Florian Roth e344b1f10f Merge pull request #3591 from frack113/yamato_security ...

Windows builtin security rules

2022-10-15 10:49:37 +02:00

..

win_security_aadhealth_mon_agent_regkey_access.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_aadhealth_svc_agent_regkey_access.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_account_backdoor_dcsync_rights.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_account_discovery.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_ad_object_writedac_access.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_ad_replication_non_machine_account.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_ad_user_enumeration.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_adcs_certificate_template_configuration_vulnerability_eku.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_adcs_certificate_template_configuration_vulnerability.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_add_remove_computer.yml

Update rules/windows/builtin/security/win_security_add_remove_computer.yml

2022-10-14 12:37:20 +02:00

win_security_admin_logon.yml

Set to low

2022-10-14 10:33:34 +02:00

win_security_admin_rdp_login.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_admin_share_access.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_alert_active_directory_user_control.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_alert_ad_user_backdoors.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_alert_enable_weak_encryption.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_alert_ruler.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_apt_chafer_mar18_security.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_apt_slingshot.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_apt_wocao.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_atsvc_task.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_camera_microphone_access.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_cobaltstrike_service_installs.yml

Add missing definition section for EID 4697

2022-10-10 10:22:46 +02:00

win_security_dce_rpc_smb_spoolss_named_pipe.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_dcom_iertutil_dll_hijack.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_dcsync.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_defender_bypass.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_device_installation_blocked.yml

Update rules/windows/builtin/security/win_security_device_installation_blocked.yml

2022-10-14 12:37:27 +02:00

win_security_diagtrack_eop_default_login_username.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_disable_event_logging.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_dpapi_domain_backupkey_extraction.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_dpapi_domain_masterkey_backup_attempt.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_etw_modification.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_event_log_cleared.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_exploit_cve_2021_1675_printspooler_security.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_external_device.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_global_catalog_enumeration.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_gpo_scheduledtasks.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_hidden_user_creation.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_hybridconnectionmgr_svc_installation.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_impacket_psexec.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_impacket_secretdump.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_invoke_obfuscation_clip_services_security.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_invoke_obfuscation_obfuscated_iex_services_security.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_invoke_obfuscation_stdin_services_security.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_invoke_obfuscation_var_services_security.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_invoke_obfuscation_via_compress_services_security.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_invoke_obfuscation_via_rundll_services_security.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_invoke_obfuscation_via_stdin_services_security.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_invoke_obfuscation_via_use_clip_services_security.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_invoke_obfuscation_via_use_mshta_services_security.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_invoke_obfuscation_via_use_rundll32_services_security.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_invoke_obfuscation_via_var_services_security.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_iso_mount.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_lm_namedpipe.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_lolbas_execution_of_nltest.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_lsass_access_non_system_account.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_mal_creddumper.yml

Add missing definition section for EID 4697

2022-10-10 10:22:46 +02:00

win_security_mal_service_installs.yml

Add missing definition section for EID 4697

2022-10-10 10:22:46 +02:00

win_security_mal_wceaux_dll.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_metasploit_authentication.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_metasploit_or_impacket_smb_psexec_service_install.yml

Add missing definition section for EID 4697

2022-10-10 10:22:46 +02:00

win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml

Add missing definition section for EID 4697

2022-10-10 10:22:46 +02:00

win_security_net_ntlm_downgrade.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_net_share_obj_susp_desktop_ini.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_new_or_renamed_user_account_with_dollar_sign.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_not_allowed_rdp_access.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_overpass_the_hash.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_pass_the_hash_2.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_petitpotam_network_share.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_petitpotam_susp_tgt_request.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_possible_dc_shadow.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_powershell_script_installed_as_service.yml

Add missing definition section for EID 4697

2022-10-10 10:22:46 +02:00

win_security_protected_storage_service_access.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_rare_schtasks_creations.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_rdp_bluekeep_poc_scanner.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_rdp_localhost_login.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_rdp_reverse_tunnel.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_register_new_logon_process_by_rubeus.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_remote_powershell_session.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_replay_attack_detected.yml

Update rules/windows/builtin/security/win_security_replay_attack_detected.yml

2022-10-14 12:37:41 +02:00

win_security_sam_registry_hive_handle_request.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_samaccountname_spoofing_cve_2021_42287.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_scheduled_task_deletion.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_scm_database_handle_failure.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_scm_database_privileged_operation.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_scrcons_remote_wmi_scripteventconsumer.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_service_installation_by_unusal_client.yml

Update rules/windows/builtin/security/win_security_service_installation_by_unusal_client.yml

2022-10-10 17:01:45 +02:00

win_security_smb_file_creation_admin_shares.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_add_domain_trust.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_add_sid_history.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_codeintegrity_check_failure.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_computer_name.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_dsrm_password_change.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_eventlog_cleared.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_failed_logon_reasons.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_failed_logon_source.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_failed_logons_explicit_credentials.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_failed_logons_single_process.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_failed_logons_single_source2.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_failed_logons_single_source_kerberos2.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_failed_logons_single_source_kerberos3.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_failed_logons_single_source_kerberos.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_failed_logons_single_source_ntlm2.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_failed_logons_single_source_ntlm.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_failed_logons_single_source.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_failed_remote_logons_single_source.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_kerberos_manipulation.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_krbrelayup.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_ldap_dataexchange.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_local_anon_logon_created.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_logon_explicit_credentials.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_logon_newcredentials.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_lsass_dump_generic.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_lsass_dump.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_multiple_files_renamed_or_deleted.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_net_recon_activity.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_opened_encrypted_zip_filename.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_opened_encrypted_zip_outlook.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_opened_encrypted_zip.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_outbound_kerberos_connection.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_psexec.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_raccess_sensitive_fext.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_rc4_kerberos.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_rottenpotato.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_samr_pwset.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_sdelete.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_time_modification.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_susp_wmi_login.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_svcctl_remote_service.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_syskey_registry_access.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_sysmon_channel_reference_deletion.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_tap_driver_installation.yml

Add missing definition section for EID 4697

2022-10-10 10:22:46 +02:00

win_security_teams_suspicious_objectaccess.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_transf_files_with_cred_data_via_network_shares.yml

Fix file name lenght

2022-10-14 09:11:19 +02:00

win_security_user_added_to_local_administrators.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.yml

Fix file name lenght

2022-10-14 09:11:19 +02:00

win_security_user_creation.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_user_driver_loaded.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_user_logoff.yml

Update win_security_user_logoff.yml

2022-10-14 18:03:40 +02:00

win_security_vssaudit_secevent_source_registration.yml

Rename security rules

2022-10-14 08:53:50 +02:00

win_security_wmi_persistence.yml

Fix related

2022-10-09 17:28:05 +02:00

win_security_wmiprvse_wbemcomn_dll_hijack.yml

Rename security rules

2022-10-14 08:53:50 +02:00