Swachchhanda Shrawan Poudel 2f84ca2f16 Merge PR #5433 from @swachchhanda000 - Add BadSuccessor dMSA Abuse Related Rules ...

new: msDS-ManagedAccountPrecededByLink Attribute Modified
new: New MsDS-DelegatedManagedServiceAccount (DMSA) Object Created
new: DMSA Service Account Created in Specific OUs - PowerShell
new: DMSA Link Attributes Modified
new: New DMSA Service Account Created in Specific OUs

---------

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

2026-03-30 12:27:13 +02:00

..

posh_ps_aadinternals_cmdlets_execution.yml

Merge PR #5186 from @swachchhanda000 - Increase coverage of AADinternals rules

2025-02-17 12:11:55 +01:00

posh_ps_access_to_browser_login_data.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_active_directory_module_dll_import.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_add_dnsclient_rule.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_add_windows_capability.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_adrecon_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_amsi_bypass_pattern_nov22.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_amsi_null_bits_bypass.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_apt_silence_eda.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_as_rep_roasting.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_audio_exfiltration.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_automated_collection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_capture_screenshots.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_clear_powershell_history.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_clearing_windows_console_history.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_cmdlet_scheduled_task.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

posh_ps_computer_discovery_get_adcomputer.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_copy_item_system_directory.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

posh_ps_cor_profiler.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

posh_ps_create_local_user.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_create_new_dmsasvc_account.yml

Merge PR #5433 from @swachchhanda000 - Add BadSuccessor dMSA Abuse Related Rules

2026-03-30 12:27:13 +02:00

posh_ps_create_volume_shadow_copy.yml

Merge PR #5557 from @phantinuss - Bump pySigma-validators-sigmahq to 0.10

2025-08-14 14:29:11 +02:00

posh_ps_detect_vm_env.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

posh_ps_directorysearcher.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_directoryservices_accountmanagement.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_disable_psreadline_command_history.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_disable_windows_optional_feature.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_dotnet_assembly_from_file.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_download_com_cradles.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_dsinternals_cmdlets.yml

Merge PR #5397 from @nasbench - Promote older rules status from experimental to test

2025-05-20 22:58:46 +02:00

posh_ps_dump_password_windows_credential_manager.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_enable_psremoting.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_enable_susp_windows_optional_feature.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_enumerate_password_windows_credential_manager.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_etw_trace_evasion.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_export_certificate.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_frombase64string_archive.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_get_acl_service.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

posh_ps_get_adcomputer.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_get_adgroup.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_get_adreplaccount.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_get_childitem_bookmarks.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_get_process_security_software_discovery.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

posh_ps_hktl_rubeus.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

posh_ps_hktl_winpwn.yml

Merge PR #5027 from @nasbench - Promote older rules status from experimental to test

2024-10-01 14:56:09 +02:00

posh_ps_hotfix_enum.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_icmp_exfiltration.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_import_module_susp_dirs.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_install_unsigned_appx_packages.yml

Merge PR #5741 from @swachchhanda000 - Add Splunk Rules for MSIX/AppX

2026-01-24 17:04:41 +01:00

posh_ps_invoke_command_remote.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_invoke_dnsexfiltration.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_invoke_obfuscation_clip.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_invoke_obfuscation_obfuscated_iex.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_invoke_obfuscation_stdin.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_invoke_obfuscation_var.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_invoke_obfuscation_via_compress.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_invoke_obfuscation_via_rundll.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_invoke_obfuscation_via_stdin.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_invoke_obfuscation_via_use_clip.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_invoke_obfuscation_via_use_mhsta.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_invoke_obfuscation_via_use_rundll32.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_invoke_obfuscation_via_var.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_keylogging.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

posh_ps_localuser.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

posh_ps_mailboxexport_share.yml

Merge PR #5769 from @nasbench - fix keywords rule and remove the fields field

2025-11-24 09:54:29 +01:00

posh_ps_malicious_commandlets.yml

Merge PR #5801 from @toheeb-orelope - add Invoke-DNSExfiltrator

2025-12-10 15:15:19 +01:00

posh_ps_malicious_keywords.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_memorydump_getstoragediagnosticinfo.yml

Merge PR #5452 from @david-syk - Update the MITRE ATT&CK tags for multiple rules

2025-06-04 14:39:25 +02:00

posh_ps_modification_of_dmsa_link_attribute.yml

Merge PR #5433 from @swachchhanda000 - Add BadSuccessor dMSA Abuse Related Rules

2026-03-30 12:27:13 +02:00

posh_ps_modify_group_policy_settings.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_msxml_com.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_nishang_malicious_commandlets.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_ntfs_ads_access.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_office_comobject_registerxll.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_packet_capture.yml

