security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
e9ed7d05e1e925a89fc0c8bcbbbeaca4dcbb88dd
blue-team-tools/rules/windows/registry/registry_set
T
History
Florian Roth 14fdf75ab5 fix: FPs noticed with THOR
2022-09-29 13:51:09 +02:00
..
registry_set_abusing_windows_telemetry_for_persistence.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_add_hidden_user.yml
Update registry_set_add_hidden_user.yml
2022-08-21 08:28:16 +02:00
registry_set_add_load_service_in_safe_mode.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_add_port_monitor.yml
fix: syntax error
2022-09-18 16:24:07 +02:00
registry_set_aedebug_persistence.yml
Persistence Rules
2022-07-21 21:13:10 +01:00
registry_set_allow_rdp_remote_assistance_feature.yml
More updates
2022-09-02 11:52:13 +02:00
registry_set_asep_reg_keys_modification_classes.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_asep_reg_keys_modification_common.yml
Update
2022-08-24 12:23:00 +01:00
registry_set_asep_reg_keys_modification_currentcontrolset.yml
fix: FPs from new evtx-baseline
2022-09-21 13:51:19 +02:00
registry_set_asep_reg_keys_modification_currentversion_nt.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_asep_reg_keys_modification_currentversion.yml
fix: FPs from new evtx-baseline
2022-09-21 13:51:19 +02:00
registry_set_asep_reg_keys_modification_internet_explorer.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_asep_reg_keys_modification_office.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_asep_reg_keys_modification_session_manager.yml
Final update
2022-08-10 18:33:17 +01:00
registry_set_asep_reg_keys_modification_system_scripts.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_asep_reg_keys_modification_winsock2.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_asep_reg_keys_modification_wow6432node_classes.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_asep_reg_keys_modification_wow6432node.yml
fix: FPs from new evtx-baseline
2022-09-21 13:51:19 +02:00
registry_set_blackbyte_ransomware.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_bypass_uac_using_delegateexecute.yml
Added quotes to strings
2022-09-01 15:22:26 +02:00
registry_set_bypass_uac_using_eventviewer.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_bypass_uac_using_silentcleanup_task.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_change_rdp_port.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_change_security_zones.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_change_sysmon_driver_altitude.yml
Sysmon driver altitude change
2022-07-29 08:34:25 +02:00
registry_set_change_winevt_channelaccess.yml
fix: FPs noticed with THOR
2022-09-29 13:51:09 +02:00
registry_set_chm_persistence.yml
Persistence Rules
2022-07-21 21:13:10 +01:00
registry_set_chrome_extension.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_cobaltstrike_service_installs.yml
Fix FP's
2022-07-11 18:33:54 +01:00
registry_set_comhijack_sdclt.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_crashdump_disabled.yml
Order
2022-08-24 18:42:56 +02:00
registry_set_creation_service_susp_folder.yml
Merge rules 1
2022-08-01 16:01:18 +01:00
registry_set_creation_service_uncommon_folder.yml
Reference Update [Batch 1]
2022-07-07 15:24:15 +01:00
registry_set_custom_file_open_handler_powershell_execution.yml
Update registry_set_custom_file_open_handler_powershell_execution.yml
2022-06-11 10:40:04 -04:00
registry_set_cve_2020_1048_new_printer_port.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_cve_2021_31979_cve_2021_33771_exploits.yml
Order
2022-08-24 18:42:56 +02:00
registry_set_cve_2022_30190_msdt_follina.yml
Create registry_set_cve_2022_30190_msdt_follina.yml
2022-05-31 12:07:37 +07:00
registry_set_dbgmanageddebugger_persistence.yml
Add registry_set_dbgmanageddebugger_persistence.yml
2022-08-07 10:30:30 +02:00
registry_set_defender_exclusions.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_dhcp_calloutdll.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_disable_administrative_share.yml
Added quotes to strings
2022-09-01 15:22:26 +02:00
registry_set_disable_autologger_sessions.yml
fix: FPs (testing, and Windows 2022 test system)
2022-09-18 16:21:05 +02:00
registry_set_disable_defender_firewall.yml
Added quotes to strings
2022-09-01 15:22:26 +02:00
