2 Commits

Author	SHA1	Message	Date
Nasreddine Bencherchali	598d29f811	Merge PR #4950 from @nasbench - Comply With v2 Spec Changes ... chore: change tags, date, modified fields to comply with v2 of the Sigma spec. chore: update the related type from `obsoletes` to `obsolete`. chore: update local json schema to the latest version.	2024-08-12 12:02:50 +02:00
Nasreddine Bencherchali	f61c1f4509	Merge PR #4832 from @nasbench - Update LOLBIN rules ... update: Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE - Update logic to add additional variation of the extensions update: Arbitrary File Download Via ConfigSecurityPolicy.EXE - Update description update: C# IL Code Compilation Via Ilasm.EXE - Add flags to increase accuracy of the rule instead of it focusing on "any" execution update: COM Object Execution via Xwizard.EXE - Update logic update: JScript Compiler Execution - Update metadata update: ManageEngine Endpoint Central Dctask64.EXE Potential Abuse - Update logic to account for flags and increase accuracy update: Potential Application Whitelisting Bypass via Dnx.EXE - Update description update: Potential Arbitrary Command Execution Via FTP.EXE - Use "windash" modifier and update description update: Potential Arbitrary File Download Via Cmdl32.EXE - Remove unnecessary spaces to account for flags being at the end. update: Renamed ZOHO Dctask64 Execution - Add additional imphash values update: Windows Kernel Debugger Execution - Reduce level to "medium" update: Xwizard.EXE Execution From Non-Default Location - Update description --------- Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>	2024-04-26 13:40:11 +02:00