blue-team-tools

net_connection_susp_win_binary_no_cmdline.yml

rule: suspicious network connections no cmdline

2022-07-03 15:58:54 +02:00

net_connection_win_binary_github_com.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

net_connection_win_binary_susp_com.yml

Updates + New Rules

2022-08-09 18:35:45 +01:00

net_connection_win_crypto_mining.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_dllhost_net_connections.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

net_connection_win_eqnedt.yml

feat: Add rule for equation editor network connections

2022-04-14 10:50:10 +02:00

net_connection_win_excel_outbound_network_connection.yml

Comparison conflict found between selection and filtere. In favor of selection

2022-06-27 21:03:36 +00:00

net_connection_win_imewdbld.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

net_connection_win_malware_backconnect_ports.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

net_connection_win_mega_nz.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_msiexec.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

net_connection_win_ngrok_io.yml

rule: communication to ngrok.io

2022-07-16 08:15:32 +02:00

net_connection_win_notepad_network_connection.yml

fix: none --> Unknown

2022-03-16 14:19:21 +01:00

net_connection_win_powershell_network_connection.yml

New Rules + Update

2022-07-14 17:35:50 +01:00

net_connection_win_python.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

net_connection_win_rdp_reverse_tunnel.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

net_connection_win_rdp_to_http.yml

New Rules + Update

2022-07-14 17:35:50 +01:00

net_connection_win_regsvr32_network_activity.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

net_connection_win_remote_powershell_session_network.yml

fix: FP found in testing

2022-08-09 10:56:00 +02:00

net_connection_win_rundll32_net_connections.yml

fix: FPs noticed with Aurora

2022-05-02 16:25:33 +02:00

net_connection_win_silenttrinity_stager_msbuild_activity.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

net_connection_win_susp_dropbox_api.yml

rule: myjino github repo compromise

2022-08-03 08:34:28 +02:00

net_connection_win_susp_outbound_kerberos_connection.yml

Renamed suspicious in filenames to susp

2022-05-19 09:37:04 +02:00

net_connection_win_susp_outbound_mobsync_connection.yml

Add "\" to "Image|endswith" modifier

2022-06-02 13:39:07 +01:00

net_connection_win_susp_outbound_smtp_connections.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

net_connection_win_susp_prog_location_network_connection.yml

Adjusting condition

2022-05-26 18:39:22 +00:00

net_connection_win_susp_rdp.yml

fix: FPs found in testing environment

2022-06-20 16:17:54 +02:00

net_connection_win_susps_epmap.yml

False positive from amazon ssm agent updater connecting to local ip address on this port

2022-07-18 19:51:00 +00:00

net_connection_win_wuauclt_network_connection.yml

Name Normalization

2022-02-27 10:58:14 +01:00