Roberto Rodriguez 7f17eaeb87 added rule to detect suspicious named pipe connections to an AD FS server

2021-10-08 01:57:22 -04:00

..

pipe_created_tool_psexec.yml

split global win_tool_psexec.yml

2021-09-21 10:10:48 +02:00

sysmon_alternate_powershell_hosts_pipe.yml

Update Threat Hunter Playbook Reference

2021-05-22 01:02:43 -03:00

sysmon_apt_turla_namedpipes.yml

Merge branch 'master' of https://github.com/SigmaHQ/sigma

2021-04-15 01:25:48 +02:00

sysmon_cred_dump_tools_named_pipes.yml

- Remove 'service: sysmon' since defining the categories made the rules generic

2020-10-02 09:37:52 +02:00

sysmon_efspotato_namedpipe.yml

fix: indentation

2021-08-23 15:03:59 +02:00

sysmon_mal_cobaltstrike_re.yml

Various fixes

2021-09-07 23:38:07 +02:00

sysmon_mal_cobaltstrike.yml

docs: note to improved sysmon config

2021-09-01 13:07:18 +02:00

sysmon_mal_namedpipes.yml

LiquidSnake named pipe

2021-09-01 13:54:47 +02:00

sysmon_powershell_execution_pipe.yml

Clean-up service: sysmon as it will be replaced by filling the category

2021-04-15 02:02:25 +02:00

sysmon_psexec_pipes_artifacts.yml

Clean-up service: sysmon as it will be replaced by filling the category

2021-04-15 02:02:25 +02:00

sysmon_susp_adfs_namedpipe_connection.yml

added rule to detect suspicious named pipe connections to an AD FS server

2021-10-08 01:57:22 -04:00

sysmon_susp_cobaltstrike_pipe_patterns.yml

Merge pull request #1968 from SigmaHQ/rule-devel

2021-09-01 13:21:28 +02:00

sysmon_susp_wmi_consumer_namedpipe.yml

fix: removed tags

2021-09-01 16:32:27 +02:00