Antonlovesdnb 397cdecb94 5 Rules covering various macro techniques ...

- Rule to look for GAC DLL loaded by an Office Product
- Rule to look for any DLL in C:\Windows\assembly loaded by an Office Product
- Rule to look for clr.dll loaded by an Office Product
- Rule to look for directory services parsing dll loaded by an Office Product
- Rule to look for kerberos dll loaded by an Office Product

2020-02-19 14:43:13 -05:00

..

builtin

Merge pull request #606 from Neo23x0/devel

2020-02-01 18:25:19 +01:00

malware

Merge pull request #492 from booberry46/master

2020-01-30 14:27:30 +01:00

other

Merge pull request #604 from Neo23x0/devel

2020-01-31 07:07:13 +01:00

powershell

rule: remove keywords in powershell rule prone to FPs

2020-02-11 16:26:17 +01:00

process_creation

fix: fixing too restrictive rule

2020-02-18 10:43:22 +01:00

sysmon

5 Rules covering various macro techniques

2020-02-19 14:43:13 -05:00