Logo
Explore Help
Sign In
security-tools/blue-team-tools
1
0
Fork 0
You've already forked blue-team-tools
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
dec9e6887696e8c38ce0d1fcf7bed768f25bbdb3
blue-team-tools/rules/windows/process_access
T
History
frack113 dec9e68876 Fix falsepositives list
2021-05-21 12:38:44 +02:00
..
sysmon_cmstp_execution.yml
Merge branch 'oscd'
2021-03-02 22:58:41 +03:00
sysmon_cred_dump_lsass_access.yml
att&ck tags review: windows/powershell, windows/process_access, windows/network_connection
2020-08-24 23:31:26 +00:00
sysmon_in_memory_assembly_execution.yml
Fixes and improvements
2021-04-03 00:08:55 +02:00
sysmon_invoke_phantom.yml
Update sysmon_invoke_phantom.yml
2020-11-20 01:30:58 -03:00
sysmon_lazagne_cred_dump_lsass_access.yml
Update sysmon_lazagne_cred_dump_lsass_access.yml
2020-11-20 01:33:04 -03:00
sysmon_load_undocumented_autoelevated_com_interface.yml
Fixes and improvements
2021-04-03 00:08:55 +02:00
sysmon_lsass_dump_comsvcs_dll.yml
Fix falsepositives list
2021-05-21 12:38:44 +02:00
sysmon_lsass_memdump.yml
Update sysmon_lsass_memdump.yml
2020-10-15 17:17:57 -03:00
sysmon_malware_verclsid_shellcode.yml
Update sysmon_malware_verclsid_shellcode.yml
2020-11-20 01:34:43 -03:00
sysmon_mimikatz_trough_winrm.yml
added missing ATT&CK v6.3 IDs with comments and removed unnecessary "modified" attributes
2020-08-25 23:51:22 +00:00
win_susp_shell_spawn_from_winrm.yml
rule: add rule to detect shell spawn from WinRM host process
2021-05-20 16:05:13 +02:00
Powered by Gitea Version: 1.26.1 Page: 202ms Template: 8ms
Auto
English
Bahasa Indonesia Deutsch English Español Français Gaeilge Italiano Latviešu Magyar nyelv Nederlands Polski Português de Portugal Português do Brasil Suomi Svenska Türkçe Čeština Ελληνικά Български Русский Українська فارسی മലയാളം 日本語 简体中文 繁體中文(台灣) 繁體中文(香港) 한국어
Licenses API