Nasreddine Bencherchali 97856b562a Add "\" to "Image|endswith" modifier ...

- Added the "\\" (backslash) for the "(Parent)Image|endswith" modifiers to avoid possible confusion.
- The modification were mostly done on  default windows binaries to avoid changing logic of other rules.

2022-06-02 13:39:07 +01:00

..

create_remote_thread_win_susp_targets.yml

Renamed suspicious in filenames to susp

2022-05-19 09:37:04 +02:00

create_remote_thread_win_ttdinjec.yml

Add "\" to "Image|endswith" modifier

2022-06-02 13:39:07 +01:00

sysmon_cactustorch.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

sysmon_cobaltstrike_process_injection.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

sysmon_createremotethread_loadlibrary.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

sysmon_password_dumper_keepass.yml

rule: KeePass password dumping

2022-04-23 18:25:11 +02:00

sysmon_password_dumper_lsass.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

sysmon_powershell_code_injection.yml

fix: remove . from title

2022-04-06 17:04:10 +02:00

sysmon_susp_powershell_rundll32.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

sysmon_susp_remote_thread.yml

Renamed suspicious in filenames to susp

2022-05-19 09:37:04 +02:00