Hieu Tran 0e934bd4b4 feat: new rules related to ZScaler blog - OneNote: A Growing Threat for Malware Distribution (#4111)

2023-03-17 13:00:57 +01:00

..

registry_event_add_local_hidden_user.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

registry_event_apt_leviathan.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

registry_event_apt_oceanlotus_registry.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

registry_event_apt_oilrig_mar18.yml

feat: update and fixes

2023-03-09 22:10:42 +01:00

registry_event_apt_pandemic.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

registry_event_bypass_via_wsreset.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_cmstp_execution_by_registry.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_disable_security_events_logging_adding_reg_key_minint.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_disable_wdigest_credential_guard.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_esentutl_volume_shadow_copy_service_keys.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

registry_event_hack_wce_reg.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

registry_event_hybridconnectionmgr_svc_installation.yml

Update Title (#3733)

2022-11-28 06:43:17 +01:00

registry_event_mal_azorult.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_mal_flowcloud.yml

fix: broken single item lists

2022-12-08 16:23:58 +01:00

registry_event_malware_qakbot_registry.yml

feat: new rules related to ZScaler blog - OneNote: A Growing Threat for Malware Distribution (#4111)

2023-03-17 13:00:57 +01:00

registry_event_mimikatz_printernightmare.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

registry_event_modify_screensaver_binary_path.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_narrator_feedback_persistance.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_net_ntlm_downgrade.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

registry_event_new_dll_added_to_appcertdlls_registry_key.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_new_dll_added_to_appinit_dlls_registry_key.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

registry_event_office_test_regadd.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

registry_event_persistence_recycle_bin.yml

feat: new rules and fixes (#3759)

2022-12-06 12:13:20 +01:00

registry_event_portproxy_registry_key.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

registry_event_redmimicry_winnti_reg.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_runkey_winekey.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_runonce_persistence.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_shell_open_keys_manipulation.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

registry_event_silentprocessexit_lsass.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

registry_event_ssp_added_lsa_config.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_stickykey_like_backdoor.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

registry_event_susp_atbroker_change.yml

fix: fp found in testing

2023-01-19 18:47:11 +01:00

registry_event_susp_download_run_key.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

registry_event_susp_lsass_dll_load.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

registry_event_susp_mic_cam_access.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

registry_event_trust_record_modification.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_set_legalnotice_susp_message.yml

Apply suggestions from code review

2022-12-12 13:23:59 +01:00