blue-team-tools

sysmon_ads_executable.yml

Move null values out from list in rules

2020-06-03 13:57:22 +02:00

sysmon_alternate_powershell_hosts_pipe.yml

fix FP + remove powershell rule redundant with sysmon_in_memory_powershell.yml

2020-05-23 10:56:23 -04:00

sysmon_apt_muddywater_dnstunnel.yml

fix: missed line

2020-06-09 17:30:54 +02:00

sysmon_apt_oceanlotus_registry.yml

sysmon registry events fix

2020-03-09 12:02:04 -04:00

sysmon_apt_pandemic.yml

fix sysmon registry rules with HKLM/HKU format as used since 02/2017 in sysmon

2020-03-04 12:47:42 -05:00

sysmon_apt_turla_namedpipes.yml

…

sysmon_asep_reg_keys_modification.yml

Rule fixes

2020-02-20 23:00:16 +01:00

sysmon_cactustorch.yml

…

sysmon_cmstp_execution.yml

filter on createkey only when needed

2020-05-22 10:37:00 -04:00

sysmon_cobaltstrike_process_injection.yml

…

sysmon_createremotethread_loadlibrary.yml

…

sysmon_creation_system_file.yml

Add tagg Endswith

2020-05-29 16:25:54 +02:00

sysmon_cred_dump_lsass_access.yml

Rule fixes

2020-02-20 23:00:16 +01:00

sysmon_cred_dump_tools_dropped_files.yml

Update sysmon_cred_dump_tools_dropped_files.yml

2020-02-28 15:16:18 +01:00

sysmon_cred_dump_tools_named_pipes.yml

Rule fixes

2020-02-20 23:00:16 +01:00

sysmon_cve-2020-1048.yml

Update to sysmon_cve-2020-1048

2020-05-26 11:20:21 +02:00

sysmon_dhcp_calloutdll.yml

…

sysmon_disable_security_events_logging_adding_reg_key_minint.yml

filter on createkey only when needed

2020-05-22 10:37:00 -04:00

sysmon_dns_serverlevelplugindll.yml

…

sysmon_etw_disabled.yml

merged Cyb3rWarD0g's rules

2020-06-06 15:42:22 +02:00

sysmon_ghostpack_safetykatz.yml

…

sysmon_hack_dumpert.yml

…

sysmon_hack_wce.yml

…

sysmon_in_memory_assembly_execution.yml

Date typos...more than I thought...

2020-04-02 10:00:00 +02:00

sysmon_in_memory_powershell.yml

fix FP + remove powershell rule redundant with sysmon_in_memory_powershell.yml

2020-05-23 10:56:23 -04:00

sysmon_invoke_phantom.yml

…

sysmon_logon_scripts_userinitmprlogonscript.yml

Rule lists extra Sysmon ID (11). Should just match registry events (12-14)

2020-06-15 13:52:12 -04:00

sysmon_lsass_memdump.yml

…

sysmon_lsass_memory_dump_file_creation.yml

All Rules use 'TargetFilename' instead of 'TargetFileName'.

2020-06-03 09:00:59 +02:00

sysmon_mal_namedpipes.yml

…

sysmon_malware_backconnect_ports.yml

…

sysmon_malware_verclsid_shellcode.yml

…

sysmon_mimikatz_inmemory_detection.yml

…

sysmon_mimikatz_trough_winrm.yml

…

sysmon_narrator_feedback_persistance.yml

…

sysmon_new_dll_added_to_appcertdlls_registry_key.yml

sysmon registry events fix

2020-03-09 12:02:04 -04:00

sysmon_new_dll_added_to_appinit_dlls_registry_key.yml

fix: description over multiple lines

2020-06-06 13:56:48 +02:00

sysmon_notepad_network_connection.yml

Update condition to filter out printer port

2020-05-14 18:22:49 +07:00

sysmon_office_persistence.yml

Fixed bad indentation

2020-06-10 15:02:41 +02:00

sysmon_password_dumper_lsass.yml

…

sysmon_possible_dns_rebinding.yml

…

sysmon_possible_privilege_escalation_via_service_registry_permissions_weakness.yml

