security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
8ca32f14237da3aef0f2fae5437c5b4e8335c977
sigma-rules/rta
T
History
Andrew Pease d68e4ac7f0 [New Rule] Hosts File Modified (#25)
2020-09-30 15:24:07 -08:00
..
bin
Rename PsRunner_License to PsRunner_LICENSE
2020-06-30 10:04:11 -06:00
__init__.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
__main__.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
adobe_hijack.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
appcompat_shim.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
at_command.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
bitsadmin_download.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
brute_force_login.py
Remove unreachable and legacy code
2020-06-30 10:12:23 -06:00
certutil_file_obfuscation.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
certutil_webrequest.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
common.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
comsvcs_dump.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
dcom_lateral_movement_with_mmc.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
delete_bootconf.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
delete_catalogs.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
delete_usnjrnl.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
delete_volume_shadows.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
disable_windows_fw.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
enum_commands.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
findstr_pw_search.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
globalflags.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
hosts_file_modify.py
[New Rule] Hosts File Modified (#25)
2020-09-30 15:24:07 -08:00
installutil_network.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
iqy_file_writes.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
lateral_command_psexec.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
lateral_commands.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
linux_compress_sensitive_files.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
linux_discovery_sensitive_files.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
mac_office_descendant.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
modification_of_wdigest_security_provider.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
ms_office_drop_exe.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
msbuild_network.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
mshta_network.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
msiexec_http_installer.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
msxsl_network.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
net_user_add.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
obfuscated_cmd_commands.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
obfuscated_powershell.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
office_application_startup.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
persistent_scripts.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
port_monitor.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
powershell_args.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
powershell_base64_gzip.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
powershell_from_script.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
process_double_extension.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
process_extension_anomalies.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
process_name_masquerade.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
recycle_bin_process.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
registry_hive_export.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
registry_persistence_create.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
registry_rdp_enable.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
regsvr32_scrobj.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
rundll32_inf_callback.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
rundll32_javascript_callback.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
schtask_escalation.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
scrobj_com_hijack.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
secure_file_deletion.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
settingcontentms_files.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
sevenzip_encrypted.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
shortcut_file_suspicious_process.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
sip_provider.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
smb_connection.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
sticky_keys_write_execute.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
suspicious_dll_registration_regsvr32.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
suspicious_office_children.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
suspicious_office_descendant_fp.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
suspicious_powershell_download.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
suspicious_wmic_script.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
suspicious_wscript_parent.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
system_restore_process.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
trust_provider.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
uac_eventviewer.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
uac_sdclt.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
uac_sysprep.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
uncommon_persistence.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
unusual_ms_tool_network.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
unusual_parent_child.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
user_dir_escalation.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
vaultcmd_commands.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
werfault_persistence.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
wevtutil_log_clear.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
winrar_encrypted.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
winrar_startup_folder.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00
wmi_incoming_logon.py
Populate RTA directory.
2020-06-29 23:07:18 -06:00