0xtf
/ fireeye_ost_nids.yml
Last active
December 11, 2020 16:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| title: NIDS FireEye Breached Red Team Tool Detected | |
| id: ce129fbc-5c2e-4e49-ac2d-9742afa10c25 | |
| status: experimental | |
| description: A red team tool, from the FireEye breach, has been detected. | |
| author: 3CORESec | |
| date: 2020/12/09 | |
| modified: 2020/12/10 | |
| references: | |
| - https://github.com/fireeye/red_team_tool_countermeasures | |
| tags: |
0xtf
/ 3cs-rule-example.yaml
Created
December 16, 2020 05:20
SIEGMA rule example / 3CORESec Rule Development
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| title: Windows ETW Tampering | |
| id: 29d02e66-cc4e-4cd4-8fd3-7e729e1a230d | |
| status: experimental | |
| description: Detects commands that remove, disable, stop or tamper tracing sessions relevant to security. | |
| author: 3CORESec | |
| date: 2020/11/16 | |
| references: | |
| - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 | |
| - https://github.com/Neo23x0/sigma/blob/8f6ad7df6b7f099db4bc1e867c4614074ea57e87/rules/windows/process_creation/win_etw_trace_evasion.yml | |
| tags: |
OlderNewer