Nasreddine Bencherchali 3749416a30 Merge branch 'SigmaHQ:master' into nasbench-rule-devel

2023-01-02 14:50:27 +01:00

..

file_event_win_hktl_createminidump.yml

Update modified last change

2023-01-02 08:44:46 +01:00

image_load_susp_winword_wmidll_load.yml

Update modified last change

2023-01-02 08:44:46 +01:00

posh_ps_access_to_chrome_login_data.yml

Update modified last change

2023-01-02 08:44:46 +01:00

posh_ps_azurehound_commands.yml

feat: updates and enhancements

2023-01-02 14:49:45 +01:00

posh_ps_invoke_nightmare.yml

feat: updates and enhancements

2023-01-02 14:49:45 +01:00

powershell_suspicious_download.yml

Update modified last change

2023-01-02 08:44:46 +01:00

powershell_suspicious_invocation_generic.yml

Update modified last change

2023-01-02 08:44:46 +01:00

powershell_suspicious_invocation_specific.yml

Update modified last change

2023-01-02 08:44:46 +01:00

powershell_syncappvpublishingserver_exe.yml

Update modified last change

2023-01-02 08:44:46 +01:00

proc_access_win_in_memory_assembly_execution.yml

Update modified last change

2023-01-02 08:44:46 +01:00

proc_creation_win_invoke_obfuscation_via_use_rundll32.yml

Update proc_creation_win_invoke_obfuscation_via_use_rundll32.yml

2022-12-30 09:53:25 +01:00

proc_creation_win_lolbas_execution_of_wuauclt.yml

Update modified last change

2023-01-02 08:44:46 +01:00

proc_creation_win_mavinject_proc_inj.yml

Update modified last change

2023-01-02 08:44:46 +01:00

proc_creation_win_nslookup_pwsh_download_cradle.yml

fix: add missing modified field

2022-12-14 10:32:11 +01:00

proc_creation_win_office_from_proxy_executing_regsvr32_payload2.yml

feat: general updates and fixes

2022-12-02 23:16:03 +01:00

proc_creation_win_office_from_proxy_executing_regsvr32_payload.yml

Update modified last change

2023-01-02 08:44:46 +01:00

proc_creation_win_possible_applocker_bypass.yml

Update modified last change

2023-01-02 08:44:46 +01:00

proc_creation_win_powershell_bitsjob.yml

Update modified last change

2023-01-02 08:44:46 +01:00

proc_creation_win_susp_run_folder.yml

Update modified last change

2023-01-02 08:44:46 +01:00

process_creation_syncappvpublishingserver_exe.yml

Update modified last change

2023-01-02 08:44:46 +01:00

registry_event_asep_reg_keys_modification.yml

Update modified last change

2023-01-02 08:44:46 +01:00

registry_set_abusing_windows_telemetry_for_persistence.yml

Update modified last change

2023-01-02 08:44:46 +01:00

registry_set_silentprocessexit.yml

Update modified last change

2023-01-02 08:44:46 +01:00

sysmon_accessing_winapi_in_powershell_credentials_dumping.yml

Refractor (#3794)

2022-12-18 21:00:14 +01:00

sysmon_dcom_iertutil_dll_hijack.yml

Refractor (#3794)

2022-12-18 21:00:14 +01:00

sysmon_mimikatz_detection_lsass.yml

Update modified last change

2023-01-02 08:44:46 +01:00

sysmon_rclone_execution.yml

Update modified last change

2023-01-02 08:44:46 +01:00

win_lateral_movement_condrv.yml

Update modified last change

2023-01-02 08:44:46 +01:00

win_susp_esentutl_activity.yml

Update modified last change

2023-01-02 08:44:46 +01:00

win_susp_rclone_exec.yml

Update modified last change

2023-01-02 08:44:46 +01:00

win_susp_vssadmin_ntds_activity.yml

Update modified last change

2023-01-02 08:44:46 +01:00