Florian Roth 57271c3c00 fix: bugs in rules

2022-02-16 17:26:57 +01:00

..

pipe_created_tool_psexec.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

sysmon_alternate_powershell_hosts_pipe.yml

fix: bugs in rules

2022-02-16 17:26:57 +01:00

sysmon_apt_turla_namedpipes.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_cred_dump_tools_named_pipes.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

sysmon_efspotato_namedpipe.yml

Adding some additional details about sysmon config and also way to test detection.

2021-10-25 21:30:33 +02:00

sysmon_mal_cobaltstrike_re.yml

Adding some additional details about sysmon config and also way to test detection.

2021-10-25 21:30:33 +02:00

sysmon_mal_cobaltstrike.yml

refactor: change all " of them" expressions

2022-01-11 10:59:57 +01:00

sysmon_mal_namedpipes.yml

Corrected typo in HyperBro malware name

2021-11-12 08:36:13 +01:00

sysmon_powershell_execution_pipe.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_psexec_pipes_artifacts.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_susp_adfs_namedpipe_connection.yml

fix: FPs noticed with Aurora

2022-02-16 17:00:27 +01:00

sysmon_susp_cobaltstrike_pipe_patterns.yml

Adding some additional details about sysmon config and also way to test detection.

2021-10-25 21:30:33 +02:00

sysmon_susp_wmi_consumer_namedpipe.yml

add missing MITRE Techniques

2021-11-20 12:26:01 +01:00