 Florian Roth
|
ab038d1ac7
|
style: minor changes
|
2019-12-20 14:59:26 +01:00 |
|
|
Florian Roth
|
bbaa9df217
|
rule: better JAB rule
|
2019-12-16 19:08:51 +01:00 |
|
|
Florian Roth
|
f83eb2268e
|
rule: improved JAB expression
|
2019-12-16 19:04:05 +01:00 |
|
|
Florian Roth
|
bd7c996588
|
rule: suspicious PS rule modified to cover newest malware campaigns
|
2019-12-16 19:02:57 +01:00 |
|
|
Thomas Patzke
|
0592cbb67a
|
Added UUIDs to rules
|
2019-11-12 23:12:27 +01:00 |
|
|
Florian Roth
|
7bef822da7
|
rule: minor improvement to susp ps enc cmd
|
2019-09-04 16:31:49 +02:00 |
|
|
Florian Roth
|
0657f29c99
|
Rule: reworked win_susp_powershell_enc_cmd
|
2019-07-30 14:36:30 +02:00 |
|
|
Florian Roth
|
03d8184990
|
Rule: Extended PowerShell Susp Cmdline Enc Commands
|
2019-04-20 09:38:41 +02:00 |
|
|
Karneades
|
75d36165fc
|
Remove non-generic falsepositives
There are tons of FPs for that... :)
|
2019-04-11 12:55:24 +02:00 |
|
|
Karneades
|
51e65be98b
|
Remove loose wildcard filter in powershell encoded cmd rule
|
2019-04-11 12:53:12 +02:00 |
|
|
mikhail
|
40241c1fdf
|
Fix 4 rules
|
2019-03-06 01:56:05 +03:00 |
|
|
Thomas Patzke
|
7602309138
|
Increased indentation to 4
* Converted (to generic sigma) rules
* Converter outputs by default with indentation 4
|
2019-03-02 00:14:20 +01:00 |
|
|
Thomas Patzke
|
c922f7d73f
|
Merge branch 'master' into project-1
|
2019-02-26 00:24:46 +01:00 |
|
|
Thomas Patzke
|
96eb460944
|
Converted Sysmon/1 and Security/4688 to generic process creation rules
|
2019-01-16 23:36:31 +01:00 |
|