markus-nclose 5d7fe8823b Add reg.exe ...

Reg.exe for Qakbot defense evasion.
https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB17_28.02.2023.txt
xcopy  C:\Windows\\\\\\system32\\\\\\reg.exe C:\Users\Admin\AppData\Local\Temp\glanduleHoratory.exe /h /s /e

2023-03-01 13:27:59 +02:00

..

builtin

Merge pull request #4077 from frack113/firewall

2023-02-27 21:26:39 +01:00

create_remote_thread

restrict System process using PID

2023-02-28 12:16:55 +01:00

create_stream_hash

fix: change title from domain to wbesites

2023-02-10 10:49:52 +01:00

dns_query

Merge pull request #4074 from pfpt-dmiller/patch-1

2023-02-28 18:28:56 +01:00

driver_load

fix: typos in multiple rules (#4011)

2023-02-06 13:53:23 +01:00

file

fix: remove pptx:zone

2023-02-24 16:36:14 +01:00

image_load

chore: update pipe-notation rules to unsupported

2023-02-24 19:54:14 +01:00

network_connection

New rules added for LockBit and Reddit used for C2. (#4045)

2023-02-20 12:07:02 +01:00

pipe_created

fix: resolves #4015

2023-02-07 14:33:56 +01:00

powershell

feat: add co-author to posh_pc_abuse_nslookup_with_dns_records.yml (#4079)

2023-02-27 12:16:55 +01:00

process_access

fix: reduce author set

2023-02-01 14:34:46 +01:00

process_creation

Add reg.exe

2023-03-01 13:27:59 +02:00

raw_access_thread

fix: more fp found in testing

2023-01-18 20:16:34 +01:00

registry

fix: change to permalink

2023-02-23 10:47:52 +01:00

sysmon

fix: typos in multiple rules (#4011)

2023-02-06 13:53:23 +01:00

wmi_event

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00