kitos/Aegis
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(tests): recognize sysmon, wevtutil, auditpol as detection commands
Aegis CI / lint-and-test (push) Has been cancelled
Details
Snyk Security Scan / Python vulnerabilities (backend) (push) Has been cancelled
Details
Snyk Security Scan / npm vulnerabilities (frontend) (push) Has been cancelled
Details
Snyk Security Scan / Docker image vulnerabilities (backend) (push) Has been cancelled
Details

Browse Source 
Blue's detect_procedure extraction had zero Blue-team-oriented tool
names in its known-binaries list — sysmon.exe, one of the most common
Windows detection tools, silently produced no suggestion at all.
Verified against the exact production input that surfaced this.
This commit is contained in:
kitos
2026-07-14 17:24:14 +02:00
parent 1b7fd6fb36
commit 11080bd627
2 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/app/services/procedure_extraction_service.py
+3 -1
View File
@@ -48,7 +48,9 @@ _COMMAND_LINE_RE = re.compile(
netsh|wmic|schtasks|sc|rundll32|regsvr32|msiexec|certutil|
mimikatz\S*|cscript|wscript|osascript|openssl|systemctl|service|
reg\s+query|whoami|nslookup|dig|ping|tasklist|ps\s|kill|
Invoke-\S+|iex|dsquery|nltest)\b
Invoke-\S+|iex|dsquery|nltest|
sysmon\S*|wevtutil|auditpol|tcpdump|tshark|procmon\S*|autorunsc\S*|
volatility\S*)\b
|
\bSELECT\s+.+\s+FROM\b # SQL
|