security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
Files
e248012783f396fb202d30baa3e3370c00a82e23
blue-team-tools/rules/windows/registry_event
T
History
Bhabesh Rai 93c7931037 Added Stealthy Office Persistence via VSTO
2021-01-10 17:54:17 +05:45
..
sysmon_apt_leviathan.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_apt_oceanlotus_registry.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_apt_pandemic.yml
Update sysmon_apt_pandemic.yml
2020-07-16 08:48:32 +02:00
sysmon_asep_reg_keys_modification.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_cmstp_execution.yml
Split up cmstp rule into 3 separate rules and remove duplicates
2020-12-23 12:17:39 -05:00
sysmon_comhijack_sdclt.yml
added event type & changed technique
2020-10-02 09:22:14 +05:30
sysmon_cve-2020-1048.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_dhcp_calloutdll.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_disable_security_events_logging_adding_reg_key_minint.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_dns_serverlevelplugindll.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_etw_disabled.yml
refactor: sysmon rule cleanup > generlization
2020-07-01 10:58:39 +02:00
sysmon_hack_wce_reg.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_logon_scripts_userinitmprlogonscript_reg.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_narrator_feedback_persistance.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_new_dll_added_to_appcertdlls_registry_key.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_new_dll_added_to_appinit_dlls_registry_key.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_office_test_regadd.yml
Update sysmon_office_test_regadd.yml
2020-11-29 18:02:37 +05:30
sysmon_office_vsto_persistence.yml
Added Stealthy Office Persistence via VSTO
2021-01-10 17:54:17 +05:45
sysmon_possible_privilege_escalation_via_service_registry_permissions_weakness.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_rdp_registry_modification.yml
Changed category names and remove sysmon log source
2020-06-24 17:41:21 +02:00
sysmon_rdp_settings_hijack.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_redmimicry_winnti_reg.yml
fix: renamed files and lien break change
2020-07-01 09:48:48 +02:00
sysmon_reg_office_security.yml
refactor: sysmon rule cleanup > generlization
2020-07-01 10:58:39 +02:00
sysmon_registry_persistence_key_linking.yml
Changed category names and remove sysmon log source
2020-06-24 17:41:21 +02:00
sysmon_registry_persistence_search_order.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_registry_trust_record_modification.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_runkey_winekey.yml
ryuk changes
2020-10-30 13:15:11 +05:30
sysmon_ssp_added_lsa_config.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_stickykey_like_backdoor.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_susp_download_run_key.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_susp_lsass_dll_load.yml
fix typos, update tags
2020-09-13 15:46:45 +02:00
sysmon_susp_mic_cam_access.yml
fix reference field + add test for references in plural form
2020-11-27 10:17:45 +01:00
sysmon_susp_reg_persist_explorer_run.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_susp_run_key_img_folder.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_susp_service_installed.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_suspicious_keyboard_layout_load.yml
Re-fix sysmon rules that are lost changes with category refactoring.
2020-07-06 10:55:42 -04:00
sysmon_sysinternals_eula_accepted.yml
fix: bugfix and cosmetics
2020-06-24 18:10:58 +02:00
sysmon_uac_bypass_eventvwr.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_uac_bypass_sdclt.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00
sysmon_win_reg_persistence.yml
att&ck tags review: windows/registry_event
2020-09-06 22:10:44 +03:00