Files
blue-team-tools/rules
Florian Roth 2bf502fb9c Merge PR #4866 from @Neo23x0 - Update network connection rules
new: Network Connection Initiated From Users\Public Folder
update: Outbound Network Connection Initiated By Cmstp.EXE - Exclude local IPs and ranges
update: Network Connection Initiated To Mega.nz - Reduce level to "low"
new: Network Communication Initiated To Portmap.IO Domain
update: Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder - Add additional file paths
update: Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location - Add additional file paths
 
---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
2024-05-31 13:53:53 +02:00
..
2023-04-21 15:01:48 +02:00