security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
c24bbdcf8155700db336a80b0b190f243f1b646c
blue-team-tools/rules/apt
T
History
Tim Burrell (MSTIC) c24bbdcf81 Sigma queries for 
-- terminating threads in a svchost process (InvokePhantom uses this technique to disable windows event logging)
-- GALLIUM threat intel IOCs in recent MSTIC blog/release.
2020-01-24 15:31:06 +01:00
..
apt_apt29_thinktanks.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_apt29_tor.yml
style: minor changes
2019-12-20 14:59:26 +01:00
apt_babyshark.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_bear_activity_gtr19.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_carbonpaper_turla.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_chafer_mar18.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_cloudhopper.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_dragonfly.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_elise.yml
fix: fixed broken link in elise rule
2019-12-05 09:56:20 +01:00
apt_emissarypanda_sep19.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_empiremonkey.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_equationgroup_c2.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_equationgroup_dll_u_load.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_equationgroup_lnx.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_gallium.yml
Sigma queries for
2020-01-24 15:31:06 +01:00
apt_hurricane_panda.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_judgement_panda_gtr19.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_oceanlotus_registry.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_pandemic.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_slingshot.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_sofacy.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_stonedrill.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_ta17_293a_ps.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_tropictrooper.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_turla_commands.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_turla_namedpipes.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_turla_service_png.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_unidentified_nov_18.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
apt_wocao.yml
fix: fixed missing condition
2019-12-20 15:18:05 +01:00
apt_zxshell.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
crime_fireball.yml
Added UUIDs to rules
2019-11-12 23:12:27 +01:00