blue-team-tools

net_connection_win_addinutil_initiated.yml

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29 01:20:23 +02:00

net_connection_win_adws_unusual_connection.yml

Merge PR #5451 from @frack113 - chore: cleanup metadata

2025-06-04 13:33:36 +02:00

net_connection_win_certutil_initiated_connection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_cmstp_initiated_connection.yml

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29 01:20:23 +02:00

net_connection_win_dialer_initiated_connection.yml

Merge PR #5390 from @david-syk - Update MITRE ATT&CK tags

2025-05-20 23:08:57 +02:00

net_connection_win_domain_azurewebsites.yml

Merge PR #5448 from @nasbench - Promote older rules status from experimental to test

2025-06-02 13:29:48 +02:00

net_connection_win_domain_btunnels.yml

Merge PR #5572 from @nasbench - Promote older rules status from experimental to test

2025-08-14 14:05:46 +02:00

net_connection_win_domain_cloudflared_communication.yml

Merge PR #5563 from @Liran017 - update MITRE tag

2025-07-30 13:08:43 +02:00

net_connection_win_domain_crypto_mining_pools.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_dead_drop_resolvers.yml

feat: update multiple rules (#5055 )

2024-10-25 16:32:03 +02:00

net_connection_win_domain_devtunnels.yml

Merge PR #5564 from @Liran017 - update MITRE tag

2025-07-30 13:05:31 +02:00

net_connection_win_domain_dropbox_api.yml

Merge PR #5558 from @Liran017 - update MITRE tag

2025-07-30 14:30:04 +02:00

net_connection_win_domain_external_ip_lookup.yml

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

net_connection_win_domain_google_api_non_browser_access.yml

Merge PR #5200 from @frack113 - Fix typo in selection name

2025-02-22 23:47:24 +01:00

net_connection_win_domain_localtonet_tunnel.yml

Merge PR #5397 from @nasbench - Promote older rules status from experimental to test

2025-05-20 22:58:46 +02:00

net_connection_win_domain_mega_nz.yml

Merge PR #5559 from @Liran017 - update MITRE tag

2025-07-30 14:30:55 +02:00

net_connection_win_domain_ngrok_tunnel.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_ngrok.yml

Merge PR #5565 from @Liran017 - title fix and update MITRE tag

2025-07-30 13:06:56 +02:00

net_connection_win_domain_notion_api_susp_communication.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_domain_portmap.yml

Merge PR #5249 from @nasbench - Promote older rules status from experimental to test

2025-04-17 00:41:35 +02:00

net_connection_win_domain_telegram_api_non_browser_access.yml

Merge PR #5566 from @Liran017 - update MITRE tag

2025-07-30 12:59:41 +02:00

net_connection_win_domain_vscode_tunnel_connection.yml

Merge PR #5561 from @Liran017 - update MITRE tag

2025-07-30 13:17:17 +02:00

net_connection_win_eqnedt.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_finger.yml

Merge PR #5763 from @swachchhanda000 - Update ClickFix/FileFix related rules

2025-11-27 23:00:25 +01:00

net_connection_win_imewdbld.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_notepad.yml

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29 01:20:23 +02:00

net_connection_win_office_outbound_non_local_ip.yml

Merge PR #5517 from @swachchhanda000 - fix: office 365 apps related false-positives

2025-10-17 07:57:13 +05:45

net_connection_win_office_uncommon_ports.yml

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29 01:20:23 +02:00

net_connection_win_python.yml

Merge PR #5224 from @swachchhanda000 - Fix Multiple FPs

2025-04-07 11:05:53 +02:00

net_connection_win_rdp_outbound_over_non_standard_tools.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_rdp_reverse_tunnel.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_rdp_to_http.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_regasm_network_activity.yml

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29 01:20:23 +02:00

net_connection_win_regsvr32_network_activity.yml

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29 01:20:23 +02:00

net_connection_win_remote_access_tools_anydesk_incoming_connection.yml

Merge PR #5477 from @phantinuss - chore: update MITRE tag t1219 to t1219.002

2025-06-13 10:00:52 +02:00

net_connection_win_rundll32_net_connections.yml

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29 01:20:23 +02:00

net_connection_win_silenttrinity_stager_msbuild_activity.yml

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29 01:20:23 +02:00

net_connection_win_susp_binary_no_cmdline.yml

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29 01:20:23 +02:00

net_connection_win_susp_file_sharing_domains_susp_folders.yml

Merge PR #5804 from @swachchhanda000 - enhance rules related with file download from file sharing websites

2025-12-12 08:04:27 +05:45

net_connection_win_susp_initiated_uncommon_or_suspicious_locations.yml

Merge PR #5804 from @swachchhanda000 - enhance rules related with file download from file sharing websites

2025-12-12 08:04:27 +05:45

net_connection_win_susp_malware_callback_port.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_susp_malware_callback_ports_uncommon.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_susp_outbound_kerberos_connection.yml

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29 01:20:23 +02:00

net_connection_win_susp_outbound_mobsync_connection.yml

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29 01:20:23 +02:00

net_connection_win_susp_outbound_smtp_connections.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_susp_remote_powershell_session.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_winlogon_net_connections.yml

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29 01:20:23 +02:00

net_connection_win_wordpad_uncommon_ports.yml

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29 01:20:23 +02:00

net_connection_win_wscript_cscript_local_connection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_wscript_cscript_outbound_connection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

net_connection_win_wuauclt_network_connection.yml

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29 01:20:23 +02:00