security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
cf3cbf808996bfd2b4d4cae3b37d101c208fa490
blue-team-tools/regression_data/rules/windows/process_creation
T
History
Swachchhanda Shrawan Poudel f05a8c4d94 Merge PR #5788 from @swachchhanda000 - Recon via RDP Logging Event 
update: Potentially Suspicious EventLog Recon Activity Using Log Query Utilities - add more interesting event ids

---------

Co-authored-by: Nasreddine Bencherchali <nasbench@users.noreply.github.com>
2025-12-09 08:48:59 +05:45
..
proc_creation_win_browsers_chromium_headless_file_download
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_browsers_chromium_load_extension
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_browsers_chromium_mockbin_abuse
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_browsers_chromium_susp_load_extension
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_browsers_inline_file_download
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_browsers_tor_execution
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_certutil_certificate_installation
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_certutil_decode
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_certutil_download
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_certutil_download_direct_ip
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_certutil_download_file_sharing_domains
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_certutil_encode
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_certutil_encode_susp_extensions
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_certutil_encode_susp_location
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_certutil_export_pfx
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_certutil_ntlm_coercion
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_chcp_codepage_lookup
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_chcp_codepage_switch
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_cipher_overwrite_deleted_data
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_clip_execution
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_cmd_assoc_execution
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_cmd_dir_execution
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_cmd_mklink_osk_cmd
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_cmd_rmdir_execution
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_cmdkey_adding_generic_creds
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_cmdkey_recon
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_conhost_headless_powershell
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_curl_susp_download
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_dirlister_execution
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_discovery_via_reg_queries
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_dism_remove
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_driverquery_recon
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_driverquery_usage
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_dsquery_domain_trust_discovery
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_dtrace_kernel_dump
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_explorer_folder_shortcut_via_shell_binary
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_findstr_gpp_passwords
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_findstr_lsass
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_findstr_recon_everyone
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_findstr_recon_pipe_output
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_findstr_security_keyword_lookup
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_finger_execution
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_github_self_hosted_runner
Merge PR #5782 from @Koifman - Add Github Self-Hosted Runner Execution
2025-12-04 00:55:53 +01:00
proc_creation_win_gpresult_execution
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_hh_chm_execution
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_pua_adfind_enumeration
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_pua_adfind_execution
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_pua_adfind_susp_usage
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_pua_advanced_ip_scanner
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_pua_advanced_port_scanner
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_pua_advancedrun
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_pua_advancedrun_priv_user
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_reg_add_run_key
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_reg_add_safeboot
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_registry_special_accounts_hide_user
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_renamed_adfind
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_renamed_binary
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_renamed_binary_highly_relevant
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_renamed_curl
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_renamed_ftp
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_renamed_msdt
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_sc_stop_service
Merge PR #5775 from @swachchhanda000 - Restructure regression testing data directory
2025-11-26 11:08:11 +01:00
proc_creation_win_susp_eventlog_content_recon
Merge PR #5788 from @swachchhanda000 - Recon via RDP Logging Event
2025-12-09 08:48:59 +05:45