AaronS97 3c9e65b24b Merge PR #4534 from @AaronS97 - Possible Excel DCOM Lateral Movement ...

new: Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

2023-11-14 09:32:29 +01:00

..

builtin

Merge PR #4560 from @nasbench - Fix FP Found In Testing & Other Rule Updates

2023-11-10 17:32:28 +01:00

create_remote_thread

Merge PR #4560 from @nasbench - Fix FP Found In Testing & Other Rule Updates

2023-11-10 17:32:28 +01:00

create_stream_hash

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

dns_query

Merge PR #4463 from @citronninja - Add New Rules Related to VsCode Tunnel Usage & Abuse

2023-10-28 12:42:55 +02:00

driver_load

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

file

Merge PR #4560 from @nasbench - Fix FP Found In Testing & Other Rule Updates

2023-11-10 17:32:28 +01:00

image_load

Merge PR #4560 from @nasbench - Fix FP Found In Testing & Other Rule Updates

2023-11-10 17:32:28 +01:00

network_connection

Merge PR #4538 from @frack113 - Add Sigma CLI Configuration File

2023-11-03 16:59:53 +01:00

pipe_created

Merge PR #4491 from @nasbench - Rule Updates & Fixes

2023-10-23 10:35:57 +02:00

powershell

Merge PR #4538 from @frack113 - Add Sigma CLI Configuration File

2023-11-03 16:59:53 +01:00

process_access

Merge PR #4560 from @nasbench - Fix FP Found In Testing & Other Rule Updates

2023-11-10 17:32:28 +01:00

process_creation

Merge PR #4534 from @AaronS97 - Possible Excel DCOM Lateral Movement

2023-11-14 09:32:29 +01:00

process_tampering

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

raw_access_thread

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

registry

Merge PR #4560 from @nasbench - Fix FP Found In Testing & Other Rule Updates

2023-11-10 17:32:28 +01:00

sysmon

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

wmi_event

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00