: none --> Unknown

2022-03-16 14:19:21 +01:00

file_event_win_msdt_autorun.yml

Update file_event_win_msdt_autorun.yml

2022-08-25 08:38:43 +02:00

file_event_win_new_files_in_uncommon_appdata_folder.yml

Fix after review

2022-08-05 18:40:12 +01:00

file_event_win_new_src_file.yml

Update file_event_win_new_src_file.yml

2022-04-28 17:30:30 +02:00

file_event_win_notepad_plus_plus_persistence.yml

Update file_event_win_notepad_plus_plus_persistence.yml

2022-06-21 11:43:42 +01:00

file_event_win_ntds_dit.yml

New Rules + Update

2022-07-14 17:35:50 +01:00

file_event_win_ntds_exfil_tools.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

file_event_win_office_persistence.yml

Added quotes to strings

2022-09-01 15:22:26 +02:00

file_event_win_outlook_c2_macro_creation.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_outlook_newform.yml

Small Update and New Rule

2022-06-16 23:37:50 +01:00

file_event_win_pcre_net_temp_file.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_pingback_backdoor.yml

Added quotes to strings

2022-09-01 15:22:26 +02:00

file_event_win_powershell_exploit_scripts.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

file_event_win_powershell_startup_shortcuts.yml

Update file_event_win_powershell_startup_shortcuts.yml

2022-08-29 20:15:54 +02:00

file_event_win_quarkspw_filedump.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_rclone_exec_file.yml

refactor condition

2022-06-03 15:35:24 +02:00

file_event_win_redmimicry_winnti_filedrop.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_ripzip_attack.yml

Rule Update

2022-07-25 16:50:19 +01:00

file_event_win_sam_dump.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_screenconnect_artefact.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

file_event_win_script_creation_by_office_using_file_ext.yml

Update Ref+Selection 3

2022-07-11 18:12:51 +01:00

file_event_win_startup_folder_file_write.yml

Update

2022-08-22 14:52:41 +01:00

file_event_win_susp_adsi_cache_usage.yml

FP: sentinel one performs this

2022-08-24 15:34:36 +00:00

file_event_win_susp_clr_logs.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

file_event_win_susp_colorcpl.yml

Added quotes to strings

2022-09-01 15:22:26 +02:00

file_event_win_susp_creation_by_mobsync.yml

Add "\" to "Image|endswith" modifier

2022-06-02 13:39:07 +01:00

file_event_win_susp_default_gpo_dir_write.yml

Update file_event_win_susp_default_gpo_dir_write.yml

2022-04-28 17:28:37 +02:00

file_event_win_susp_desktop_ini.yml

chore: test rules: capitalization on FP list entries

2022-05-09 16:07:44 +02:00

file_event_win_susp_desktop_txt.yml

Added quotes to strings

2022-09-01 15:22:26 +02:00

file_event_win_susp_desktopimgdownldr_file.yml

Add "\" to "Image|endswith" modifier

2022-06-02 13:39:07 +01:00

file_event_win_susp_diagcab.yml

Update file_event_win_susp_diagcab.yml

2022-06-09 18:27:50 +02:00

file_event_win_susp_double_extension.yml

Add file_event_win_susp_double_extension

2022-07-28 20:51:36 +02:00

file_event_win_susp_dropper.yml

MS Update FP

2022-07-27 08:11:17 +02:00

file_event_win_susp_exchange_aspx_write.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_susp_executable_creation.yml

Update file_event_win_susp_executable_creation.yml

2022-09-06 09:17:35 +02:00

file_event_win_susp_get_variable.yml

Fix title

2022-04-23 18:35:23 +02:00

file_event_win_susp_ntds_dit.yml

New Rules + Update

2022-07-14 17:35:50 +01:00

file_event_win_susp_pfx_file_creation.yml

fix: filter expressions missing in condition

2022-07-07 18:42:05 +02:00

file_event_win_susp_powershell_profile.yml

Fix after review

2022-08-24 18:35:23 +01:00

file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_susp_spool_drivers_color_drop.yml

New Rules

2022-07-29 14:07:14 +02:00

file_event_win_susp_startup_folder_persistence.yml

More additions and updates

2022-08-10 12:52:49 +01:00

file_event_win_susp_system_interactive_powershell.yml

Update backslash

2022-08-13 09:59:31 +02:00

file_event_win_susp_task_write.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_susp_teamviewer_remote_session.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_susp_vscode_powershell_profile.yml

Update file_event_win_susp_vscode_powershell_profile.yml

2022-08-24 12:29:54 +01:00

file_event_win_susp_winword_startup.yml

Update file_event_win_susp_winword_startup.yml

2022-08-29 20:16:41 +02:00

file_event_win_tool_psexec.yml

refactor condition

2022-06-03 15:35:24 +02:00

file_event_win_tsclient_filewrite_startup.yml

Update

2022-08-22 14:52:41 +01:00

file_event_win_uac_bypass_consent_comctl32.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_uac_bypass_dotnet_profiler.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_uac_bypass_eventvwr.yml

fix: removing Level based filter

2022-04-27 15:04:39 +02:00

file_event_win_uac_bypass_idiagnostic_profile.yml

Update file_event_win_uac_bypass_idiagnostic_profile.yml

2022-07-04 14:03:26 +01:00

file_event_win_uac_bypass_ieinstal.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_uac_bypass_msconfig_gui.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_uac_bypass_ntfs_reparse_point.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_uac_bypass_winsat.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_uac_bypass_wmp.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_webshell_creation_detect.yml

fix: typo in modifier

2022-09-18 16:33:49 +02:00

file_event_win_werfault_dll_hijacking.yml

Update file_event_win_werfault_dll_hijacking.yml

2022-05-12 13:59:49 +02:00

file_event_win_win_cscript_wscript_dropper.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_win_shell_write_susp_directory.yml

Update meta

2022-08-12 13:42:52 +01:00

file_event_win_win_shell_write_susp_files_extensions.yml

fix: FPs (testing, and Windows 2022 test system)

2022-09-18 16:21:05 +02:00

file_event_win_winrm_awl_bypass.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_winword_cve_2021_40444.yml

Merge pull request #3143 from SigmaHQ/rule-devel

2022-06-19 15:04:46 +02:00

file_event_win_wmi_persistence_script_event_consumer_write.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_wmiexec_default_filename.yml

tightened the regular expression

2022-09-10 09:34:16 +02:00

file_event_win_wmiprvse_wbemcomn_dll_hijack.yml

Name Normalization

2022-02-27 07:39:46 +01:00

file_event_win_word_template_creation.yml

feat: new rule for persistence using Office startup

2022-06-07 14:25:52 +01:00

file_event_win_wpbbin_persistence.yml

UEFI Persistence - wpbbin

2022-07-18 12:45:44 +01:00

file_event_win_writing_local_admin_share.yml

Dev

2022-09-08 22:50:57 +02:00