Merge PR #5249 from @nasbench - Promote older rules status from experimental to test

2025-04-17 00:41:35 +02:00

posh_ps_potential_invoke_mimikatz.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_potential_unconstrained_delegation_discovery.yml

Merge PR #4886 from @frack113 - Add Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock

2025-04-07 11:02:17 +02:00

posh_ps_powershell_web_access_installation.yml

Merge PR #5452 from @david-syk - Update the MITRE ATT&CK tags for multiple rules

2025-06-04 14:39:25 +02:00

posh_ps_powerview_malicious_commandlets.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_prompt_credentials.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_psasyncshell.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_psattack.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_remote_session_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_remotefxvgpudisablement_abuse.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_request_kerberos_ticket.yml

Merge PR #5761 from @swachchhanda000 - feat: Suspicious Kerberos ticket request via CLI

2025-11-23 21:12:40 +05:45

posh_ps_resolve_list_of_ip_from_file.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_root_certificate_installed.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_run_from_mount_diskimage.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_script_with_upload_capabilities.yml

Merge PR #5534 from @swachchhanda000 - update PowerShell WebRequest rules

2025-07-28 13:32:57 +02:00

posh_ps_sensitive_file_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_set_acl_susp_location.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_set_acl.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_set_policies_to_unsecure_level.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_shellcode_b64.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_shellintel_malicious_commandlets.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_software_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_store_file_in_alternate_data_stream.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_ace_tampering.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_ad_group_reco.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_alias_obfscuation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_clear_eventlog.yml

Merge PR #5679 from @swachchhanda000 - chore: update evtx baseline to v0.8.2

2025-10-09 13:03:39 +02:00

posh_ps_susp_directory_enum.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_download.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_execute_batch_script.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_extracting.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_follina_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_get_addefaultdomainpasswordpolicy.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_get_current_user.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_get_gpo.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_get_process.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_getprocess_lsass.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_gettypefromclsid.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_hyper_v_condlet.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_invocation_generic.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_invocation_specific.yml

Merge PR #5196 from @swachchhanda000 - Updated and Added rules related to Autorun Registry

2025-05-12 13:28:51 +02:00

posh_ps_susp_invoke_webrequest_useragent.yml

Merge PR #5534 from @swachchhanda000 - update PowerShell WebRequest rules

2025-07-28 13:32:57 +02:00

posh_ps_susp_iofilestream.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_keylogger_activity.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_keywords.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_local_group_reco.yml

Merge PR #5594 from @vl43den - Update Suspicious Get Local Groups Information

2025-10-01 11:50:48 +02:00

posh_ps_susp_mail_acces.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_mount_diskimage.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_mounted_share_deletion.yml

Merge PR #5679 from @swachchhanda000 - chore: update evtx baseline to v0.8.2

2025-10-09 13:03:39 +02:00

posh_ps_susp_networkcredential.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_new_psdrive.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_proxy_scripts.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_recon_export.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_remove_adgroupmember.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_service_dacl_modification_set_service.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_set_alias.yml

Merge PR #5654 from @djlukic - add hexnode fp filter

2025-10-23 08:58:09 +05:45

posh_ps_susp_smb_share_reco.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_ssl_keyword.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_start_process.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_unblock_file.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_wallpaper.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_win32_pnpentity.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_win32_shadowcopy_deletion.yml

Merge PR #5424 from @phantinuss - Some housekeeping

2025-05-20 23:12:55 +02:00

posh_ps_susp_windowstyle.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_write_eventlog.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_susp_zip_compress.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_syncappvpublishingserver_exe.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_tamper_windows_defender_rem_mp.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_tamper_windows_defender_set_mp.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

posh_ps_test_netconnection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_timestomp.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_user_discovery_get_aduser.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_user_profile_tampering.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_using_set_service_to_hide_services.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_vbscript_registry_modification.yml

Merge PR #5591 from @swachchhanda000 - Registry Modifications through VBScripts

2025-11-21 11:54:19 +01:00

posh_ps_veeam_credential_dumping_script.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_web_request_cmd_and_cmdlets.yml

Merge PR #5622 from @swachchhanda000 - fix duplicate and fps

2025-10-20 09:08:28 +05:45

posh_ps_win32_nteventlogfile_usage.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_win32_product_install_msi.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_win_api_susp_access.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_win_defender_exclusions_added.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_windows_firewall_profile_disabled.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_winlogon_helper_dll.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

posh_ps_wmi_persistence.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

posh_ps_wmi_unquoted_service_search.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_wmimplant.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_x509enrollment.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

posh_ps_xml_iex.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00