CB-Threat-Hunting

🚨 Project Archived 🚨

Note: This project is no longer maintained. Please check https://github.com/Sam0x90/CB-Threat-Hunting for an updated/maintained or newly created detection rules.

CB-Threat-Hunting

Carbon Black search queries that help security analysts in finding malicious activities.The search queries could be adjusted to be used elsewhere including sysmon

CarbonBlack MITRE ATT&CK Mapping

This will contain tested search queries to map most of Mitre ATTACK Framework to CarbonBlack. Will be updated from time to time

Name		Name	Last commit message	Last commit date
Latest commit History 204 Commits
API		API
ATT&CK		ATT&CK
Scripts		Scripts
SigmaRules		SigmaRules
Bitsadmin usage		Bitsadmin usage
Clearing Windows Eventlog		Clearing Windows Eventlog
CreateRemoteThread from powershell.exe		CreateRemoteThread from powershell.exe
MMC Lateral Movment		MMC Lateral Movment
Malicious Shims		Malicious Shims
Processes on User Profile		Processes on User Profile
README.md		README.md
Reg export usage		Reg export usage
Ruler Detection		Ruler Detection
Sc.exe executed cmd.exe		Sc.exe executed cmd.exe
Simon Tatham signed processes to the internet		Simon Tatham signed processes to the internet
Susp_mmc_source		Susp_mmc_source
Suspicious certutil usage		Suspicious certutil usage
Suspicious executions of mstsc.exe		Suspicious executions of mstsc.exe
Unsigned Processes running from programdata with network connection		Unsigned Processes running from programdata with network connection
WMIprvse childrens		WMIprvse childrens
Windows Update UAC Bypass		Windows Update UAC Bypass
Wmic usage		Wmic usage
winrs		winrs

0xAnalyst/CB-Threat-Hunting

Folders and files

Latest commit

History

Repository files navigation

🚨 Project Archived 🚨

CB-Threat-Hunting

CarbonBlack MITRE ATT&CK Mapping

About

Resources

Stars

Watchers

Forks

Languages