security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
c4a89b3b44ec21d323ecabf296e779b2e2a135d3
blue-team-tools/rules/windows/builtin/system
T
History
phantinuss f642bff744 fix: fix typos found by new check
2022-10-21 17:29:34 +02:00
..
win_system_anydesk_service_installation.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_application_sysmon_crash.yml
Rename rule
2022-10-14 11:25:25 +02:00
win_system_apt_carbonpaper_turla.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_apt_chafer_mar18_system.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_apt_stonedrill.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_apt_turla_service_png.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_cobaltstrike_service_installs.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_defender_disabled.yml
Rename rule
2022-10-14 11:25:25 +02:00
win_system_eventlog_cleared.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_hack_smbexec.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_invoke_obfuscation_clip_services.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_invoke_obfuscation_obfuscated_iex_services.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_invoke_obfuscation_stdin_services.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_invoke_obfuscation_var_services.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_invoke_obfuscation_via_compress_services.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_invoke_obfuscation_via_rundll_services.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_invoke_obfuscation_via_stdin_services.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_invoke_obfuscation_via_use_clip_services.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_invoke_obfuscation_via_use_mshta_services.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_invoke_obfuscation_via_use_rundll32_services.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_invoke_obfuscation_via_var_services.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_krbrelayup_service_installation.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_lpe_indicators_tabtip.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_lsasrv_ntlmv1.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_mal_creddumper.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_moriya_rootkit.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_ntfs_vuln_exploit.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_pcap_drivers.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_possible_zerologon_exploitation_using_wellknown_tools.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_powershell_script_installed_as_service.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_quarkspwdump_clearing_hive_access_history.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_rare_service_installs.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_rdp_potential_cve_2019_0708.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_service_hacktools.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_service_install_pdqdeploy_runner.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_service_install_pdqdeploy.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_service_install_susp_double_ampersand.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_sliver_service_installs.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_susp_dhcp_config_failed.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_susp_dhcp_config.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_susp_eventlog_cleared.yml
Rename rule
2022-10-14 11:25:25 +02:00
win_system_susp_proceshacker.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_susp_rtcore64_service_install.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_susp_sam_dump.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_susp_service_installation_folder_pattern.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_susp_service_installation_folder.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_susp_service_installation_script.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_susp_service_installation.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_susp_system_update_error.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_susp_vuln_cve_2022_21919_or_cve_2021_34484.yml
fix: fix typos found by new check
2022-10-21 17:29:34 +02:00
win_system_system_service_installation_by_unusal_client.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_tap_driver_installation.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_tool_psexec.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_volume_shadow_copy_mount.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_vul_cve_2020_1472.yml
Rename system rules
2022-10-14 09:04:45 +02:00
win_system_vul_cve_2021_42278_or_cve_2021_42287.yml
Rename system rules
2022-10-14 09:04:45 +02:00