Florian Roth 61e8d427c1 Merge PR #4477 from @Neo23x0 - CoercedPotato activity ...

new: HackTool - CoercedPotato Named Pipe Creation
new: HackTool - CoercedPotato Execution
update: Renamed CURL.EXE Execution - Extended filter

---------

Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>

2023-10-12 12:52:45 +02:00

..

builtin

Merge PR #4476 From @phantinuss - Fix False Positives Found In Testing

2023-10-12 12:47:45 +02:00

create_remote_thread

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

create_stream_hash

feat: update cl diag script rules

2023-08-17 19:26:21 +02:00

dns_query

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

driver_load

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

file

Merge PR #4476 From @phantinuss - Fix False Positives Found In Testing

2023-10-12 12:47:45 +02:00

image_load

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

network_connection

Merge PR #4452 from @SILJAEUROPA - Add New Rules To AddInUtil Potential Abuse

2023-10-05 13:07:50 +02:00

pipe_created

Merge PR #4477 from @Neo23x0 - CoercedPotato activity

2023-10-12 12:52:45 +02:00

powershell

Merge PR #4392 from @tjgeorgen - Update MITRE Tags

2023-08-28 16:53:27 +02:00

process_access

Merge PR #4476 From @phantinuss - Fix False Positives Found In Testing

2023-10-12 12:47:45 +02:00

process_creation

Merge PR #4477 from @Neo23x0 - CoercedPotato activity

2023-10-12 12:52:45 +02:00

process_tampering

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

raw_access_thread

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

registry

Merge PR #4472 From @Tuutaans - New Registry Rule Related To HVCI

2023-10-09 11:17:56 +02:00

sysmon

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

wmi_event

Merge PR #4434 from @wagga40 - Update/Fix Rule Logic

2023-09-11 00:14:25 +02:00