frack113 7060db3d47 Promotion rules (#3821) ...

* Promotion rules

* fix missing null

* fix: modified date

Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>

2022-12-27 12:29:10 +01:00

..

registry_event_add_local_hidden_user.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_apt_chafer_mar18.yml

Update Title (#3733)

2022-11-28 06:43:17 +01:00

registry_event_apt_leviathan.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

registry_event_apt_oceanlotus_registry.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

registry_event_apt_pandemic.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_bypass_via_wsreset.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_cmstp_execution_by_registry.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_disable_security_events_logging_adding_reg_key_minint.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_disable_wdigest_credential_guard.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_esentutl_volume_shadow_copy_service_keys.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

registry_event_hack_wce_reg.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_hybridconnectionmgr_svc_installation.yml

Update Title (#3733)

2022-11-28 06:43:17 +01:00

registry_event_mal_azorult.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_mal_flowcloud.yml

fix: broken single item lists

2022-12-08 16:23:58 +01:00

registry_event_mimikatz_printernightmare.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

registry_event_modify_screensaver_binary_path.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_narrator_feedback_persistance.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_net_ntlm_downgrade.yml

Update Title (#3739)

2022-11-30 11:44:15 +01:00

registry_event_new_dll_added_to_appcertdlls_registry_key.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_new_dll_added_to_appinit_dlls_registry_key.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

registry_event_office_test_regadd.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

registry_event_persistence_recycle_bin.yml

feat: new rules and fixes (#3759)

2022-12-06 12:13:20 +01:00

registry_event_portproxy_registry_key.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

registry_event_redmimicry_winnti_reg.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_runkey_winekey.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_runonce_persistence.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_shell_open_keys_manipulation.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_silentprocessexit_lsass.yml

feat: multiple update and enhancements

2022-12-19 17:41:40 +01:00

registry_event_ssp_added_lsa_config.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_stickykey_like_backdoor.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

registry_event_susp_atbroker_change.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_susp_download_run_key.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_susp_lsass_dll_load.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_event_susp_mic_cam_access.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

registry_event_trust_record_modification.yml

Order yaml field

2022-10-26 06:16:55 +02:00

registry_set_legalnotice_susp_message.yml

Apply suggestions from code review

2022-12-12 13:23:59 +01:00