security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
d91a1d0903b7f3407ab429f388d4fd2016450d00
blue-team-tools/rules/linux/process_creation
T
History
Veramine d91a1d0903 filter some legitimate activity 
Filter landscape-sysinfo tool calling who
2023-01-13 00:47:40 -08:00
..
proc_creation_lnx_at_command.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_base64_decode.yml
feat: add new linux rules
2022-12-29 11:17:42 +01:00
proc_creation_lnx_base64_execution.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_base64_shebang_cli.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_bpftrace_unsafe_option_usage.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_capa_discovery.yml
feat: add new linux rules
2022-12-29 11:17:42 +01:00
proc_creation_lnx_cat_sudoers.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_chattr_immutable_removal.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_clear_logs.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_clear_syslog.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_clipboard_collection.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_crontab_removal.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_crypto_mining.yml
Promotion rules (#3821)
2022-12-27 12:29:10 +01:00
proc_creation_lnx_curl_usage.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_cve_2022_26134_atlassian_confluence.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_cve_2022_33891_spark_shell_command_injection.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_dd_file_overwrite.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_doas_execution.yml
Linux rules update
2022-09-16 09:22:57 +02:00
proc_creation_lnx_file_and_directory_discovery.yml
Title modified in several rules (#3728)
2022-11-25 15:34:38 +01:00
proc_creation_lnx_file_deletion.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_groupdel.yml
Add rule delete group or user (#3822)
2022-12-27 11:21:14 +01:00
proc_creation_lnx_gtfobin_apt.yml
feat: add new linux rules
2022-12-29 11:17:42 +01:00
proc_creation_lnx_gtfobin_vim.yml
feat: add new linux rules
2022-12-29 11:17:42 +01:00
proc_creation_lnx_hack_tools.yml
feat: updates and enhancements
2023-01-04 17:49:32 +01:00
proc_creation_lnx_install_root_certificate.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_install_suspicioua_packages.yml
fix: unique item list
2023-01-04 18:26:59 +01:00
proc_creation_lnx_local_account.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
proc_creation_lnx_local_groups.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
proc_creation_lnx_network_service_scanning.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
proc_creation_lnx_nohup.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_omigod_scx_runasprovider_executescript.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_process_discovery.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_proxy_connection.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_python_pty_spawn.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_remote_system_discovery.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_schedule_task_job_cron.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
proc_creation_lnx_security_software_discovery.yml
Update Title (#3733)
2022-11-28 06:43:17 +01:00
proc_creation_lnx_security_tools_disabling.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
proc_creation_lnx_services_stop_and_disable.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_setgid_setuid.yml
Remove mitre url
2023-01-10 18:09:04 +01:00
proc_creation_lnx_sudo_cve_2019_14287.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_susp_chmod_directories.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_susp_curl_fileupload.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_susp_curl_useragent.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_susp_find_execution.yml
feat: add new linux rules
2022-12-29 11:17:42 +01:00
proc_creation_lnx_susp_git_clone.yml
Update modified
2023-01-05 09:11:49 +01:00
proc_creation_lnx_susp_history_delete.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_susp_history_recon.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_susp_interactive_bash.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_susp_java_children.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_susp_pipe_shell.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_susp_recon_indicators.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_system_info_discovery.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_system_network_connections_discovery.yml
filter some legitimate activity
2023-01-13 00:47:40 -08:00
proc_creation_lnx_system_network_discovery.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_triple_cross_rootkit_execve_hijack.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_triple_cross_rootkit_install.yml
Order yaml field
2022-10-25 08:53:44 +02:00
proc_creation_lnx_userdel.yml
Add rule delete group or user (#3822)
2022-12-27 11:21:14 +01:00
proc_creation_lnx_usermod_susp_group.yml
fix: rule status
2022-12-21 19:23:23 +01:00
proc_creation_lnx_webshell_detection.yml
feat: add new linux rules
2022-12-29 11:17:42 +01:00