David Vassallo 41f5ebc403 Update win_alert_ad_user_backdoors.yml ...

the original rule generates false positives if the "AllowedToDelegateTo" is set to "-". This seems to be a common occurrence, hence my proposed addition

2019-06-07 13:29:45 +03:00

..

builtin

Update win_alert_ad_user_backdoors.yml

2019-06-07 13:29:45 +03:00

malware

Update win_mal_ursnif.yml

2019-04-14 11:51:13 -05:00

other

Converted to use the new process_creation data source

2019-03-09 20:57:59 +03:00

powershell

Added missing tags and some minor improvements

2019-03-05 23:25:49 +01:00

process_creation

Rule: renamed file - name was too generic

2019-06-02 10:57:44 +02:00

sysmon

Rule: applying recommendation

2019-05-23 09:44:25 +02:00