blue-team-tools

registry_event_add_local_hidden_user.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_apt_pandemic.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_bypass_via_wsreset.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_cmstp_execution_by_registry.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_disable_security_events_logging_adding_reg_key_minint.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_disable_wdigest_credential_guard.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_esentutl_volume_shadow_copy_service_keys.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_hack_wce_reg.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_hybridconnectionmgr_svc_installation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_mal_azorult.yml

Merge PR #5395 from @david-syk - Update MITRE ATT&CK tags

2025-05-20 23:05:21 +02:00

registry_event_malware_qakbot_registry.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_mimikatz_printernightmare.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_modify_screensaver_binary_path.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_narrator_feedback_persistance.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_net_ntlm_downgrade.yml

fix: FPs with NetNTLM downgrade attack (#5108 )

2024-12-03 22:44:37 +01:00

registry_event_new_dll_added_to_appcertdlls_registry_key.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_new_dll_added_to_appinit_dlls_registry_key.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_office_test_regadd.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_office_trust_record_modification.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_persistence_recycle_bin.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_portproxy_registry_key.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_redmimicry_winnti_reg.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_runkey_winekey.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_runonce_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_shell_open_keys_manipulation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_silentprocessexit_lsass.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_ssp_added_lsa_config.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_stickykey_like_backdoor.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_susp_atbroker_change.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_susp_download_run_key.yml

Merge PR #5196 from @swachchhanda000 - Updated and Added rules related to Autorun Registry

2025-05-12 13:28:51 +02:00

registry_event_susp_lsass_dll_load.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_event_susp_mic_cam_access.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_enable_anonymous_connection.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00