registry_set_disable_function_user.yml
More updates
2022-09-02 11:52:13 +02:00
registry_set_disable_microsoft_office_security_features.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_disable_security_center_notifications.yml
Added quotes to strings
2022-09-01 15:22:26 +02:00
registry_set_disable_system_restore.yml
Big Update
2022-09-09 15:02:31 +02:00
registry_set_disable_uac_registry.yml
Update registry_set_disable_uac_registry.yml
2022-08-29 20:12:10 +02:00
registry_set_disable_windows_defender_service.yml
Merge rules 2
2022-08-01 16:01:51 +01:00
registry_set_disable_windows_firewall.yml
Update ref
2022-08-19 17:20:34 +02:00
registry_set_disable_winevt_logging.yml
fix: FP in testing environment
2022-09-21 13:45:26 +02:00
registry_set_disabled_exploit_guard_net_protection_on_ms_defender.yml
Update PowerShell + other rules
2022-08-05 17:10:41 +01:00
registry_set_disabled_microsoft_defender_eventlog.yml
rule: Disabled Windows Defender Eventlog
2022-07-04 13:20:20 +02:00
registry_set_disabled_pua_protection_on_microsoft_defender.yml
refactor: improved old rule
2022-07-04 13:20:40 +02:00
registry_set_disabled_tamper_protection_on_microsoft_defender.yml
fix: FPs found in win2022 domain controller baseline
2022-04-21 10:48:59 +02:00
registry_set_disallowrun_execution.yml
Added quotes to strings
2022-09-01 15:22:26 +02:00
registry_set_disk_cleanup_handler_autorun_persistence.yml
Fix FP
2022-07-21 21:46:34 +01:00
registry_set_dns_over_https_enabled.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_dns_serverlevelplugindll.yml
Order
2022-08-24 18:42:56 +02:00
registry_set_enabling_cor_profiler_env_variables.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_enabling_turnoffcheck.yml
Big Update
2022-09-09 15:02:31 +02:00
registry_set_etw_disabled.yml
refactor: rule level adjustments - critical to high
2022-06-18 17:43:22 +02:00
registry_set_exploit_guard_susp_allowed_apps.yml
Update registry_set_exploit_guard_susp_allowed_apps.yml
2022-08-05 17:13:15 +01:00
registry_set_fax_change_service_user.yml
reordered fields
2022-07-18 12:17:53 +02:00
registry_set_fax_dll_persistance.yml
Update registry_set_fax_dll_persistance.yml
2022-08-29 20:10:25 +02:00
registry_set_file_association_exefile.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_globalflags_persistence.yml
More updates
2022-09-07 12:02:09 +02:00
registry_set_hangs_debugger_persistence.yml
Persistence Rules
2022-07-21 21:13:10 +01:00
registry_set_hhctrl_persistence.yml
More additions and updates
2022-08-10 12:52:49 +01:00
registry_set_hidden_extention.yml
Added quotes to strings
2022-09-01 15:22:26 +02:00
registry_set_hide_file.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_hide_function_user.yml
Big Update
2022-09-09 15:02:31 +02:00
registry_set_hide_scheduled_task_via_index_tamper.yml
New + Update
2022-08-26 15:38:43 +01:00
registry_set_ie_persistence.yml
Added quotes to strings
2022-09-01 15:22:26 +02:00
registry_set_ifilter_persistence.yml
Update registry_set_ifilter_persistence.yml
2022-07-21 21:22:53 +01:00
registry_set_install_root_or_ca_certificat.yml
Big Update
2022-09-09 15:02:31 +02:00
registry_set_lolbin_onedrivestandaloneupdater.yml
Renamed LOLBIN rules + Other
2022-06-12 23:59:25 +01:00
registry_set_lsa_extension_persistence.yml
Persistence Rules
2022-07-21 21:13:10 +01:00
registry_set_mal_adwind.yml
Added quotes to strings
2022-09-01 15:22:26 +02:00
registry_set_mal_blue_mockingbird.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_mpnotify_persistence.yml
Update registry_set_mpnotify_persistence.yml
2022-08-29 20:11:29 +02:00
registry_set_new_application_appcompat.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_new_network_provider.yml
fix: FPs (testing, and Windows 2022 test system)
2022-09-18 16:21:05 +02:00
registry_set_office_enable_dde.yml
Added quotes to strings
2022-09-01 15:22:26 +02:00
registry_set_office_security.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_office_vsto_persistence.yml
fix: FP with AVG anti virus
2022-06-13 13:30:21 +02:00
registry_set_outlook_c2_registry_key.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_outlook_registry_todaypage.yml
Added quotes to strings
2022-09-01 15:22:26 +02:00
registry_set_outlook_registry_webview.yml
Add missing EventType
2022-06-26 17:41:23 +02:00
