0cca5208e9
Create proc_creation_win_wab_unusual_parents.yml
2022-08-12 17:18:44 +01:00
3fffd6a8f3
Create proc_creation_win_wab_execution_from_non_default_location.yml
2022-08-12 17:12:35 +01:00
4f7738b867
Add rule CVE-2022-31656
2022-08-12 16:29:52 +01:00
fa522f68c9
False positive fix, needs to match ALL of selectioN_delete, not 1 of them
2022-08-12 15:29:49 +00:00
dd4a32e50f
Add Ref
2022-08-12 17:25:49 +02:00
2e438a5312
Add file_event_win_iphlpapi_dll_sideloading
2022-08-12 17:16:17 +02:00
b6fda3e758
Fix FP
2022-08-12 16:09:20 +01:00
4a0c1b41f2
Update proc_creation_win_renamed_procdump.yml
2022-08-12 16:04:38 +01:00
8477c4976b
Update proc_creation_win_renamed_procdump.yml
2022-08-12 16:02:54 +01:00
970b15f440
Update file_change_win_2022_timestomping.yml
2022-08-12 15:10:24 +02:00
560916b357
Update file_change_win_2022_timestomping.yml
2022-08-12 15:09:32 +02:00
cf2a817801
New Rules
2022-08-12 13:44:16 +01:00
e4e24a00a7
Update procdump rules
2022-08-12 13:44:03 +01:00
b1e0668ae3
Update adfind rules
2022-08-12 13:43:36 +01:00
d7bc975c71
Update meta
2022-08-12 13:42:52 +01:00
19eaa0ae8a
Update file_change_win_2022_timestomping.yml
2022-08-12 14:06:54 +02:00
0214a0632a
Fix FP
2022-08-12 11:47:15 +01:00
2bcb6abd72
Escape ? character
2022-08-12 12:46:21 +02:00
5c549a2825
Escape ? character
2022-08-12 12:45:52 +02:00
08d25bd065
Escape ? character
2022-08-12 12:44:53 +02:00
b189122287
Escape ? character
2022-08-12 12:44:23 +02:00
75b9b7b1a9
Escape ? character
2022-08-12 12:43:58 +02:00
4ccb8d9ca0
Escape question mark
2022-08-12 12:38:07 +02:00
472da1d8ef
Fix startswith
2022-08-12 12:07:03 +02:00
29dbe65d92
Add file_change_win_2022_timestomping
2022-08-12 12:04:38 +02:00
501f41e475
Merge pull request #3363 from frack113/refractor
...
Update ShareName
2022-08-12 08:43:46 +02:00
9a64b6660f
Merge pull request #3338 from Tomasuh/master
...
proxy_susp_flash_download_loc.yml: c-uri inst. of c-uri-query and r-dns inst of c-uri-stem, proxy_ua_susp.yml: Avoid adobe false positives
2022-08-11 19:57:19 +02:00
1d6199494d
Update lnx_auditd_bpfdoor_port_redirect.yml
2022-08-11 19:51:48 +02:00
a3dcc61eac
Rename lnx_auditd_BPF_Door_port_redirect.yml to lnx_auditd_bpfdoor_port_redirect.yml
2022-08-11 19:34:43 +02:00
28ee157216
Rename lnx_auditd_BPFDoor_file_accessed.yml to lnx_auditd_bpfdoor_file_accessed.yml
2022-08-11 19:32:17 +02:00
3268a6c9b0
Fix ShareName
2022-08-11 19:19:07 +02:00
8cf1d92c84
Fix ShareName
2022-08-11 19:07:47 +02:00
35d69a5a4b
Update and rename BPF_Door_port_redirect.yml to lnx_auditd_BPF_Door_port_redirect.yml
2022-08-11 19:04:17 +02:00
f001d35c8b
Update and rename BPFDoor_abnormal_process_id_or_lock_file_accessed.yml to lnx_auditd_BPFDoor_file_accessed.yml
2022-08-11 18:59:58 +02:00
835b54c05c
Merge pull request #3362 from MarkMorow/markmorow
...
Create azure_privileged_account_creation.yml
2022-08-11 18:43:32 +02:00
b5ebc2033e
Update azure_privileged_account_creation.yml
2022-08-11 18:25:10 +02:00
b199e50898
Merge pull request #3358 from frack113/fix_3351
...
Fix condition
2022-08-11 18:24:43 +02:00
3fd33a6e1f
Merge pull request #3360 from martinspielmann/master
...
Reduced False Positives for Java Running with Remote Debugging Rule
2022-08-11 18:23:59 +02:00
10871396c4
Create azure_privileged_account_creation.yml
...
Detects when a priv account is created
2022-08-11 07:08:15 -07:00
41d79d4d1b
Update proc_creation_win_vul_java_remote_debugging.yml
...
simplified rule
2022-08-11 13:29:15 +02:00
8da1502e5d
Update proc_creation_win_vul_java_remote_debugging.yml
...
For Java Running with Remote Debugging, add filtering to vulnerable jvm versions. Later jvm versions limit remote debugging access to localhost by default.
2022-08-11 13:20:40 +02:00
a75e9a41a2
fix: FP with office click to run
2022-08-11 09:53:25 +02:00
7f86fcf89d
Update to use cs-host instead of r-dns
2022-08-11 08:36:23 +02:00
61c2e6b532
Update proxy_susp_flash_download_loc.yml
2022-08-11 08:33:07 +02:00
80df54d092
Fix condition
2022-08-11 06:59:01 +02:00
1b60c9b6f1
Merge pull request #3357 from MarkMorow/markmorow
...
Create azure_guest_invite_failure.yml
2022-08-11 06:40:32 +02:00
1a57509e85
Merge pull request #3346 from nasbench/nasbench-rule-devel
...
Updates + New Rules
2022-08-11 06:26:57 +02:00
634397e855
Merge pull request #3353 from nasbench/tune-fp-short-path-rules
...
Fix FP - Short Path Rules
2022-08-11 06:26:41 +02:00
4d6eda3488
Merge pull request #3348 from lawndoc/master
...
BloodHound Collection Files
2022-08-11 06:26:05 +02:00
f34a60b215
Update proc_creation_win_rundll32_unc_path.yml
2022-08-10 22:08:03 +01:00
Nasreddine Bencherchali