 Thomas Patzke
|
3ef930b094
|
Escaped '\*' to '\\*' where required
|
2019-02-03 00:24:57 +01:00 |
|
|
megan201296
|
440b0ddffe
|
Update sysmon_susp_powershell_parent_combo.yml
|
2018-10-09 19:11:17 -05:00 |
|
|
SherifEldeeb
|
48441962cc
|
Change All "str" references to be "list"to mach schema update
|
2018-01-28 02:24:16 +03:00 |
|
|
SherifEldeeb
|
112a0939d7
|
Change "reference" to "references" to match new schema
|
2018-01-28 02:12:19 +03:00 |
|
|
Thomas Patzke
|
986c9ff9b7
|
Added field names to first rules
|
2017-09-12 23:54:04 +02:00 |
|
|
Thomas Patzke
|
f768bf3d61
|
Fixed parse errors
|
2017-08-02 22:49:15 +02:00 |
|
|
Florian Roth
|
e6a81623a8
|
PowerShell Combo - False Positive with MOM
|
2017-03-29 22:10:28 +02:00 |
|
|
Florian Roth
|
140141b7a2
|
Rule: Suspicious PowerShell parent image combination
|
2017-03-16 18:58:59 +01:00 |
|