security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
Files
fb167c5698ff01a30d2ada8eaa53c4e2dee2e54a
blue-team-tools/rules/windows/builtin/system
T
History
frack113 e2b70a2edb add win_susp_system_update_error rule
2021-12-04 13:02:12 +01:00
..
win_apt_carbonpaper_turla.yml
Order rules
2021-12-04 10:07:07 +01:00
win_apt_chafer_mar18_system.yml
Order rules
2021-12-04 10:07:07 +01:00
win_apt_stonedrill.yml
Order rules
2021-12-04 10:07:07 +01:00
win_apt_turla_service_png.yml
Order rules
2021-12-04 10:07:07 +01:00
win_cobaltstrike_service_installs.yml
Order rules
2021-12-04 10:07:07 +01:00
win_hack_smbexec.yml
Order rules
2021-12-04 10:07:07 +01:00
win_invoke_obfuscation_clip_services.yml
Order rules
2021-12-04 10:07:07 +01:00
win_invoke_obfuscation_obfuscated_iex_services.yml
Order rules
2021-12-04 10:07:07 +01:00
win_invoke_obfuscation_stdin_services.yml
Order rules
2021-12-04 10:07:07 +01:00
win_invoke_obfuscation_var_services.yml
Order rules
2021-12-04 10:07:07 +01:00
win_invoke_obfuscation_via_compress_services.yml
Order rules
2021-12-04 10:07:07 +01:00
win_invoke_obfuscation_via_rundll_services.yml
Order rules
2021-12-04 10:07:07 +01:00
win_invoke_obfuscation_via_stdin_services.yml
Order rules
2021-12-04 10:07:07 +01:00
win_invoke_obfuscation_via_use_clip_services.yml
Order rules
2021-12-04 10:07:07 +01:00
win_invoke_obfuscation_via_use_mshta_services.yml
Order rules
2021-12-04 10:07:07 +01:00
win_invoke_obfuscation_via_use_rundll32_services.yml
Order rules
2021-12-04 10:07:07 +01:00
win_invoke_obfuscation_via_var_services.yml
Order rules
2021-12-04 10:07:07 +01:00
win_mal_creddumper.yml
Order rules
2021-12-04 10:07:07 +01:00
win_meterpreter_or_cobaltstrike_getsystem_service_installation.yml
Order rules
2021-12-04 10:07:07 +01:00
win_moriya_rootkit.yml
Order rules
2021-12-04 10:07:07 +01:00
win_ntfs_vuln_exploit.yml
Order rules
2021-12-04 10:07:07 +01:00
win_pcap_drivers.yml
Order rules
2021-12-04 10:07:07 +01:00
win_possible_zerologon_exploitation_using_wellknown_tools.yml
Order rules
2021-12-04 10:07:07 +01:00
win_powershell_script_installed_as_service.yml
Order rules
2021-12-04 10:07:07 +01:00
win_quarkspwdump_clearing_hive_access_history.yml
Order rules
2021-12-04 10:07:07 +01:00
win_rare_service_installs.yml
Order rules
2021-12-04 10:07:07 +01:00
win_rdp_potential_cve_2019_0708.yml
Order rules
2021-12-04 10:07:07 +01:00
win_susp_dhcp_config_failed.yml
Order rules
2021-12-04 10:07:07 +01:00
win_susp_dhcp_config.yml
Order rules
2021-12-04 10:07:07 +01:00
win_susp_proceshacker.yml
Order rules
2021-12-04 10:07:07 +01:00
win_susp_sam_dump.yml
Order rules
2021-12-04 10:07:07 +01:00
win_susp_system_update_error.yml
add win_susp_system_update_error rule
2021-12-04 13:02:12 +01:00
win_system_defender_disabled.yml
Order rules
2021-12-04 10:07:07 +01:00
win_system_susp_eventlog_cleared.yml
Order rules
2021-12-04 10:07:07 +01:00
win_tap_driver_installation.yml
Order rules
2021-12-04 10:07:07 +01:00
win_tool_psexec.yml
Order rules
2021-12-04 10:07:07 +01:00
win_volume_shadow_copy_mount.yml
Order rules
2021-12-04 10:07:07 +01:00
win_vul_cve_2020_1472.yml
Order rules
2021-12-04 10:07:07 +01:00