booberry46 36fe748c2e Update win_rdp_reverse_tunnel.yml ...

With the recent example for the evtx. RDP Tunneling can happen not only from port 3389. So I tune it to fit in general.

Changed the obsolete twitter status with linkage to the evtx from Samir Bousseaden

2019-10-29 17:25:37 +08:00

..

builtin

Update win_rdp_reverse_tunnel.yml

2019-10-29 17:25:37 +08:00

malware

rules: AV rules updated to reflect 1.7.2 auf AV cheat sheet

2019-10-04 16:17:34 +02:00

other

Update win_defender_bypass.yml

2019-10-27 00:07:56 +08:00

powershell

powershell false positives

2019-09-06 03:54:19 -04:00

process_creation

rule: webshell detection improved

2019-10-26 09:14:54 +02:00

sysmon

fix: relevant fields in lsass dll load rule

2019-10-16 19:09:20 +02:00