security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
Files
dbd68bf3f078619ba850686c621b0589667a4f73
blue-team-tools/rules/windows/powershell/powershell_module
T
History
phantinuss dbd68bf3f0 chore: test rules: capitalization on FP list entries 
Entires to the false positive list should begin with
a capital letter. e.g. Unkown instead of unkown.

Fixed the existing rules accordingly
2022-05-09 16:07:44 +02:00
..
posh_pm_alternate_powershell_hosts.yml
fix: FPs found in win2022 domain controller baseline
2022-04-21 10:48:59 +02:00
posh_pm_bad_opsec_artifacts.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_pm_clear_powershell_history.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_pm_decompress_commands.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
posh_pm_get_addbaccount.yml
chore: test rules: capitalization on FP list entries
2022-05-09 16:07:44 +02:00
posh_pm_get_clipboard.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
posh_pm_invoke_obfuscation_clip.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_invoke_obfuscation_obfuscated_iex.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_pm_invoke_obfuscation_stdin.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_invoke_obfuscation_var.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_invoke_obfuscation_via_compress.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
posh_pm_invoke_obfuscation_via_rundll.yml
Refactor regex
2022-03-08 19:07:37 +01:00
posh_pm_invoke_obfuscation_via_stdin.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_invoke_obfuscation_via_use_clip.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_invoke_obfuscation_via_use_mhsta.yml
Refactor regex
2022-03-07 19:08:30 +01:00
posh_pm_invoke_obfuscation_via_use_rundll32.yml
Refactor regex
2022-03-08 19:07:37 +01:00
posh_pm_invoke_obfuscation_via_var.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_powercat.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_remote_powershell_session.yml
FP on valid remote call of Powershell Archive.psm1, maybe beneficial to filter all powershell modules in future
2022-03-14 22:23:06 +00:00
posh_pm_susp_athremotefxvgpudisablementcommand.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_susp_get_nettcpconnection.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_susp_zip_compress.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_suspicious_ad_group_reco.yml
fix: more falsepositives harmonization
2022-03-16 14:57:06 +01:00
posh_pm_suspicious_download.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_pm_suspicious_invocation_generic.yml
fix: remove penetration test as valid false positive reason
2022-03-16 14:33:18 +01:00
posh_pm_suspicious_invocation_specific.yml
fix: remove penetration test as valid false positive reason
2022-03-16 14:33:18 +01:00
posh_pm_suspicious_local_group_reco.yml
fix: more falsepositives harmonization
2022-03-16 14:57:06 +01:00
posh_pm_suspicious_reset_computermachinepassword.yml
add posh_pm_suspicious_reset_computermachinepassword
2022-02-22 13:44:51 +01:00
posh_pm_suspicious_smb_share_reco.yml
fix: more falsepositives harmonization
2022-03-16 14:57:06 +01:00
posh_pm_syncappvpublishingserver_exe.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00