Nasreddine Bencherchali 360475d6ff fix: apply suggestions from code review ...

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

2023-08-18 15:15:26 +02:00

..

file_event_win_access_susp_teams.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_access_susp_unattend_xml.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

file_event_win_advanced_ip_scanner.yml

Update Title (#3739)

2022-11-30 11:44:15 +01:00

file_event_win_anydesk_artefact.yml

change status to test

2023-01-27 06:48:34 +01:00

file_event_win_anydesk_writing_susp_binaries.yml

fix: apply suggestions from code review

2023-02-20 12:06:37 +01:00

file_event_win_aspnet_temp_files.yml

fix: apply suggestions from code review

2023-08-18 15:15:26 +02:00

file_event_win_bloodhound_collection.yml

feat: new rules, updates and fp fixes (#4162)

2023-04-11 13:04:22 +02:00

file_event_win_crackmapexec_patterns.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_create_evtx_non_common_locations.yml

feat: new rules and updates

2023-07-13 17:31:13 +02:00

file_event_win_create_non_existent_dlls.yml

Merge branch 'master' into wmic-rules-updates

2023-02-15 19:58:11 +01:00

file_event_win_creation_new_shim_database.yml

feat: update shim rules

2023-08-01 23:13:18 +02:00

file_event_win_creation_scr_binary_file.yml

Fix FP

2022-11-08 12:32:44 +01:00

file_event_win_creation_system_file.yml

fix: FP found in testing

2023-03-23 10:52:08 +01:00

file_event_win_creation_unquoted_service_path.yml

change status to test

2023-01-27 06:48:34 +01:00

file_event_win_cred_dump_tools_dropped_files.yml

feat: rules update

2023-08-07 16:09:21 +02:00

file_event_win_cscript_wscript_dropper.yml

Update title (#3746)

2022-12-02 18:10:43 +01:00

file_event_win_csexec_service.yml

feat: rules update

2023-08-07 16:09:21 +02:00

file_event_win_csharp_compile_artefact.yml

fix: add missing modified

2023-02-17 22:52:09 +01:00

file_event_win_cve_2021_1675_printspooler.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_cve_2021_26858_msexchange.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_cve_2021_31979_cve_2021_33771_exploits.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_cve_2021_41379_msi_lpe.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_cve_2021_44077_poc_default_files.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_cve_2022_24527_lpe.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_dcom_iertutil_dll_hijack.yml

Refractor (#3794)

2022-12-18 21:00:14 +01:00

file_event_win_dll_sideloading_space_path.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_errorhandler_persistence.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file_event_win_exchange_webshell_drop_suspicious.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_exchange_webshell_drop.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_gotoopener_artefact.yml

change status to test

2023-01-27 06:48:34 +01:00

file_event_win_hktl_dumpert.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file_event_win_hktl_hivenightmare_file_exports.yml

feat: new rules and updates

2023-07-13 17:31:13 +02:00

file_event_win_hktl_inveigh_artefacts.yml

feat: updates and fixes

2023-02-17 17:51:44 +01:00

file_event_win_hktl_mimikatz_files.yml

feat: updates and fixes

2023-02-17 17:51:44 +01:00

file_event_win_hktl_nppspy.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_hktl_powerup_dllhijacking.yml

feat: updates and fixes

2023-02-17 17:51:44 +01:00

file_event_win_hktl_quarkspw_filedump.yml

feat: updates and fixes

2023-02-17 17:51:44 +01:00

file_event_win_hktl_remote_cred_dump.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file_event_win_hktl_safetykatz.yml

feat: updates and fixes

2023-02-17 17:51:44 +01:00

file_event_win_initial_access_dll_search_order_hijacking.yml

new rules: Sigma rules based on Elastic rules (#3632)

2022-10-28 10:13:44 +02:00

file_event_win_install_teamviewer_desktop.yml

change status to test

2023-01-27 06:48:34 +01:00

file_event_win_iphlpapi_dll_sideloading.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_iso_file_mount.yml

