frack113 2cb6ccd04d Merge PR #4536 from @frack113 - Add New Rules Related To Sysvol Access ...

new: Access To Sysvol Policies Share By Uncommon Process
new: Access To Potentially Sensitive Sysvol Files By Uncommon Application 

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

2023-12-21 17:04:40 +01:00

..

builtin

Merge PR #4611 from @nasbench - Promote Older Rules Status From experimental To test

2023-12-01 12:50:36 +01:00

create_remote_thread

Merge PR #4564 from @nasbench - Fix Further FPs Found In Testing

2023-11-15 15:35:43 +01:00

create_stream_hash

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

dns_query

Merge PR #4628 from @ssnkhan - New: Detect Creation of Cloudflared Quick Tunnels

2023-12-21 12:32:08 +01:00

driver_load

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

file

Merge PR #4536 from @frack113 - Add New Rules Related To Sysvol Access

2023-12-21 17:04:40 +01:00

image_load

Merge PR #4631 from @nasbench - add rules related to CISA aa23-347a advisory and other updates

2023-12-18 16:46:46 +01:00

network_connection

Merge PR #4619 from @mcdave2k1 - Tune false positives with IMAP & SMTP ports

2023-12-18 11:19:13 +01:00

pipe_created

Merge PR #4632 from @tr0mb1r - Add exclusion for pipe names starting with \pipe\

2023-12-21 10:11:49 +01:00

powershell

Merge PR #4631 from @nasbench - add rules related to CISA aa23-347a advisory and other updates

2023-12-18 16:46:46 +01:00

process_access

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

process_creation

Merge PR #4635 from @qasimqlf - Fix error in modifier usage

2023-12-21 16:38:11 +01:00

process_tampering

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

raw_access_thread

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

registry

Merge PR #4633 from @slincoln-aiq - New Rules Related To Desktop Background Change

2023-12-21 11:44:52 +01:00

sysmon

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

wmi_event

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00