Nasreddine Bencherchali 37af110aa2 Update proc_creation_win_susp_office_token_search.yml

2022-10-25 23:48:08 +02:00

..

builtin

add FP filter for MS Office

2022-10-25 14:15:08 +02:00

create_remote_thread

Order yaml field

2022-10-25 12:00:56 +02:00

create_stream_hash

Order yaml field

2022-10-25 12:00:56 +02:00

dns_query

Order yaml field

2022-10-25 12:00:56 +02:00

driver_load

Order yaml field

2022-10-25 12:00:56 +02:00

file

Add Office Token Stealing Rules

2022-10-25 01:14:27 +02:00

image_load

Update image_load_side_load_dbghelp_dll.yml

2022-10-25 12:48:52 +02:00

network_connection

old experimental rule promotion

2022-10-09 16:54:04 +02:00

pipe_created

Order yaml field

2022-10-25 12:00:56 +02:00

powershell

fix: Fix typo in selection

2022-10-25 01:47:53 +02:00

process_access

Merge pull request #3611 from nasbench/fix-false-positives

2022-10-21 18:11:27 +02:00

process_creation

Update proc_creation_win_susp_office_token_search.yml

2022-10-25 23:48:08 +02:00

raw_access_thread

Order yaml field

2022-10-25 12:00:56 +02:00

registry

Apply suggestions from code review

2022-10-25 15:17:50 +02:00

sysmon

Order yaml field

2022-10-25 12:00:56 +02:00

wmi_event

Order yaml field

2022-10-25 12:00:56 +02:00