Rule fixes

2020-02-20 23:00:16 +01:00

sysmon_powershell_execution_moduleload.yml

…

sysmon_powershell_exploit_scripts.yml

…

sysmon_powershell_network_connection.yml

…

sysmon_quarkspw_filedump.yml

…

sysmon_raw_disk_access_using_illegitimate_tools.yml

Rule fixes

2020-02-20 23:00:16 +01:00

sysmon_rdp_registry_modification.yml

…

sysmon_rdp_reverse_tunnel.yml

…

sysmon_rdp_settings_hijack.yml

…

sysmon_reg_office_security.yml

Cosmetics

2020-06-10 16:35:14 +02:00

sysmon_registry_persistence_key_linking.yml

filter on createkey only when needed

2020-05-22 10:37:00 -04:00

sysmon_registry_persistence_search_order.yml

Add Windows Registry Persistence COM Search Order Hijacking

2020-04-14 12:59:29 +02:00

sysmon_registry_trust_record_modification.yml

fix: converted CRLF line break to LF

2020-03-25 14:36:34 +01:00

sysmon_regsvr32_network_activity.yml

Rule fixes

2020-02-20 23:00:16 +01:00

sysmon_remote_powershell_session_network.yml

…

sysmon_rundll32_net_connections.yml

…

sysmon_ssp_added_lsa_config.yml

…

sysmon_stickykey_like_backdoor.yml

…

sysmon_susp_adsi_cache_usage.yml

Fix rules with incorrect escaping of wildcars

2020-06-15 13:38:18 -04:00

sysmon_susp_desktop_ini.yml

Update sysmon_susp_desktop_ini.yml

2020-03-28 13:19:10 +01:00

sysmon_susp_download_run_key.yml

…

sysmon_susp_driver_load.yml

…

sysmon_susp_fax_dll.yml

Fax Service DLL search order hijacking

2020-06-10 15:01:07 +02:00

sysmon_susp_image_load.yml

…

sysmon_susp_lsass_dll_load.yml

…

sysmon_susp_office_dotnet_assembly_dll_load.yml

Fix rules with incorrect escaping of wildcars

2020-06-15 13:38:18 -04:00

sysmon_susp_office_dotnet_clr_dll_load.yml

fix: converted CRLF line break to LF

2020-03-25 14:36:34 +01:00

sysmon_susp_office_dotnet_gac_dll_load.yml

various rules cleaning

2020-05-18 20:29:53 -04:00

sysmon_susp_office_dsparse_dll_load.yml

fix: converted CRLF line break to LF

2020-03-25 14:36:34 +01:00

sysmon_susp_office_kerberos_dll_load.yml

various rules cleaning

2020-05-18 20:29:53 -04:00

sysmon_susp_powershell_rundll32.yml

…

sysmon_susp_procexplorer_driver_created_in_tmp_folder.yml

Fix rules with incorrect escaping of wildcars

2020-06-15 13:38:18 -04:00

sysmon_susp_prog_location_network_connection.yml

…

sysmon_susp_rdp.yml

…

sysmon_susp_reg_persist_explorer_run.yml

sysmon registry events fix

2020-03-09 12:02:04 -04:00

sysmon_susp_run_key_img_folder.yml

Remove AppData folder as suspicious folder

2020-05-24 15:16:07 +02:00

sysmon_susp_service_installed.yml

Casing

2020-04-14 13:40:34 +02:00

sysmon_susp_winword_vbadll_load.yml

various rules cleaning

2020-05-18 20:29:53 -04:00

sysmon_susp_winword_wmidll_load.yml

…

sysmon_suspicious_dbghelp_dbgcore_load.yml

fix test

2020-05-23 10:02:58 -04:00

sysmon_suspicious_keyboard_layout_load.yml

Fix rules with incorrect escaping of wildcars

2020-06-15 13:38:18 -04:00

sysmon_suspicious_outbound_kerberos_connection.yml

Rule fixes

2020-02-20 23:00:16 +01:00

sysmon_suspicious_remote_thread.yml

Date typos...more than I thought...

2020-04-02 10:00:00 +02:00

sysmon_svchost_dll_search_order_hijack.yml

Fix rules with incorrect escaping of wildcars

2020-06-15 13:38:18 -04:00

sysmon_sysinternals_eula_accepted.yml

…

sysmon_tsclient_filewrite_startup.yml

All Rules use 'TargetFilename' instead of 'TargetFileName'.

2020-06-03 09:00:59 +02:00

sysmon_uac_bypass_eventvwr.yml

fix sysmon registry rules with HKLM/HKU format as used since 02/2017 in sysmon

2020-03-04 12:47:42 -05:00

sysmon_uac_bypass_sdclt.yml

sysmon registry events fix

2020-03-09 12:02:04 -04:00

sysmon_unsigned_image_loaded_into_lsass.yml

Rule fixes

2020-02-20 23:00:16 +01:00

sysmon_webshell_creation_detect.yml

flake 8

2020-05-18 10:03:18 -04:00

sysmon_win_binary_github_com.yml

…

sysmon_win_binary_susp_com.yml

…

sysmon_win_reg_persistence.yml

…

sysmon_wmi_event_subscription.yml

…

sysmon_wmi_module_load.yml

add more FP

2020-05-25 04:50:22 -04:00

sysmon_wmi_persistence_commandline_event_consumer.yml

Rule needs endwith, not exact match.

2020-06-15 13:54:02 -04:00

sysmon_wmi_persistence_script_event_consumer_write.yml

…

sysmon_wmi_susp_scripting.yml

…