security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
c3d807f53a670e8e8dd5c19dc92f950e3e9dfaa1
blue-team-tools/rules/windows/builtin/system
T
History
Florian Roth bea6f18d35 Merge pull request #3024 from redsand/win_system_susp_eventlog_cleared 
Making a derived detection for system/application/security event logs…
2022-05-20 20:56:00 +02:00
..
win_apt_carbonpaper_turla.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
win_apt_chafer_mar18_system.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
win_apt_stonedrill.yml
fix: ServiceFileName in 7045 events
2022-03-22 14:41:25 +01:00
win_apt_turla_service_png.yml
fix: unlikely --> Unlikely
2022-03-16 14:16:10 +01:00
win_cobaltstrike_service_installs.yml
Order rules
2021-12-04 10:07:07 +01:00
win_eventlog_cleared.yml
Making a derived detection for system/application/security event logs being cleared, vs any in general. fp due to custom applications clearing their eventlog
2022-05-17 18:49:54 +00:00
win_hack_smbexec.yml
fix: Service Installation 7045 field confusion
2022-03-21 11:10:03 +01:00
win_invoke_obfuscation_clip_services.yml
fix: Service Installation 7045 field confusion
2022-03-21 11:10:03 +01:00
win_invoke_obfuscation_obfuscated_iex_services.yml
Change double quote to quote
2022-01-06 14:02:35 +01:00
win_invoke_obfuscation_stdin_services.yml
Order rules
2021-12-04 10:07:07 +01:00
win_invoke_obfuscation_var_services.yml
Order rules
2021-12-04 10:07:07 +01:00
win_invoke_obfuscation_via_compress_services.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
win_invoke_obfuscation_via_rundll_services.yml
Refactor regex
2022-03-07 19:08:30 +01:00
win_invoke_obfuscation_via_stdin_services.yml
Order rules
2021-12-04 10:07:07 +01:00
win_invoke_obfuscation_via_use_clip_services.yml
some fixes and refactoring
2022-04-26 15:32:56 +02:00
win_invoke_obfuscation_via_use_mshta_services.yml
refactor regex
2022-03-06 20:15:32 +01:00
win_invoke_obfuscation_via_use_rundll32_services.yml
Refactor regex
2022-03-07 19:08:30 +01:00
win_invoke_obfuscation_via_var_services.yml
Order rules
2021-12-04 10:07:07 +01:00
win_lsasrv_ntlmv1.yml
fix: FPs with new NTLMv1 rule
2022-05-02 16:32:18 +02:00
win_mal_creddumper.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
win_meterpreter_or_cobaltstrike_getsystem_service_installation.yml
fix: unescaped double back slashes
2022-02-01 15:57:15 +01:00
win_moriya_rootkit.yml
fix: none --> Unknown
2022-03-16 14:19:21 +01:00
win_ntfs_vuln_exploit.yml
Add a ref
2022-04-23 10:05:27 +02:00
win_pcap_drivers.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
win_possible_zerologon_exploitation_using_wellknown_tools.yml
String 2 Int for EventIDs
2022-04-26 15:12:42 +02:00
win_powershell_script_installed_as_service.yml
Order rules
2021-12-04 10:07:07 +01:00
win_quarkspwdump_clearing_hive_access_history.yml
refactor: proposed changes from issue #2917
2022-04-14 16:57:30 +02:00
win_rare_service_installs.yml
fix: Service Installation 7045 field confusion
2022-03-21 11:10:03 +01:00
win_rdp_potential_cve_2019_0708.yml
fix: FPs noticed with Aurora
2022-02-21 18:43:18 +01:00
win_security_krbrelayup_service_installation.yml
User meant to use service vs category. currently no category assignment for "system". We need a unit test to detect new sections here, vs backends. this was untested in the field.
2022-05-16 22:18:35 +00:00
win_service_hacktools.yml
fix: Service Installation 7045 field confusion
2022-03-21 11:10:03 +01:00
win_susp_dhcp_config_failed.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
win_susp_dhcp_config.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
win_susp_proceshacker.yml
Order rules
2021-12-04 10:07:07 +01:00
win_susp_sam_dump.yml
refactor: proposed changes from issue #2917
2022-04-14 16:57:30 +02:00
win_susp_service_installation_folder_pattern.yml
add modified and date
2022-03-24 15:57:47 -04:00
win_susp_service_installation_folder.yml
new susp service installation rules
2022-03-18 16:08:40 +01:00
win_susp_service_installation_script.yml
Update win_susp_service_installation_script.yml
2022-03-24 21:22:26 +01:00
win_susp_service_installation.yml
fix: FPs in prod environment
2022-05-02 16:44:15 +02:00
win_susp_system_update_error.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
win_system_application_sysmon_crash.yml
chore: test rules: capitalization on FP list entries
2022-05-09 16:07:44 +02:00
win_system_defender_disabled.yml
doc: change titles to avoid duplicates
2022-05-04 11:30:30 +02:00
win_system_susp_eventlog_cleared.yml
Re-adding accidently removed entry
2022-05-19 17:16:39 +00:00
win_tap_driver_installation.yml
Order rules
2021-12-04 10:07:07 +01:00
win_tool_psexec.yml
fix: Service Installation 7045 field confusion
2022-03-21 11:10:03 +01:00
win_volume_shadow_copy_mount.yml
fix: FPs noticed with Aurora
2022-01-08 15:12:17 +01:00
win_vul_cve_2020_1472.yml
Order rules
2021-12-04 10:07:07 +01:00
win_vul_cve_2021_42278_or_cve_2021_42287.yml
docs: removed tracking info from reference link
2021-12-27 11:52:16 +01:00