security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
f42eb77f299f400ca7527ecd91ef653b68d15a31
blue-team-tools/rules-deprecated/windows
T
History
Nasreddine Bencherchali ea536c33b3 feat: update and merge some pwsh rules
2023-01-20 17:07:23 +01:00
..
file_event_win_hktl_createminidump.yml
Update modified last change
2023-01-02 08:44:46 +01:00
file_event_win_susp_clr_logs.yml
feat: updates and enhancements
2023-01-06 16:35:34 +01:00
image_load_susp_winword_wmidll_load.yml
Update modified last change
2023-01-02 08:44:46 +01:00
posh_pm_powercat.yml
feat: update and merge some pwsh rules
2023-01-20 17:07:23 +01:00
posh_ps_access_to_chrome_login_data.yml
Update modified last change
2023-01-02 08:44:46 +01:00
posh_ps_azurehound_commands.yml
feat: updates and enhancements
2023-01-02 14:49:45 +01:00
posh_ps_invoke_nightmare.yml
feat: updates and enhancements
2023-01-02 14:49:45 +01:00
powershell_suspicious_download.yml
Update modified last change
2023-01-02 08:44:46 +01:00
powershell_suspicious_invocation_generic.yml
Update modified last change
2023-01-02 08:44:46 +01:00
powershell_suspicious_invocation_specific.yml
fix: rollback
2023-01-04 17:54:20 +01:00
powershell_syncappvpublishingserver_exe.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_access_win_in_memory_assembly_execution.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_indirect_cmd.yml
feat: updates and enhancements
2023-01-04 17:49:32 +01:00
proc_creation_win_indirect_command_execution_forfiles.yml
fix: status
2023-01-04 17:55:48 +01:00
proc_creation_win_invoke_obfuscation_via_use_rundll32.yml
Update proc_creation_win_invoke_obfuscation_via_use_rundll32.yml
2022-12-30 09:53:25 +01:00
proc_creation_win_lolbas_execution_of_wuauclt.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_mavinject_proc_inj.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_nslookup_pwsh_download_cradle.yml
fix: add missing modified field
2022-12-14 10:32:11 +01:00
proc_creation_win_office_from_proxy_executing_regsvr32_payload2.yml
feat: general updates and fixes
2022-12-02 23:16:03 +01:00
proc_creation_win_office_from_proxy_executing_regsvr32_payload.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_possible_applocker_bypass.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_powershell_bitsjob.yml
Update modified last change
2023-01-02 08:44:46 +01:00
proc_creation_win_renamed_powershell.yml
fix: merge overlapping detections
2023-01-18 20:18:36 +01:00
proc_creation_win_renamed_psexec.yml
fix: merge overlapping detections
2023-01-18 20:18:36 +01:00
proc_creation_win_renamed_rundll32.yml
fix: merge overlapping detections
2023-01-18 20:18:36 +01:00
proc_creation_win_susp_bitstransfer.yml
fix: some issues
2023-01-11 11:18:54 +01:00
proc_creation_win_susp_cmd_exectution_via_wmi.yml
Update proc_creation_win_susp_cmd_exectution_via_wmi.yml
2023-01-20 06:45:38 +01:00
proc_creation_win_susp_run_folder.yml
Update modified last change
2023-01-02 08:44:46 +01:00
process_creation_syncappvpublishingserver_exe.yml
Update modified last change
2023-01-02 08:44:46 +01:00
registry_event_asep_reg_keys_modification.yml
Update modified last change
2023-01-02 08:44:46 +01:00
registry_set_abusing_windows_telemetry_for_persistence.yml
Update modified last change
2023-01-02 08:44:46 +01:00
registry_set_silentprocessexit.yml
Update modified last change
2023-01-02 08:44:46 +01:00
sysmon_accessing_winapi_in_powershell_credentials_dumping.yml
Refractor (#3794)
2022-12-18 21:00:14 +01:00
sysmon_dcom_iertutil_dll_hijack.yml
Refractor (#3794)
2022-12-18 21:00:14 +01:00
sysmon_mimikatz_detection_lsass.yml
Update modified last change
2023-01-02 08:44:46 +01:00
sysmon_rclone_execution.yml
Update modified last change
2023-01-02 08:44:46 +01:00
win_lateral_movement_condrv.yml
Update modified last change
2023-01-02 08:44:46 +01:00
win_susp_esentutl_activity.yml
Update modified last change
2023-01-02 08:44:46 +01:00
win_susp_rclone_exec.yml
Update modified last change
2023-01-02 08:44:46 +01:00
win_susp_vssadmin_ntds_activity.yml
Update modified last change
2023-01-02 08:44:46 +01:00