security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a99b5082e1a6c5c752120d56fdd67ee239e6a302
blue-team-tools/rules-deprecated/windows
T
History
Nasreddine Bencherchali a99b5082e1 feat: updates and enhancements
2023-01-02 14:49:45 +01:00
..
image_load_susp_winword_wmidll_load.yml
move deprecated rules
2022-05-14 09:42:32 +02:00
le_event_win_hktl_createminidump.yml
move deprecated rules
2022-05-14 09:42:32 +02:00
posh_ps_access_to_chrome_login_data.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
posh_ps_azurehound_commands.yml
feat: updates and enhancements
2023-01-02 14:49:45 +01:00
posh_ps_invoke_nightmare.yml
feat: updates and enhancements
2023-01-02 14:49:45 +01:00
powershell_suspicious_download.yml
refactor: folder refactoring
2022-04-11 11:35:19 +02:00
powershell_suspicious_invocation_generic.yml
refactor: folder refactoring
2022-04-11 11:35:19 +02:00
powershell_suspicious_invocation_specific.yml
refactor: folder refactoring
2022-04-11 11:35:19 +02:00
powershell_syncappvpublishingserver_exe.yml
refactor: folder refactoring
2022-04-11 11:35:19 +02:00
proc_access_win_in_memory_assembly_execution.yml
fix: deprecate 5f113a8f-8b61-41ca-b90f-d374fa7e4a39
2022-11-15 22:56:51 +01:00
proc_creation_win_invoke_obfuscation_via_use_rundll32.yml
Update proc_creation_win_invoke_obfuscation_via_use_rundll32.yml
2022-12-30 09:53:25 +01:00
proc_creation_win_lolbas_execution_of_wuauclt.yml
chore: move deprecated rule instead of deleting
2022-05-30 08:43:40 +02:00
proc_creation_win_mavinject_proc_inj.yml
style: reordered fields
2022-12-21 08:56:26 +01:00
proc_creation_win_nslookup_pwsh_download_cradle.yml
fix: add missing modified field
2022-12-14 10:32:11 +01:00
proc_creation_win_office_from_proxy_executing_regsvr32_payload2.yml
feat: general updates and fixes
2022-12-02 23:16:03 +01:00
proc_creation_win_office_from_proxy_executing_regsvr32_payload.yml
feat: general updates and fixes
2022-12-02 23:16:03 +01:00
proc_creation_win_possible_applocker_bypass.yml
Deprecate 82a19e3a-2bfe-4a91-8c0d-5d4c98fbb719
2022-11-03 13:42:45 +01:00
proc_creation_win_powershell_bitsjob.yml
fix: deprecate f67dbfce-93bc-440d-86ad-a95ae8858c90
2022-11-21 12:31:01 +01:00
proc_creation_win_susp_run_folder.yml
Deprecate dca91cfd-d7ab-4c66-8da7-ee57d487b35b
2022-11-03 13:41:40 +01:00
process_creation_syncappvpublishingserver_exe.yml
refactor: folder refactoring
2022-04-11 11:35:19 +02:00
registry_event_asep_reg_keys_modification.yml
Reference Update [Batch 1]
2022-07-07 15:24:15 +01:00
registry_set_abusing_windows_telemetry_for_persistence.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
registry_set_silentprocessexit.yml
feat: multiple update and enhancements
2022-12-19 17:41:40 +01:00
sysmon_accessing_winapi_in_powershell_credentials_dumping.yml
Refractor (#3794)
2022-12-18 21:00:14 +01:00
sysmon_dcom_iertutil_dll_hijack.yml
Refractor (#3794)
2022-12-18 21:00:14 +01:00
sysmon_mimikatz_detection_lsass.yml
refactor: folder refactoring
2022-04-11 11:35:19 +02:00
sysmon_rclone_execution.yml
refactor: folder refactoring
2022-04-11 11:35:19 +02:00
win_lateral_movement_condrv.yml
move deprecated rules
2022-05-14 09:42:32 +02:00
win_susp_esentutl_activity.yml
refactor: folder refactoring
2022-04-11 11:35:19 +02:00
win_susp_rclone_exec.yml
refactor: folder refactoring
2022-04-11 11:35:19 +02:00
win_susp_vssadmin_ntds_activity.yml
fix: add missing quotes and additional metadata
2022-11-10 17:02:29 +01:00