tr0mb1r 4faa757e3c ClickOnce rule added ...

Unsigned Module Loaded by ClickOnce Application added, based on the article:
https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5

2023-06-08 09:24:42 +04:00

..

builtin

feat: new rule related to Failed DNS Zone Transfer (#4235)

2023-05-30 15:17:58 +02:00

create_remote_thread

feat: update author and selection

2023-05-05 18:25:07 +02:00

create_stream_hash

feat: add more extensions and fix metadata

2023-05-18 22:55:18 +02:00

dns_query

fix: FPs in testing environment

2023-05-23 12:24:01 +02:00

driver_load

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

file

chore: fix fp found in testing

2023-06-01 23:35:57 +02:00

image_load

ClickOnce rule added

2023-06-08 09:24:42 +04:00

network_connection

feat: add new rules related to small sieve

2023-05-19 02:34:01 +02:00

pipe_created

fix: FPs found in different environments

2023-04-20 09:48:47 +02:00

powershell

Merge pull request #4232 from swachchhanda000/master

2023-06-05 13:26:03 +02:00

process_access

fix: rule using old wildcard char

2023-05-18 12:30:29 +02:00

process_creation

fix: typo in 'related' field

2023-06-07 12:02:43 +02:00

raw_access_thread

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

registry

feat: add new rule "Potential PSFactoryBuffer COM Hijacking" (#4299)

2023-06-07 21:10:08 +02:00

sysmon

fix: typos in multiple rules (#4011)

2023-02-06 13:53:23 +01:00

wmi_event

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00