blue-team-tools

create_remote_thread_win_susp_remote_thread_target.yml

feat: more updates

2023-05-05 17:52:47 +02:00

driver_load_win_mal_creddumper.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

driver_load_win_mal_poortry_driver.yml

Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac

2024-11-25 09:30:14 +01:00

driver_load_win_powershell_script_installed_as_service.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

driver_load_win_vuln_avast_anti_rootkit_driver.yml

Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac

2024-11-25 09:30:14 +01:00

driver_load_win_vuln_dell_driver.yml

Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac

2024-11-25 09:30:14 +01:00

driver_load_win_vuln_drivers_names.yml

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

driver_load_win_vuln_gigabyte_driver.yml

Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac

2024-11-25 09:30:14 +01:00

driver_load_win_vuln_hw_driver.yml

Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac

2024-11-25 09:30:14 +01:00

driver_load_win_vuln_lenovo_driver.yml

Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac

2024-11-25 09:30:14 +01:00

file_event_win_access_susp_teams.yml

Merge PR #4920 from @fornotes - Update file_access based rules

2024-07-22 18:53:48 +02:00

file_event_win_access_susp_unattend_xml.yml

Merge PR #4920 from @fornotes - Update file_access based rules

2024-07-22 18:53:48 +02:00

file_event_win_crackmapexec_patterns.yml

Merge PR #4762 from @nasbench - Fix false positives found in testing

2024-03-11 16:58:55 +01:00

file_event_win_hktl_createminidump.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

file_event_win_lsass_memory_dump_file_creation.yml

Merge PR #4406 from @nasbench - Multiple Updates & Additions

2023-09-07 11:42:15 +02:00

file_event_win_mimikatz_memssp_log_file.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

file_event_win_susp_clr_logs.yml

Merge PR #4940 from @fukusuket - Update unreachable references blog.menasec[.]net

2024-07-31 10:16:56 +02:00

image_load_alternate_powershell_hosts_moduleload.yml

feat: more updates

2023-06-01 23:22:35 +02:00

image_load_side_load_advapi32.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

image_load_side_load_scm.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

image_load_side_load_svchost_dlls.yml

Merge PR #4662 from @nasbench - Updated and added new rules

2024-01-10 20:14:20 +01:00

image_load_susp_uncommon_image_load.yml

Merge PR #4679 from @swachchhanda000 - Suspicious unsigned DLL Loaded by RunDLL32/RegSvr32

2024-01-22 11:40:10 +01:00

image_load_susp_winword_wmidll_load.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

net_connection_win_binary_github_com.yml

Merge PR #4754 from @qasimqlf - Update ATT&CK mapping for multiple rules

2024-03-06 17:33:49 +01:00

net_connection_win_reddit_api_non_browser_access.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_susp_epmap.yml

Merge PR #4762 from @nasbench - Fix false positives found in testing

2024-03-11 16:58:55 +01:00

pipe_created_psexec_pipes_artifacts.yml

feat: rules update

2023-08-07 16:09:21 +02:00

posh_pm_powercat.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

posh_ps_access_to_chrome_login_data.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

posh_ps_azurehound_commands.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

posh_ps_cl_invocation_lolscript.yml

feat: update cl diag script rules

2023-08-17 19:26:21 +02:00

posh_ps_cl_mutexverifiers_lolscript.yml

feat: update cl diag script rules

2023-08-17 19:26:21 +02:00

posh_ps_dnscat_execution.yml

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00

posh_ps_file_and_directory_discovery.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

posh_ps_invoke_nightmare.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

posh_ps_susp_gwmi.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

powershell_suspicious_download.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

powershell_suspicious_invocation_generic.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

powershell_suspicious_invocation_specific.yml

refactor: use 1 of selection_*

2023-05-04 14:23:08 +09:00

powershell_syncappvpublishingserver_exe.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_access_win_in_memory_assembly_execution.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_access_win_lazagne_cred_dump_lsass_access.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_lsass_susp_access.yml

Merge PR #4958 from @fukusuket - Update unreachable/broken references

2024-08-10 01:23:58 +02:00

proc_access_win_pypykatz_cred_dump_lsass_access.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_susp_invoke_patchingapi.yml

Merge PR #5007 from @fukusuket - Fix unreachable GitHub URL references

2024-09-13 11:14:11 +02:00

proc_creation_win_apt_apt29_thinktanks.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_apt_dragonfly.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_apt_gallium.yml

Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac

2024-11-25 09:30:14 +01:00

proc_creation_win_apt_hurricane_panda.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_apt_lazarus_activity_apr21.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_apt_lazarus_loader.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_apt_muddywater_dnstunnel.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_apt_ta505_dropper.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_certutil_susp_execution.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_cmd_read_contents.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_cmd_redirect_to_stream.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_credential_acquisition_registry_hive_dumping.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_cscript_vbs.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_execution_mssql_xp_cmdshell_stored_procedure.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_indirect_cmd.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_indirect_command_execution_forfiles.yml

Merge PR #5227 from @Gude5 - Fix small typos in deprecated rules

2025-03-16 03:09:53 +01:00

proc_creation_win_invoke_obfuscation_via_rundll.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_invoke_obfuscation_via_use_rundll32.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_lolbas_execution_of_wuauclt.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_lolbin_findstr.yml

Merge PR #4564 from @nasbench - Fix Further FPs Found In Testing

2023-11-15 15:35:43 +01:00

proc_creation_win_lolbin_office.yml

feat: new rules & updates (#4328 )

