Stephen Lincoln 7a8672f92b Merge PR #4663 from @slincoln-aiq - Update Disable Windows Defender Features Rules ...

update: Tamper Windows Defender - ScriptBlockLogging - Add additional PowerShell MpPreference Cmdlets
update: Tamper Windows Defender - PSClassic - Add additional PowerShell MpPreference Cmdlets
update: Powershell Defender Disable Scan Feature - Add additional PowerShell MpPreference Cmdlets 

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

2024-01-10 19:24:20 +01:00

..

posh_pc_abuse_nslookup_with_dns_records.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_delete_volume_shadow_copies.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_downgrade_attack.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_exe_calling_ps.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_powercat.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_remote_powershell_session.yml

Merge PR #4659 from @nasbench - Reduce Remote PowerShell Session (PS Classic) Level

2024-01-03 23:30:21 +01:00

posh_pc_remotefxvgpudisablement_abuse.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

posh_pc_renamed_powershell.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_susp_download.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_susp_get_nettcpconnection.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_susp_zip_compress.yml

Merge PR #4631 from @nasbench - add rules related to CISA aa23-347a advisory and other updates

2023-12-18 16:46:46 +01:00

posh_pc_tamper_windows_defender_set_mp.yml

Merge PR #4663 from @slincoln-aiq - Update Disable Windows Defender Features Rules

2024-01-10 19:24:20 +01:00

posh_pc_wsman_com_provider_no_powershell.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_xor_commandline.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00