security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
c8f488eabf94271e79ac874099464a18246675f6
blue-team-tools/rules/linux
T
History
frack113 c8f488eabf move to builtin
2021-11-09 13:27:20 +01:00
..
auditd
Update lnx_auditd_load_module_insmod.yml
2021-11-02 17:16:59 +01:00
builtin
move to builtin
2021-11-09 13:27:20 +01:00
file_create
Rule for Cron activity - file creation
2021-10-16 02:33:01 -04:00
modsecurity
add missing tags
2021-09-07 18:16:46 +02:00
network_connection
rules: crypto coin mining
2021-10-26 08:52:07 +02:00
process_creation
Move to correct directory
2021-10-27 14:38:51 +02:00
lnx_clamav.yml
add missing tags
2021-09-07 18:16:46 +02:00
lnx_security_tools_disabling_syslog.yml
split global lnx_security_tools_disabling.yml
2021-09-14 19:32:58 +02:00
lnx_ssh_cve_2018_15473.yml
add missing tags
2021-09-07 18:16:46 +02:00
lnx_susp_failed_logons_single_source.yml
add missing tags
2021-09-07 18:16:46 +02:00
lnx_susp_guacamole.yml
add missing tags
2021-09-07 18:16:46 +02:00
lnx_susp_named.yml
Update lnx_susp_named.yml
2020-11-29 21:31:54 +01:00
lnx_susp_ssh.yml
restore the original file
2020-11-29 21:30:50 +01:00
lnx_susp_vsftp.yml
Fixed my git issue
2020-09-13 22:03:04 -06:00
macos_applescript.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_base64_decode.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_binary_padding.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_change_file_time_attr.yml
fix: duplicate UUIDs
2021-05-27 10:29:21 +02:00
macos_clear_system_logs.yml
Fix selection with only 1 element
2021-08-14 09:54:27 +02:00
macos_create_account.yml
Fixes and improvements
2021-04-03 00:08:55 +02:00
macos_create_hidden_account.yml
Fixes and improvements
2021-04-03 00:08:55 +02:00
macos_creds_from_keychain.yml
Changed selections and condition
2020-11-27 19:23:31 +01:00
macos_disable_security_tools.yml
Fixes and improvements
2021-04-03 00:08:55 +02:00
macos_emond_launch_daemon.yml
Sigma rule
2020-10-23 10:16:59 +02:00
macos_file_and_directory_discovery.yml
Fixes and improvements
2021-04-03 00:08:55 +02:00
macos_find_cred_in_files.yml
fix: duplicate UUIDs
2021-05-27 10:29:21 +02:00
macos_gui_input_capture.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_local_account.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_local_groups.yml
Fixes and improvements
2021-04-03 00:08:55 +02:00
macos_network_service_scanning.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_network_sniffing.yml
Fixes and improvements
2021-04-03 00:08:55 +02:00
macos_remote_system_discovery.yml
fix: duplicate UUIDs
2021-05-27 10:29:21 +02:00
macos_schedule_task_job_cron.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_screencapture.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00
macos_security_software_discovery.yml
Fixes and improvements
2021-04-03 00:08:55 +02:00
macos_split_file_into_pieces.yml
Fixes and improvements
2021-04-03 00:08:55 +02:00
macos_startup_items.yml
Fixes and improvements
2021-04-03 00:08:55 +02:00
macos_susp_histfile_operations.yml
added fish to macos rule
2020-10-17 02:37:21 +03:00
macos_suspicious_macos_firmware_activity.yml
Create macos_suspicious_macos_firmware_activity.yml
2021-09-30 18:47:15 -05:00
macos_system_network_connections_discovery.yml
Fixes and improvements
2021-04-03 00:08:55 +02:00
macos_system_network_discovery.yml
Fixes and improvements
2021-04-03 00:08:55 +02:00
macos_system_shutdown_reboot.yml
Fixes and improvements
2021-04-03 00:08:55 +02:00
macos_xattr_gatekeeper_bypass.yml
Renamed ProcessName field to Image for the process_creation category.
2021-02-25 01:57:26 +03:00