security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
e098fc73cb2fb18c723fd9727e116e9dc9bcb22e
blue-team-tools/rules/windows/process_access
T
History
Florian Roth eb247704fe Merge pull request #1761 from d4rk-d4nph3/master 
Added rule for Cabinet file expansion and Pypykatz
2021-08-05 15:50:12 +02:00
..
sysmon_cmstp_execution_by_access.yml
fix 3 times the same name file
2021-07-02 11:01:07 +02:00
sysmon_cred_dump_lsass_access.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45
sysmon_direct_syscall_ntopenprocess.yml
fix: remove unnecessary single value list
2021-08-04 15:50:39 +02:00
sysmon_in_memory_assembly_execution.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45
sysmon_injected_amsi_bypass.yml
CobaltStrike injected AMSI bypass
2021-08-04 11:28:58 +02:00
sysmon_invoke_phantom.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45
sysmon_lazagne_cred_dump_lsass_access.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45
sysmon_load_undocumented_autoelevated_com_interface.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45
sysmon_lsass_dump_comsvcs_dll.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45
sysmon_lsass_memdump.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45
sysmon_malware_verclsid_shellcode.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45
sysmon_mimikatz_trough_winrm.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45
sysmon_pypykatz_cred_dump_lsass_access.yml
Added rule for pypykatz
2021-08-03 15:06:27 +05:45
sysmon_svchost_cred_dump.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45
win_susp_shell_spawn_from_winrm.yml
Merging upstream updates
2021-07-01 12:18:30 +05:45