security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
e91fc4486e57fc40e30d12253694de4c80a9e4ea
blue-team-tools/rules/windows/registry_event
T
History
Florian Roth 026428640e Update registry_event_set_nopolicies_user.yml
2022-03-21 12:06:50 +01:00
..
registry_event_abusing_windows_telemetry_for_persistence.yml
fix: none --> Unknown
2022-03-16 14:19:21 +01:00
registry_event_add_local_hidden_user.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_add_port_monitor.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_apt_chafer_mar18.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
registry_event_apt_leviathan.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_apt_oceanlotus_registry.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_apt_pandemic.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_asep_reg_keys_modification_classes.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_asep_reg_keys_modification_common.yml
Office Installation FP
2022-03-05 11:09:27 +01:00
registry_event_asep_reg_keys_modification_currentcontrolset.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_asep_reg_keys_modification_currentversion_nt.yml
OfficeClickToRun FP
2022-03-03 19:45:03 +01:00
registry_event_asep_reg_keys_modification_currentversion.yml
Fix FP new install
2022-03-04 16:53:30 +01:00
registry_event_asep_reg_keys_modification_internet_explorer.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_asep_reg_keys_modification_office.yml
OfficeClickToRun FP
2022-03-03 19:45:03 +01:00
registry_event_asep_reg_keys_modification_session_manager.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_asep_reg_keys_modification_system_scripts.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_asep_reg_keys_modification_winsock2.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_asep_reg_keys_modification_wow6432node_classes.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_asep_reg_keys_modification_wow6432node_currentversion.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_asep_reg_keys_modification_wow6432node.yml
Office Installation FP
2022-03-05 11:09:27 +01:00
registry_event_asep_reg_keys_modification.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_blackbyte_ransomware.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_bypass_uac_using_delegateexecute.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_bypass_uac_using_eventviewer.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_bypass_uac_using_silentcleanup_task.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_bypass_via_wsreset.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_change_rdp_port.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_change_security_zones.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_chrome_extension.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_cmstp_execution_by_registry.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_cobaltstrike_service_installs.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_comhijack_sdclt.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_crashdump_disabled.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_cve_2020_1048.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_cve_2021_31979_cve_2021_33771_exploits.yml
Add cve tags
2021-10-25 18:14:03 +02:00
registry_event_defender_disabled.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
registry_event_defender_exclusions.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
registry_event_defender_realtime_protection_disabled.yml
Create new rule for detecting Microsfot Defender Tampering via Registry
2021-10-18 10:07:44 +04:00
registry_event_dhcp_calloutdll.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_disable_administrative_share.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_disable_defender_firewall.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_disable_fonction_user.yml
Update registry_event_disable_fonction_user.yml
2022-03-21 12:01:54 +01:00
registry_event_disable_microsoft_office_security_features.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_disable_security_events_logging_adding_reg_key_minint.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_disable_uac_registry.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_disable_wdigest_credential_guard.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_disabled_exploit_guard_net_protection_on_ms_defender.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_disabled_pua_protection_on_microsoft_defender.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_disabled_tamper_protection_on_microsoft_defender.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_dns_over_https_enabled.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_dns_serverlevelplugindll.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_enabling_cor_profiler_env_variables.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_esentutl_volume_shadow_copy_service_keys.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_etw_disabled.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_file_association_exefile.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_hack_wce_reg.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_hidden_extention.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_hide_fonction_user.yml
Update registry_event_hide_fonction_user.yml
2022-03-21 12:04:29 +01:00
registry_event_hybridconnectionmgr_svc_installation.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_ie_persistence.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_logon_scripts_userinitmprlogonscript_reg.yml
fix: remove penetration test as valid false positive reason
2022-03-16 14:33:18 +01:00
registry_event_mal_adwind.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
registry_event_mal_azorult.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_mal_blue_mockingbird.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_mal_flowcloud.yml
Order rules
2022-01-20 22:06:55 +01:00
registry_event_mal_netwire.yml
fix: more falsepositives harmonization
2022-03-16 14:57:06 +01:00
registry_event_mal_ursnif.yml
Order rules
2022-01-20 22:06:55 +01:00
registry_event_mimikatz_printernightmare.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_modify_screensaver_binary_path.yml
fix: more falsepositives harmonization
2022-03-16 14:57:06 +01:00
registry_event_mstsc_history_cleared.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_narrator_feedback_persistance.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_net_ntlm_downgrade.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
registry_event_new_application_appcompat.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_new_dll_added_to_appcertdlls_registry_key.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_new_dll_added_to_appinit_dlls_registry_key.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_office_enable_dde.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_office_security.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_office_test_regadd.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_office_vsto_persistence.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_outlook_c2_registry_key.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_outlook_registry_todaypage.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_outlook_registry_webview.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_outlook_security.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_persistence_key_linking.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_persistence_recycle_bin.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_persistence_search_order.yml
fix: a 2nd "contains" error
2022-03-07 16:03:17 +01:00
registry_event_persistence.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_portproxy_registry_key.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_powershell_as_service.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_powershell_in_run_keys.yml
Update registry_event_powershell_in_run_keys.yml
2022-03-18 20:58:16 +01:00
registry_event_rdp_registry_modification.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_rdp_settings_hijack.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_redmimicry_winnti_reg.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_removal_amsi_registry_key.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_removal_com_hijacking_registry_key.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_runkey_winekey.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_runonce_persistence.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_set_nopolicies_user.yml
Update registry_event_set_nopolicies_user.yml
2022-03-21 12:06:50 +01:00
registry_event_set_servicedll.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_shell_open_keys_manipulation.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_shim_databases_persistence.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_silentprocessexit_lsass.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_silentprocessexit.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_ssp_added_lsa_config.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_stickykey_like_backdoor.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
registry_event_susp_atbroker_change.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_susp_download_run_key.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_susp_lsass_dll_load.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_susp_mic_cam_access.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_susp_printer_driver.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_susp_reg_persist_explorer_run.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_susp_run_key_img_folder.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_susp_service_installed.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_suspicious_keyboard_layout_load.yml
fix: more falsepositives harmonization
2022-03-16 14:57:06 +01:00
registry_event_sysinternals_eula_accepted.yml
split sysinternals eula and uac bypass
2021-09-12 09:38:05 +02:00
registry_event_sysinternals_sdelete_registry_keys.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_taskcache_entry.yml
Fix Windows11-Office FP
2022-03-03 15:20:53 +01:00
registry_event_telemetry_persistence.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_trust_record_modification.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_uac_bypass_eventvwr.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_uac_bypass_sdclt.yml
fix: unknown --> Unknown
2022-03-16 13:43:54 +01:00
registry_event_uac_bypass_winsat.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
registry_event_uac_bypass_wmp.yml
Add setvalue for Details
2022-01-13 16:28:29 +01:00
registry_event_vbs_payload_stored.yml
Fix FP new install
2022-03-04 16:53:30 +01:00
registry_event_wab_dllpath_reg_change.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_wdigest_enable_uselogoncredential.yml
Name Normalization
2022-02-27 10:58:14 +01:00
registry_event_winlogon_notify_key.yml
Name Normalization
2022-02-27 10:58:14 +01:00