CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
034f9c0957aea6c623ea8a7dd633312ebfb2bb33
hayabusa/rules/sigma/windows/powershell/powershell_script
History
itiB 034f9c0957 Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
..
powershell_accessing_win_api.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_adrecon_execution.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_automated_collection.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_cl_invocation_lolscript_count.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_cl_invocation_lolscript.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_cl_mutexverifiers_lolscript_count.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_cl_mutexverifiers_lolscript.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_create_local_user.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_data_compressed.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_detect_vm_env.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_dnscat_execution.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_icmp_exfiltration.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_invoke_nightmare.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_invoke_obfuscation_clip_in_scriptblocktext.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_invoke_obfuscation_obfuscated_iex_in_scriptblocktext.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_invoke_obfuscation_stdin_in_scriptblocktext.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_invoke_obfuscation_var_in_scriptblocktext.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_invoke_obfuscation_via_compress_in_scriptblocktext.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_invoke_obfuscation_via_rundll_in_scriptblocktext.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_invoke_obfuscation_via_stdin_in_scriptblocktext.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_invoke_obfuscation_via_use_clip_in_scriptblocktext.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_invoke_obfuscation_via_use_mhsta_in_scriptblocktext.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_invoke_obfuscation_via_use_rundll32_in_scriptblocktext.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_invoke_obfuscation_via_var_in_scriptblocktext.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_keylogging.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_malicious_commandlets.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_malicious_keywords.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_memorydump_getstoragediagnosticinfo.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_nishang_malicious_commandlets.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_ntfs_ads_access.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_powerview_malicious_commandlets.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_prompt_credentials.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_psattack.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_shellcode_b64.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_shellintel_malicious_commandlets.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_store_file_in_alternate_data_stream.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_susp_zip_compress_in_scriptblocktext.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_suspicious_export_pfxcertificate.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_suspicious_getprocess_lsass.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_suspicious_keywords.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_suspicious_mail_acces.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_suspicious_mounted_share_deletion.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_suspicious_recon.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_suspicious_win32_pnpentity.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_timestomp.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_trigger_profiles.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_web_request.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_windows_firewall_profile_disabled.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_winlogon_helper_dll.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_wmi_persistence.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00
powershell_wmimplant.yml
Add: sigma rules (#175)
2021-11-22 08:45:44 +09:00