 S.kiran kumar
|
27823763cb
|
Update silenttrinity_stager_msbuild_activity.yml
|
2020-10-12 20:14:43 +05:30 |
|
|
S.kiran kumar
|
a640c1e151
|
Update silenttrinity_stager_msbuild_activity.yml
|
2020-10-12 20:11:24 +05:30 |
|
|
S.kiran kumar
|
f1c9286a25
|
Updated minor changes
Change tags.
Change author (add "oscd.community").
Change date format.
Change logsource.
Change detection (use endswith as a modifier).
Change fields.
|
2020-10-12 20:06:36 +05:30 |
|
|
omkargudhate22
|
8f618c9a1f
|
changed condition
|
2020-10-12 18:59:53 +05:30 |
|
|
omkargudhate22
|
f162bc1aff
|
remove space
|
2020-10-12 18:53:47 +05:30 |
|
|
omkargudhate22
|
0e3c51316a
|
updated
|
2020-10-12 18:50:18 +05:30 |
|
|
omkargudhate22
|
ecb42fb5dd
|
Update sysmon_susp_clr_logs.yml
|
2020-10-12 18:50:07 +05:30 |
|
|
omkar72
|
cf60438c93
|
clr logs creation
|
2020-10-12 18:42:09 +05:30 |
|
|
Ryan Plas
|
a67c19c08b
|
Split up powershell detection
|
2020-10-12 09:00:08 -04:00 |
|
|
omkargudhate22
|
7d69a08c30
|
Update win_netsh_port_fwd.yml
|
2020-10-12 18:29:02 +05:30 |
|
|
omkar72
|
a5575f3079
|
adding shortened commands
|
2020-10-12 17:47:26 +05:30 |
|
|
omkar72
|
b32b6f0e09
|
script loading .net
|
2020-10-12 17:20:22 +05:30 |
|
|
Vasiliy Burov
|
d31f8d6977
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-12 14:43:53 +03:00 |
|
|
omkargudhate22
|
e2911a025e
|
added tags and corrected image condition format
|
2020-10-12 17:00:57 +05:30 |
|
|
Vasiliy Burov
|
2e6f184370
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-12 14:11:10 +03:00 |
|
|
Vasiliy Burov
|
436dd4d90c
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-12 14:04:24 +03:00 |
|
|
Alexander Sungurov
|
175834fe90
|
Pcwrun.exe detection added
|
2020-10-12 13:52:49 +03:00 |
|
|
Florian Roth
|
b8dc8d3f7e
|
reduced to avoid FPs
|
2020-10-12 10:46:34 +02:00 |
|
|
Florian Roth
|
d30502cdab
|
Merge pull request #1134 from Neo23x0/rule-devel
Rule devel
|
2020-10-12 10:25:13 +02:00 |
|
|
Sander
|
8c1bd4e466
|
Remove redundant space
|
2020-10-12 10:01:44 +02:00 |
|
|
omkar72
|
0fab2c0930
|
finger executable suspicious execution
|
2020-10-12 13:28:52 +05:30 |
|
|
Sander
|
3ab244c70f
|
regini.exe ADS rule
|
2020-10-12 09:55:34 +02:00 |
|
|
Florian Roth
|
3affdd12e0
|
fix: rule title casing
|
2020-10-12 09:51:35 +02:00 |
|
|
omkar72
|
99d87d60ec
|
updated adfind command line
|
2020-10-12 12:52:54 +05:30 |
|
|
Florian Roth
|
0d0cda0f86
|
docs: improved false positive notes
|
2020-10-12 09:18:42 +02:00 |
|
|
Florian Roth
|
e7c6794ecd
|
rule: suspicious wmic process call create + rundll32
|
2020-10-12 09:18:30 +02:00 |
|
|
Florian Roth
|
2e732eb01f
|
Merge branch 'master' into rule-devel
|
2020-10-12 09:13:24 +02:00 |
|
|
omkar72
|
cf5ad9197c
|
updated adfind command line
|
2020-10-12 12:42:05 +05:30 |
|
|
omkar72
|
d29a28a4a8
|
updated adfind command line
|
2020-10-12 12:40:50 +05:30 |
|
|
uncleP@sk
|
13e829219c
|
reference's list changed
|
2020-10-12 08:35:11 +03:00 |
|
|
uncleP@sk
|
8ff91088ee
|
tag's issue solved
|
2020-10-12 08:31:10 +03:00 |
|
|
remotephone@gmail.com
|
476a3c04d9
|
Adding t1070_002
|
2020-10-12 00:01:10 -05:00 |
|
|
remotephone@gmail.com
|
781c7ce6dc
|
Cleaning up falsepositives section of both rules
|
2020-10-11 23:52:47 -05:00 |
|
|
remotephone@gmail.com
|
48edc674bd
|
updating keywords to CommandLine|contains and splitting rule into two
|
2020-10-11 22:43:28 -05:00 |
|
|
Bartlomiej Czyz
|
e90f91b89e
|
append authors of the update
|
2020-10-11 23:42:33 +02:00 |
|
|
Vasiliy Burov
|
a0ac753e32
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-12 00:39:36 +03:00 |
|
|
Bartlomiej Czyz
|
ae41190291
|
remove redundant reference
|
2020-10-11 23:39:08 +02:00 |
|
|
Vasiliy Burov
|
48f6fad6c3
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-12 00:35:59 +03:00 |
|
|
Bartlomiej Czyz
|
b6876e5123
|
remove redundant reference
|
2020-10-11 23:35:17 +02:00 |
|
|
svch0stz
|
2edd79a37f
|
Update win_root_certificate_installed.yml
|
2020-10-12 08:30:28 +11:00 |
|
|
Vasiliy Burov
|
8d926dc303
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-12 00:27:45 +03:00 |
|
|
Vasiliy Burov
|
6f7475020a
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-12 00:23:27 +03:00 |
|
|
Vasiliy Burov
|
26ef1da071
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-12 00:00:17 +03:00 |
|
|
Vasiliy Burov
|
d4e1786836
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-11 23:57:27 +03:00 |
|
|
Vasiliy Burov
|
e2543158ce
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-11 23:53:00 +03:00 |
|
|
Vasiliy Burov
|
47d6122298
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-11 23:46:51 +03:00 |
|
|
Vasiliy Burov
|
a39d453792
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-11 23:42:51 +03:00 |
|
|
Vasiliy Burov
|
1320e0b733
|
Update powershell_cmdline_reversed_strings.yml
|
2020-10-11 23:40:12 +03:00 |
|
|
Vasiliy Burov
|
2d88000fdf
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-11 23:38:07 +03:00 |
|
|
Vasiliy Burov
|
5c4adbb24e
|
Update powershell_cmdline_specific_comb_methods.yml
|
2020-10-11 23:33:57 +03:00 |
|