2023-07-13 10:01:05 +02:00

proc_creation_win_lolbin_rdrleakdiag.yml

fix: merge rules and update detection

2023-04-24 19:24:19 +02:00

proc_creation_win_lolbins_by_office_applications.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_mal_ryuk.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_malware_trickbot_recon_activity.yml

chore: move rules to new folders (#4205 )

2023-05-02 23:17:57 +02:00

proc_creation_win_mavinject_proc_inj.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_msdt_diagcab.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_new_service_creation.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_nslookup_pwsh_download_cradle.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_odbcconf_susp_exec.yml

feat: add/update rules related to odbcconf (#4228 )

2023-05-23 14:08:56 +02:00

proc_creation_win_office_from_proxy_executing_regsvr32_payload2.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_office_from_proxy_executing_regsvr32_payload.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_office_spawning_wmi_commandline.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_possible_applocker_bypass.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_powershell_amsi_bypass_pattern_nov22.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_powershell_base64_invoke_susp_cmdlets.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_powershell_base64_listing_shadowcopy.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_powershell_base64_shellcode.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_powershell_bitsjob.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_powershell_service_modification.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_powershell_xor_encoded_command.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_reg_dump_sam.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_regsvr32_anomalies.yml

feat: update more regsvr32

2023-05-26 15:59:30 +02:00

proc_creation_win_renamed_paexec.yml

Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac

2024-11-25 09:30:14 +01:00

proc_creation_win_renamed_powershell.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_renamed_psexec.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_renamed_rundll32.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_root_certificate_installed.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_run_from_zip.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_rundll32_js_runhtmlapplication.yml

Merge PR #4973 from @frack113 - Fix date format for some rules along with a broken logsource field

2024-08-16 12:37:51 +02:00

proc_creation_win_rundll32_script_run.yml

Merge PR #4719 from @joshnck - Update Rules Related To RunHTMLApplication Abuse

2024-02-26 11:37:37 +01:00

proc_creation_win_sc_delete_av_services.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_schtasks_user_temp.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_service_stop.yml

chore: fix typo of lowercase Windows in description

2023-06-21 09:52:43 +02:00

proc_creation_win_susp_bitstransfer.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_susp_cmd_exectution_via_wmi.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_susp_commandline_chars.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_susp_lolbin_non_c_drive.yml

Merge PR #4406 from @nasbench - Multiple Updates & Additions

2023-09-07 11:42:15 +02:00

proc_creation_win_susp_run_folder.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_susp_squirrel_lolbin.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_sysinternals_psexec_service_execution.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_sysinternals_psexesvc_start.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_whoami_as_system.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_winword_dll_load.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_wmic_execution_via_office_process.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_wmic_remote_command.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_wmic_remote_service.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

proc_creation_win_wuauclt_execution.yml

Merge PR #4718 from @qasimqlf - Update ATT&CK Mapping For Some Rules

2024-02-26 17:09:30 +01:00

process_creation_syncappvpublishingserver_exe.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

registry_add_sysinternals_sdelete_registry_keys.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

registry_event_asep_reg_keys_modification.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

registry_set_abusing_windows_telemetry_for_persistence.yml

Refractor registry_set rules

2023-08-17 08:57:52 +02:00

registry_set_add_hidden_user.yml

Refractor registry_set rules

2023-08-17 08:57:52 +02:00

registry_set_creation_service_uncommon_folder.yml

Merge PR #4783 from @nasbench - Update registry rules logic and fix some false positives

2024-03-26 13:28:49 +01:00

registry_set_disable_microsoft_office_security_features.yml

Refractor registry_set rules

2023-08-17 08:57:52 +02:00

registry_set_malware_adwind.yml

Merge PR #4783 from @nasbench - Update registry rules logic and fix some false positives

2024-03-26 13:28:49 +01:00

registry_set_office_security.yml

Refractor registry_set rules

2023-08-17 08:57:52 +02:00

registry_set_persistence_com_hijacking_susp_locations.yml

Merge PR #4993 from @nasbench - Fix Issues

2024-09-02 19:03:46 +02:00

registry_set_persistence_search_order.yml

Merge PR #4993 from @nasbench - Fix Issues

2024-09-02 19:03:46 +02:00

registry_set_silentprocessexit.yml

Refractor registry_set rules

2023-08-17 08:57:52 +02:00

sysmon_accessing_winapi_in_powershell_credentials_dumping.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

sysmon_dcom_iertutil_dll_hijack.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

sysmon_mimikatz_detection_lsass.yml

fix:F multiple 404 links in references (#4332 )

2023-06-26 10:10:04 +01:00

sysmon_powershell_execution_moduleload.yml

Merge PR #5227 from @Gude5 - Fix small typos in deprecated rules

2025-03-16 03:09:53 +01:00

sysmon_rclone_execution.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

win_defender_disabled.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

win_dsquery_domain_trust_discovery.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

win_lateral_movement_condrv.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

win_security_event_log_cleared.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

win_security_group_modification_logging.yml

chore: move rules to new folders (#4205 )

2023-05-02 23:17:57 +02:00

win_security_lolbas_execution_of_nltest.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

win_security_windows_defender_exclusions_write_deleted.yml

Merge PR #5176 from @GtUGtHGtNDtEUaE - Update rules covering EventID 4660

2025-01-31 18:08:59 +01:00

win_susp_esentutl_activity.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

win_susp_rclone_exec.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

win_susp_vssadmin_ntds_activity.yml

chore: remove contrib folder + rename folders

2023-04-23 15:42:01 +02:00

win_system_service_install_susp_double_ampersand.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

win_system_susp_sam_dump.yml

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00