Qasim Qlf 3b4fc8c3fd VS Code Filter Fix - Undo the last commit ...

Previous Filter of Image was wrong. Image can't endsWith (Code.exe and attrib.exe) at the same time. Same condition with other scenario.
CommandLine filter is good.

2022-09-13 16:02:17 +05:00

..

builtin

Update win_susp_computer_name.yml

2022-09-09 18:53:48 +02:00

create_remote_thread

fix: FP found in testing environment

2022-08-29 16:58:12 +02:00

create_stream_hash

Merge pull request #3468 from nasbench/nasbench-rule-devel

2022-09-08 06:29:36 +02:00

dns_query

fix: FP on race condition

2022-09-08 16:28:05 +02:00

driver_load

New+Update

2022-09-02 09:15:21 +02:00

file_access

System FP

2022-07-27 10:52:08 +02:00

file_change

Revert "Merge branch 'master' of github.com:elhoim/sigma"

2022-09-09 16:55:12 +02:00

file_delete

Update Ref+Selection

2022-07-11 14:11:53 +01:00

file_event

tightened the regular expression

2022-09-10 09:34:16 +02:00

file_rename

Update file_rename_win_ransomware.yml

2022-08-31 16:08:12 +02:00

image_load

Merge branch 'master' into aurora-false-positive-fixing

2022-09-13 08:07:26 +02:00

network_connection

Merge pull request #3459 from SigmaHQ/aurora-false-positive-fixing

2022-09-06 08:41:02 +02:00

pipe_created

rule: CsExec

2022-08-22 17:43:49 +02:00

powershell

Merge pull request #3482 from nasbench/nasbench-rule-devel

2022-09-10 12:34:26 +02:00

process_access

fix: FP with windows defender

2022-09-09 13:51:53 +02:00

process_creation

VS Code Filter Fix - Undo the last commit

2022-09-13 16:02:17 +05:00

raw_access_thread

fix: FPs with THOR

2022-03-15 18:05:42 +01:00

registry

Big Update

2022-09-09 15:02:31 +02:00

sysmon

fix: changes to existing rules

2022-09-13 08:07:03 +02:00

wmi_event

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00