registry_set_outlook_security.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_persistence_appx_debugger.yml
Persistence appx
2022-07-28 07:04:53 +02:00
registry_set_persistence_autodial_dll.yml
Update registry_set_persistence_autodial_dll.yml
2022-08-29 07:48:27 +02:00
registry_set_persistence_com_hijacking_susp_locations.yml
Add %tmp% env variable
2022-09-13 10:49:14 +02:00
registry_set_persistence_mycomputer.yml
More additions and updates
2022-08-10 12:52:49 +01:00
registry_set_persistence_search_order.yml
fix: FPs from new evtx-baseline
2022-09-21 13:51:19 +02:00
registry_set_persistence_typed_paths.yml
TypedPaths
2022-08-22 20:04:43 +01:00
registry_set_policies_associations_tamper.yml
Update registry_set_policies_associations_tamper.yml
2022-08-02 09:15:57 +02:00
registry_set_policies_attachments_tamper.yml
Update registry_set_policies_attachments_tamper.yml
2022-08-02 09:17:08 +02:00
registry_set_powershell_as_service.yml
More additions and updates
2022-08-10 12:52:49 +01:00
registry_set_powershell_in_run_keys.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_powershell_logging_disabled.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_renamed_sysinternals_eula_accepted.yml
New + Update
2022-08-26 15:38:43 +01:00
registry_set_scr_file_executed_by_rundll32.yml
fix: lowercase false positive
2022-05-12 21:56:46 +02:00
registry_set_scrobj_dll_persistence.yml
Fix test error
2022-08-20 12:07:01 +02:00
registry_set_servicedll_hijack.yml
fix: FPs from new evtx-baseline
2022-09-21 13:51:19 +02:00
registry_set_set_nopolicies_user.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_shim_databases_persistence.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_silentprocessexit.yml
More updates
2022-09-07 12:02:09 +02:00
registry_set_sip_persistence.yml
fix: FPs from new evtx-baseline
2022-09-21 13:51:19 +02:00
registry_set_sophos_av_tamaper.yml
Update registry_set_sophos_av_tamaper.yml
2022-09-02 13:53:59 +02:00
registry_set_special_accounts.yml
DFIR Report - SELECT XMRig FROM SQLServer
2022-07-12 01:27:51 +01:00
registry_set_suppress_defender_notifications.yml
Update ref
2022-08-19 17:20:34 +02:00
registry_set_susp_app_paths_persistence.yml
Add %tmp% env variable
2022-09-13 10:49:14 +02:00
registry_set_susp_keyboard_layout_load.yml
Renamed suspicious in filenames to susp
2022-05-19 09:37:04 +02:00
registry_set_susp_printer_driver.yml
fix: FPs from new evtx-baseline
2022-09-21 13:51:19 +02:00
registry_set_susp_reg_persist_explorer_run.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_susp_run_key_img_folder.yml
Add %tmp% env variable
2022-09-13 10:49:14 +02:00
registry_set_susp_service_installed.yml
chore: test rules: reactivate single value list check
2022-05-10 17:13:04 +02:00
registry_set_taskcache_entry.yml
fix: FP with .NET ngen on test system
2022-09-16 16:40:40 +02:00
registry_set_telemetry_persistence.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_terminal_server_suspicious.yml
fix: FPs noticed in THOR testing
2022-09-29 13:41:20 +02:00
registry_set_terminal_server_tampering.yml
fix: FPs noticed in THOR testing
2022-09-29 13:41:20 +02:00
registry_set_timeproviders_dllname.yml
Update Ref+Selection 2
2022-07-11 17:48:40 +01:00
registry_set_treatas_persistence.yml
Fix FP
2022-09-29 11:20:08 +02:00
registry_set_uac_bypass_eventvwr.yml
refactor: rule level adjustments - critical to high
2022-06-18 17:43:22 +02:00
registry_set_uac_bypass_sdclt.yml
Added quotes to strings
2022-09-01 15:22:26 +02:00
registry_set_uac_bypass_winsat.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_uac_bypass_wmp.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_vbs_payload_stored.yml
fix: FP with VBScript in registry key rule
2022-09-19 09:23:15 +02:00
registry_set_wab_dllpath_reg_change.yml
Reference Update [Batch 1]
2022-07-07 15:24:15 +01:00
registry_set_wdigest_enable_uselogoncredential.yml
Order registry
2022-04-04 15:45:32 +02:00
registry_set_windows_defender_tamper.yml
Updates + New Rules
2022-08-09 18:35:45 +01:00
registry_set_winlogon_allow_multiple_tssessions.yml
Big Update
2022-09-09 15:02:31 +02:00
registry_set_winlogon_notify_key.yml
Persistence Rules
2022-07-21 21:13:10 +01:00
regsitry_set_natural_language_persistence.yml
Persistence Rules
2022-07-21 21:13:10 +01:00