Update file_event_win_iso_file_mount.yml

2023-06-22 09:51:44 -04:00

file_event_win_iso_file_recent.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_lolbin_gather_network_info_script_output.yml

fix: apply suggestions

2023-02-09 10:41:41 +01:00

file_event_win_lsass_dump.yml

fix: apply suggestions from code review

2023-05-18 22:54:53 +02:00

file_event_win_lsass_memory_dump_file_creation.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_lsass_shtinkering.yml

feat: updates and enhancements

2022-12-16 16:52:12 +01:00

file_event_win_lsass_werfault_dump.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_mal_adwind.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_mal_octopus_scanner.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_msdt_susp_directories.yml

feat: updates and fixes

2023-02-23 12:49:44 +01:00

file_event_win_net_cli_artefact.yml

feat: more updates

2023-05-05 17:52:47 +02:00

file_event_win_new_files_in_uncommon_appdata_folder.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file_event_win_new_src_file.yml

fix: apply rewording suggestion

2023-02-24 13:33:08 +01:00

file_event_win_notepad_plus_plus_persistence.yml

feat: updates and fixes

2023-02-23 12:49:44 +01:00

file_event_win_ntds_dit_creation.yml

feat: more updates

2023-05-05 17:52:47 +02:00

file_event_win_ntds_dit_uncommon_parent_process.yml

fix: apply suggestions from code review

2023-05-09 16:04:24 +02:00

file_event_win_ntds_dit_uncommon_process.yml

feat: more updates

2023-05-05 17:52:47 +02:00

file_event_win_ntds_exfil_tools.yml

feat: more updates

2023-05-05 17:52:47 +02:00

file_event_win_office_addin_persistence.yml

feat: updates and fixes

2023-02-23 12:49:44 +01:00

file_event_win_office_macro_files_created.yml

fix: remove pptx extension

2023-02-24 13:34:49 +01:00

file_event_win_office_macro_files_downloaded.yml

feat: update browsers selections and filters

2023-04-18 18:05:08 +02:00

file_event_win_office_macro_files_from_susp_process.yml

fix: remove pptx extension

2023-02-24 13:34:49 +01:00

file_event_win_office_onenote_files_in_susp_locations.yml

fix: add missing modified and improve test

2023-02-10 00:56:07 +01:00

file_event_win_office_onenote_susp_dropped_files.yml

fix: apply 2nd batch of suggestions from code review

2023-03-01 18:45:26 +01:00

file_event_win_office_outlook_macro_creation.yml

fix: duplicate ids and small updates

2023-02-08 19:36:55 +01:00

file_event_win_office_outlook_newform.yml

feat: updates and fixes

2023-02-23 12:49:44 +01:00

file_event_win_office_outlook_susp_macro_creation.yml

fix: duplicate ids and small updates

2023-02-08 19:36:55 +01:00

file_event_win_office_publisher_files_in_susp_locations.yml

fix: duplicate ids and small updates

2023-02-08 19:36:55 +01:00

file_event_win_office_startup_persistence.yml

feat: new rules & updates (#4328)

2023-07-13 10:01:05 +02:00

file_event_win_office_susp_file_extension.yml

feat: new rules & updates (#4328)

2023-07-13 10:01:05 +02:00

file_event_win_office_uncommon_file_startup.yml

feat: new rules & updates (#4328)

2023-07-13 10:01:05 +02:00

file_event_win_pcre_net_temp_file.yml

Move file category rules

2022-10-13 13:25:05 +02:00

file_event_win_perflogs_susp_files.yml

feat: more updates

2023-05-05 17:52:47 +02:00

file_event_win_powershell_drop_binary_or_script.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file_event_win_powershell_drop_powershell.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file_event_win_powershell_exploit_scripts.yml

chore: order list

2023-04-21 11:14:55 +02:00

file_event_win_powershell_module_creation.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file_event_win_powershell_module_susp_creation.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file_event_win_powershell_module_uncommon_creation.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file_event_win_powershell_startup_shortcuts.yml

feat: updates and fixes

2023-02-23 12:49:44 +01:00

file_event_win_ps_script_policy_test_creation_by_uncommon_process.yml

chore: fix fp found in testing

2023-06-01 23:35:57 +02:00

file_event_win_rclone_config_files.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file_event_win_rdp_file_susp_creation.yml

fix: small updates

2023-04-19 12:38:38 +02:00

file_event_win_redmimicry_winnti_filedrop.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_remcom_service.yml

fix: duplicate ids and missing selections

2023-08-10 11:20:34 +02:00

file_event_win_remote_access_tools_screenconnect_artefact.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file_event_win_ripzip_attack.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_sam_dump.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_shell_write_susp_directory.yml

feat: new rules, updates and fp fixes (#4162)

