Andreas Braathen 5397ea4f0a Merge PR #4882 from @netgrain - New rules related to LocaltoNet tunneling ...

new: Communication To LocaltoNet Tunneling Service Initiated
new: Communication To LocaltoNet Tunneling Service Initiated - Linux 

---------

Co-authored-by: Andreas Braathen <andreasb@mnemonic.io>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

2024-06-20 13:09:49 +02:00

..

builtin

Merge PR #4873 from @ruppde - Add the string "mikatz" to relevant rules

2024-06-05 23:17:16 +02:00

create_remote_thread

Merge PR #4756 from @benmontour - Update Remote Thread Creation In Uncommon Target Image

2024-03-07 00:01:03 +01:00

create_stream_hash

Merge PR #4841 from @nasbench - Promote older rules status from experimental to test

2024-05-02 10:34:25 +02:00

dns_query

Merge PR #4863 from @deFr0ggy - Add network connection counterpart rule for cloudflare tunnels

2024-05-27 13:10:06 +02:00

driver_load

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

file

Merge PR #4867 from @nasbench - Promote older rules status from experimental to test

2024-06-03 10:29:22 +02:00

image_load

Merge PR #4867 from @nasbench - Promote older rules status from experimental to test

2024-06-03 10:29:22 +02:00

network_connection

Merge PR #4882 from @netgrain - New rules related to LocaltoNet tunneling

2024-06-20 13:09:49 +02:00

pipe_created

Merge PR #4690 from @tr0mb1r - filter Websense named pipe

2024-01-29 11:50:59 +01:00

powershell

Merge PR #4867 from @nasbench - Promote older rules status from experimental to test

2024-06-03 10:29:22 +02:00

process_access

Merge PR #4862 from @frack113 - Add Uncommon Process Access Rights For Target Image

2024-05-27 14:23:52 +02:00

process_creation

Merge PR #4778 from @faisalusuf - Add new rule covering suspicious usage of Qemu

2024-06-03 14:23:51 +02:00

process_tampering

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

raw_access_thread

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

registry

Merge PR #4869 from @ssnkhan - Add new rules detecting Windows Recall feature enabling

2024-06-03 12:13:50 +02:00

sysmon

Merge PR #4867 from @nasbench - Promote older rules status from experimental to test

2024-06-03 10:29:22 +02:00

wmi_event

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00