security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
eb06a6fdd152ed1fa3fad65a8cb53b51e9d6b74a
blue-team-tools/rules/windows/powershell/powershell_script
T
History
Florian Roth eb06a6fdd1 Merge pull request #2764 from SigmaHQ/rule-devel 
refactor: PowerShell Defender modifications
2022-03-03 23:29:08 +01:00
..
posh_ps_access_to_browser_login_data.yml
Change status and related
2022-02-03 06:53:50 +01:00
posh_ps_access_to_chrome_login_data.yml
Change status and related
2022-02-03 06:53:50 +01:00
posh_ps_accessing_win_api.yml
fix: FP
2022-02-23 17:18:53 +01:00
posh_ps_adrecon_execution.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_automated_collection.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_azurehound_commands.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_capture_screenshots.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_cl_invocation_lolscript_count.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_cl_invocation_lolscript.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_cl_mutexverifiers_lolscript_count.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_cl_mutexverifiers_lolscript.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_clear_powershell_history.yml
Update posh_ps_clear_powershell_history.yml
2022-01-27 16:16:57 +01:00
posh_ps_clearing_windows_console_history.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_cmdlet_scheduled_task.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_copy_item_system32.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_cor_profiler.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_create_local_user.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_create_volume_shadow_copy.yml
Windows Redcannary
2022-01-12 20:27:56 +01:00
posh_ps_data_compressed.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_detect_vm_env.yml
update Author contribute
2022-03-03 14:34:13 +07:00
posh_ps_directorysearcher.yml
Windows Redcannary
2022-02-12 15:53:13 +01:00
posh_ps_directoryservices_accountmanagement.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_dnscat_execution.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_dump_password_windows_credential_manager.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_enable_psremoting.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_enumerate_password_windows_credential_manager.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_file_and_directory_discovery.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_get_acl_service.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_get_adreplaccount.yml
refactor: increased level to medium
2022-02-06 14:17:38 +01:00
posh_ps_get_childitem_bookmarks.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_icmp_exfiltration.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_command_remote.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_dnsexfiltration.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_nightmare.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_obfuscation_clip.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_obfuscation_obfuscated_iex.yml
fix: used in legitimate microsoft scripts
2022-02-02 11:00:43 +01:00
posh_ps_invoke_obfuscation_stdin.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_obfuscation_var.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_obfuscation_via_compress.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_obfuscation_via_rundll.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_obfuscation_via_stdin.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_obfuscation_via_use_clip.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_obfuscation_via_use_mhsta.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_obfuscation_via_use_rundll32.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_invoke_obfuscation_via_var.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_keylogging.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_localuser.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_malicious_commandlets.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_malicious_keywords.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_memorydump_getstoragediagnosticinfo.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_msxml_com.yml
Add Redcannary Windows Rules
2022-01-19 20:40:43 +01:00
posh_ps_nishang_malicious_commandlets.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_ntfs_ads_access.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_office_comobject_registerxll.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_powerview_malicious_commandlets.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_prompt_credentials.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_psattack.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_remote_session_creation.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_remove_item_path.yml
Windows Redcannary
2022-01-15 17:04:03 +01:00
posh_ps_request_kerberos_ticket.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_root_certificate_installed.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_run_from_mount_diskimage.yml
Windows Redcannary T1553.005
2022-02-01 18:41:53 +01:00
posh_ps_security_software_discovery.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_send_mailmessage.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_set_policies_to_unsecure_level.yml
fix: reduce level, many legitimate usages expected
2022-02-23 14:13:12 +01:00
posh_ps_shellcode_b64.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_shellintel_malicious_commandlets.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_software_discovery.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_store_file_in_alternate_data_stream.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_susp_invoke_webrequest_useragent.yml
Windows Redcannary
2022-01-23 16:37:59 +01:00
posh_ps_susp_remove_adgroupmember.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_susp_ssl_keyword.yml
Redcannary windows test
2022-01-23 11:37:01 +01:00
posh_ps_susp_wallpaper.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_susp_win32_shadowcopy.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_susp_zip_compress.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_suspicious_ad_group_reco.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_suspicious_download.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_suspicious_execute_batch_script.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_suspicious_export_pfxcertificate.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_suspicious_extracting.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_suspicious_getprocess_lsass.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_suspicious_gwmi.yml
Windows Redcannary
2022-01-12 20:27:56 +01:00
posh_ps_suspicious_invocation_generic.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_suspicious_invocation_specific.yml
fix: FPs noticed in THOR testing
2022-02-21 10:15:27 +01:00
posh_ps_suspicious_iofilestream.yml
fix detection
2022-01-10 17:48:46 +01:00
posh_ps_suspicious_keywords.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_suspicious_local_group_reco.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_suspicious_mail_acces.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_suspicious_mount_diskimage.yml
Windows Redcannary T1553.005
2022-02-01 18:41:53 +01:00
posh_ps_suspicious_mounted_share_deletion.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_suspicious_networkcredential.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_suspicious_new_psdrive.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_suspicious_recon.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_suspicious_smb_share_reco.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_suspicious_start_process.yml
Windows Redcannary
2022-01-15 17:04:03 +01:00
posh_ps_suspicious_unblock_file.yml
Windows Redcannary T1553.005
2022-02-01 18:41:53 +01:00
posh_ps_suspicious_win32_pnpentity.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_suspicious_windowstyle.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_syncappvpublishingserver_exe.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_tamper_defender.yml
refactor: PowerShell Defender modifications
2022-03-03 13:53:06 +01:00
posh_ps_test_netconnection.yml
Fix space
2022-01-23 11:40:35 +01:00
posh_ps_timestomp.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_trigger_profiles.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_upload.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_web_request.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_windows_firewall_profile_disabled.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_winlogon_helper_dll.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_wmi_persistence.yml
Rename powershell_script
2022-01-15 10:54:21 +01:00
posh_ps_wmimplant.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_ps_xml_iex.yml
Add Redcannary Windows Rules
2022-01-19 20:40:43 +01:00