2023-04-11 13:04:22 +02:00

file_event_win_shell_write_susp_files_extensions.yml

chore: fix typo of lowercase Windows in description

2023-06-21 09:52:43 +02:00

file_event_win_startup_folder_file_write.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

file_event_win_susp_adsi_cache_usage.yml

feat: new rules and updates

2023-01-17 01:00:44 +01:00

file_event_win_susp_colorcpl.yml

feat: updates and enhancements

2023-01-06 16:35:34 +01:00

file_event_win_susp_creation_by_mobsync.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_default_gpo_dir_write.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_desktop_ini.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_desktop_txt.yml

change status to test

2023-01-27 06:48:34 +01:00

file_event_win_susp_desktopimgdownldr_file.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_susp_diagcab.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_double_extension.yml

chore: fix typo of lowercase Windows in description

2023-06-21 09:52:43 +02:00

file_event_win_susp_dropper.yml

feat: updates and fixes

2023-01-26 22:42:56 +01:00

file_event_win_susp_exchange_aspx_write.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_susp_executable_creation.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_get_variable.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_susp_homoglyph_filename.yml

feat: add new rule for Potential Homoglyph Attack (#4223)

2023-05-09 01:35:52 +02:00

file_event_win_susp_legitimate_app_dropping_archive.yml

feat: new rules & updates (#4328)

2023-07-13 10:01:05 +02:00

file_event_win_susp_legitimate_app_dropping_exe.yml

feat: new rules & updates (#4328)

2023-07-13 10:01:05 +02:00

file_event_win_susp_legitimate_app_dropping_script.yml

feat: new rules & updates (#4328)

2023-07-13 10:01:05 +02:00

file_event_win_susp_lnk_double_extension.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file_event_win_susp_pfx_file_creation.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

file_event_win_susp_powershell_profile.yml

feat: multiple update and enhancements

2022-12-19 17:41:40 +01:00

file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml

feat: general fixes

2022-11-22 01:22:36 +01:00

file_event_win_susp_recycle_bin_fake_exec.yml

fix: apply suggestions from code review

2023-07-24 12:35:11 +02:00

file_event_win_susp_spool_drivers_color_drop.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_susp_startup_folder_persistence.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_susp_system_interactive_powershell.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_susp_task_write.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_susp_teamviewer_remote_session.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_susp_vscode_powershell_profile.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_susp_windows_terminal_profile.yml

Update file_event_win_susp_windows_terminal_profile.yml

2023-07-24 10:37:56 +02:00

file_event_win_susp_winsxs_binary_creation.yml

fix: apply suggestions from code review

2023-05-12 10:33:05 +02:00

file_event_win_sysinternals_livekd_default_dump_name.yml

feat: multiple updates and new rules (#4242)

2023-05-17 17:21:59 +02:00

file_event_win_sysinternals_livekd_driver_susp_creation.yml

feat: multiple updates and new rules (#4242)

2023-05-17 17:21:59 +02:00

file_event_win_sysinternals_livekd_driver.yml

feat: multiple updates and new rules (#4242)

2023-05-17 17:21:59 +02:00

file_event_win_sysinternals_procexp_driver_susp_creation.yml

feat: small fix and add procmon

2023-05-05 18:19:05 +02:00

file_event_win_sysinternals_procmon_driver_susp_creation.yml

feat: small fix and add procmon

2023-05-05 18:19:05 +02:00

file_event_win_sysinternals_psexec_service_key.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file_event_win_sysinternals_psexec_service.yml

feat: rules update

2023-08-07 16:09:21 +02:00

file_event_win_system32_local_folder_privilege_escalation.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_tsclient_filewrite_startup.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_uac_bypass_consent_comctl32.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_uac_bypass_dotnet_profiler.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_uac_bypass_eventvwr.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_uac_bypass_idiagnostic_profile.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_uac_bypass_ieinstal.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_uac_bypass_msconfig_gui.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_uac_bypass_ntfs_reparse_point.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_uac_bypass_winsat.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_uac_bypass_wmp.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_vhd_download_via_browsers.yml

feat: more updates

2023-05-05 17:52:47 +02:00

file_event_win_webshell_creation_detect.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_werfault_dll_hijacking.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_winrm_awl_bypass.yml

revert trigger error for new test

2023-08-15 13:24:57 +02:00

file_event_win_wmi_persistence_script_event_consumer_write.yml

Order yaml field

2022-10-26 06:16:30 +02:00

file_event_win_wmiexec_default_filename.yml

feat: update and fixes

2023-03-09 22:10:42 +01:00

file_event_win_wmiprvse_wbemcomn_dll_hijack.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

file_event_win_wpbbin_persistence.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

file_event_win_writing_local_admin_share.yml

Order yaml field

2022-10-26 06:16:30 +02:00