Nasreddine Bencherchali eea07fcc83 Merge PR #4757 from @nasbench - add new rules related to shell context tampering ...

new: Shell Context Menu Command Tampering
new: Potential SentinelOne Shell Context Menu Scan Command Tampering

2024-03-07 10:53:57 +01:00

..

builtin

Merge PR #4745 from @nasbench - Promote older rules status from experimental to test

2024-03-01 15:38:35 +01:00

create_remote_thread

Merge PR #4756 from @benmontour - Update Remote Thread Creation In Uncommon Target Image

2024-03-07 00:01:03 +01:00

create_stream_hash

Merge PR #4745 from @nasbench - Promote older rules status from experimental to test

2024-03-01 15:38:35 +01:00

dns_query

Merge PR #4733 from @joshnck - Add DNS Rule For OneLaunch Update Service

2024-02-26 21:37:49 +01:00

driver_load

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00

file

Merge PR #4754 from @qasimqlf - Update ATT&CK mapping for multiple rules

2024-03-06 17:33:49 +01:00

image_load

Merge PR #4745 from @nasbench - Promote older rules status from experimental to test

2024-03-01 15:38:35 +01:00

network_connection

Merge PR #4754 from @qasimqlf - Update ATT&CK mapping for multiple rules

2024-03-06 17:33:49 +01:00

pipe_created

Merge PR #4690 from @tr0mb1r - filter Websense named pipe

2024-01-29 11:50:59 +01:00

powershell

Merge PR #4745 from @nasbench - Promote older rules status from experimental to test

2024-03-01 15:38:35 +01:00

process_access

Merge PR #4750 from @secDre4mer - Fix false positive with Potential Credential Dumping Activity Via LSASS rule

2024-03-02 02:28:29 +01:00

process_creation

Merge PR #4753 from @defensivedepth - Update Wlrmdr.EXE Uncommon Argument Or Child Process

2024-03-06 18:09:21 +01:00

process_tampering

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

raw_access_thread

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

registry

Merge PR #4757 from @nasbench - add new rules related to shell context tampering

2024-03-07 10:53:57 +01:00

sysmon

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

wmi_event

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00