security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
df4fa62bcaf271fcff5fe67dcb33a43034f88b1e
blue-team-tools/rules/windows
T
History
Nasreddine Bencherchali 67d1036566 Merge pull request #4390 from @nasbench - CVE-2023-36874 
new: Potential CVE-2023-36874 Exploitation - Uncommon Report.Wer Location
new: Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation
new: Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution
new: Suspicious Execution Location Of Wermgr.EXE - split from 396f6630-f3ac-44e3-bfc8-1b161bc00c4e
update: Potential Defense Evasion Via Rename Of Highly Relevant Binaries - enhanced child process list
update: Suspicious Child Process Of Wermgr.EXE - update title
fix: SCR File Write Event - update modifier

---------

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
2023-08-24 12:50:57 +02:00
..
builtin
feat: update rules using file sharing domains
2023-08-17 13:39:59 +02:00
create_remote_thread
feat: more updates
2023-07-28 14:32:57 +02:00
create_stream_hash
feat: update cl diag script rules
2023-08-17 19:26:21 +02:00
dns_query
feat: typo fix and remote access software rule update (#4313)
2023-06-15 11:18:20 +02:00
driver_load
feat: rules update
2023-08-07 16:09:21 +02:00
file
Merge pull request #4390 from @nasbench - CVE-2023-36874
2023-08-24 12:50:57 +02:00
image_load
fix: apply suggestions from code review
2023-08-18 15:15:26 +02:00
network_connection
feat: update rules using file sharing domains
2023-08-17 13:39:59 +02:00
pipe_created
fix: typos
2023-08-08 11:06:37 +02:00
powershell
feat: update cl diag script rules
2023-08-17 19:26:21 +02:00
process_access
fix:F multiple 404 links in references (#4332)
2023-06-26 10:10:04 +01:00
process_creation
Merge pull request #4390 from @nasbench - CVE-2023-36874
2023-08-24 12:50:57 +02:00
raw_access_thread
feat: new rules, updates and goofy guineapig stuff (#4229)
2023-05-15 15:53:39 +02:00
registry
Merge pull request #4382 from nasbench/new-rules-august-23
2023-08-18 15:45:00 +02:00
sysmon
Apply suggestions from code review
2023-07-20 15:47:14 +02:00
wmi_event
chore: add nextron authors tag
2023-02-01 11:14:59 +01:00