security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
ca41e7a93f6258a69d8e3fa8cee9546f73eaebff
blue-team-tools/rules-unsupported/windows
T
History
fukusuket ca41e7a93f fix: update modified date
2023-04-23 21:37:50 +09:00
..
dns_query_win_possible_dns_rebinding.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
driver_load_invoke_obfuscation_clip+_services.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
driver_load_invoke_obfuscation_obfuscated_iex_services.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
driver_load_invoke_obfuscation_stdin+_services.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
driver_load_invoke_obfuscation_var+_services.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
driver_load_invoke_obfuscation_via_compress_services.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
driver_load_invoke_obfuscation_via_rundll_services.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
driver_load_invoke_obfuscation_via_stdin_services.yml
fix: update modified date
2023-04-23 21:37:50 +09:00
driver_load_invoke_obfuscation_via_use_clip_services.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
driver_load_invoke_obfuscation_via_use_mshta_services.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
driver_load_invoke_obfuscation_via_use_rundll32_services.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
driver_load_invoke_obfuscation_via_var++_services.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
driver_load_meterpreter_or_cobaltstrike_getsystem_service_installation.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
driver_load_tap_driver_installation.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
file_event_executable_and_script_creation_by_office_using_file_ext.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
image_load_mimikatz_inmemory_detection.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
posh_ps_cl_invocation_lolscript_count.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
posh_ps_cl_mutexverifiers_lolscript_count.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
proc_creation_win_correlation_apt_silence_downloader_v3.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
proc_creation_win_correlation_apt_turla_commands_medium.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
proc_creation_win_correlation_dnscat2_powershell_implementation.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
proc_creation_win_correlation_multiple_susp_cli.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
proc_creation_win_correlation_susp_builtin_commands_recon.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
sysmon_always_install_elevated_msi_spawned_cmd_and_powershell_spawned_processes.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
sysmon_always_install_elevated_parent_child_correlated.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
sysmon_non_priv_program_files_move.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
sysmon_process_reimaging.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_access_fake_files_with_stored_credentials.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_apt_apt29_tor.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_dumping_ntdsdit_via_dcsync.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_dumping_ntdsdit_via_netsync.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_kernel_and_3rd_party_drivers_exploits_token_stealing.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_mal_service_installs.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_metasploit_or_impacket_smb_psexec_service_install.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_possible_privilege_escalation_using_rotten_potato.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_remote_schtask.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_remote_service.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_security_global_catalog_enumeration.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_security_rare_schtasks_creations.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_security_susp_failed_logons_explicit_credentials.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_security_susp_failed_logons_single_process.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_security_susp_failed_logons_single_source2.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_security_susp_failed_logons_single_source_kerberos2.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_security_susp_failed_logons_single_source_kerberos3.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_security_susp_failed_logons_single_source_kerberos.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_security_susp_failed_logons_single_source_ntlm2.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_security_susp_failed_logons_single_source_ntlm.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_security_susp_failed_logons_single_source.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_security_susp_failed_remote_logons_single_source.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_security_susp_multiple_files_renamed_or_deleted.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_security_susp_samr_pwset.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_susp_failed_hidden_share_mount.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_suspicious_werfault_connection_outbound.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_system_rare_service_installs.yml
chore: move more rules
2023-04-21 15:00:36 +02:00
win_taskscheduler_rare_schtask_creation.yml
chore: move more rules
2023-04-21 15:00:36 +02:00