security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
e43d7f7e0ef10d76e05eb2fa62045bc4e6f03f27
blue-team-tools/rules-unsupported
T
History
Florian Roth 91c83bbe09 docs: changed wording in rule descriptions
2021-11-27 15:20:37 +01:00
..
zeek
No filetype or bodyMagic in zeek http log field
2021-11-14 09:24:34 +01:00
driver_load_invoke_obfuscation_clip+_services.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
driver_load_invoke_obfuscation_obfuscated_iex_services.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
driver_load_invoke_obfuscation_stdin+_services.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
driver_load_invoke_obfuscation_var+_services.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
driver_load_invoke_obfuscation_via_compress_services.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
driver_load_invoke_obfuscation_via_rundll_services.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
driver_load_invoke_obfuscation_via_stdin_services.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
driver_load_invoke_obfuscation_via_use_clip_services.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
driver_load_invoke_obfuscation_via_use_mshta_services.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
driver_load_invoke_obfuscation_via_use_rundll32_services.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
driver_load_invoke_obfuscation_via_var++_services.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
driver_load_tap_driver_installation.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
file_event_executable_and_script_creation_by_office_using_file_ext.yml
FileMagicBytes do not exist in file_event
2021-11-10 19:44:08 +01:00
lnx_auditd_omigod_scx_runasprovider_executescript.yml
Fix auditd field name
2021-11-11 10:13:48 +01:00
net_dns_high_subdomain_rate.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
net_dns_large_domain_name.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
net_possible_dns_rebinding.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
sysmon_always_install_elevated_msi_spawned_cmd_and_powershell_spawned_processes.yml
docs: changed wording in rule descriptions
2021-11-27 15:20:37 +01:00
sysmon_always_install_elevated_parent_child_correlated.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
sysmon_non_priv_program_files_move.yml
Integrity do not exist in file_event
2021-11-10 19:51:01 +01:00
sysmon_process_reimaging.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
win_access_fake_files_with_stored_credentials.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
win_apt_apt29_tor.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
win_dumping_ntdsdit_via_dcsync.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
win_dumping_ntdsdit_via_netsync.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
win_kernel_and_3rd_party_drivers_exploits_token_stealing.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
win_mal_service_installs.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
win_metasploit_or_impacket_smb_psexec_service_install.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
win_possible_privilege_escalation_using_rotten_potato.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
win_remote_schtask.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
win_remote_service.yml
change to unsupported status
2021-10-29 06:53:24 +02:00
win_suspicious_werfault_connection_outbound.yml
ParentImage do not exist in network_connection
2021-11-10 19:38:05 +01:00