xiangchen96 6eb7ce7dae Merge PR #4710 from @xiangchen96 - Add ipconfig.io domain ...

update: Suspicious DNS Query for IP Lookup Service APIs - Add ipconfig.io domain
update: Suspicious Network Connection to IP Lookup Service APIs - Add ipconfig.io domain

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

2024-02-08 16:16:02 +01:00

..

net_connection_win_addinutil.yml

Merge PR #4452 from @SILJAEUROPA - Add New Rules To AddInUtil Potential Abuse

2023-10-05 13:07:50 +02:00

net_connection_win_binary_susp_com.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

net_connection_win_certutil_initiated_connection.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_crypto_mining_pools.yml

Merge PR #4680 from @xiangchen96 - new domains from miningocean.org

2024-01-19 16:48:29 +01:00

net_connection_win_dead_drop_resolvers.yml

Merge PR #4713 from @X-Junior - Update Potential Dead Drop Resolvers rule

2024-02-06 16:19:32 +01:00

net_connection_win_devtunnel_connection.yml

Merge PR #4580 from @deFr0ggy - Update VsCode/DevTunnels Communication Related Rules

2023-11-20 13:22:15 +01:00

net_connection_win_dfsvc_uncommon_ports.yml

feat: update clickonce rules

2023-06-12 23:52:40 +02:00

net_connection_win_dllhost_net_connections.yml

fix: filter fp found in testing

2023-01-20 11:39:08 +01:00

net_connection_win_eqnedt.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_excel_outbound_network_connection.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_google_api_non_browser_access.yml

Merge PR #4538 from @frack113 - Add Sigma CLI Configuration File

2023-11-03 16:59:53 +01:00

net_connection_win_hh.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_imewdbld.yml

Merge PR #4557 from @swachchhanda000 - Multiple Rule Updates & New Rules

2023-11-14 09:46:39 +01:00

net_connection_win_mega_nz.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

net_connection_win_msiexec.yml

change status to test

2023-01-27 06:48:34 +01:00

net_connection_win_ngrok_domains.yml

Merge PR #4576 from @Neo23x0 - Additional Ngrok Domains

2023-11-17 16:44:49 +01:00

net_connection_win_ngrok_tunnel.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_notepad_network_connection.yml

Order yaml field

2022-10-26 09:42:26 +02:00

net_connection_win_notion_api_susp_communication.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

net_connection_win_office_susp_ports.yml

Merge PR #4619 from @mcdave2k1 - Tune false positives with IMAP & SMTP ports

2023-12-18 11:19:13 +01:00

net_connection_win_powershell_network_connection.yml

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

net_connection_win_python.yml

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

net_connection_win_rdp_outbound_over_non_standard_tools.yml

Merge PR #4684 from @phantinuss - Multiple FP fixes & rule updates

2024-01-23 12:15:04 +01:00

net_connection_win_rdp_reverse_tunnel.yml

fix: broken single item lists

2022-12-08 16:23:58 +01:00

net_connection_win_rdp_to_http.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_reddit_api_non_browser_access.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

net_connection_win_regsvr32_network_activity.yml

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

net_connection_win_remote_powershell_session_network.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

net_connection_win_rundll32_net_connections.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

net_connection_win_script_wan.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_script.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_silenttrinity_stager_msbuild_activity.yml

Order yaml field

2022-10-26 09:42:26 +02:00

net_connection_win_susp_binary_no_cmdline.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_susp_cmstp.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_susp_dropbox_api.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_susp_epmap.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

net_connection_win_susp_external_ip_lookup.yml

Merge PR #4710 from @xiangchen96 - Add ipconfig.io domain

2024-02-08 16:16:02 +01:00

net_connection_win_susp_malware_callback_port.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

net_connection_win_susp_malware_callback_ports_uncommon.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

net_connection_win_susp_outbound_kerberos_connection.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

net_connection_win_susp_outbound_mobsync_connection.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_susp_outbound_smtp_connections.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_susp_prog_location_network_connection.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

net_connection_win_telegram_api_non_browser_access.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

net_connection_win_vscode_tunnel_connection.yml

Merge PR #4580 from @deFr0ggy - Update VsCode/DevTunnels Communication Related Rules

2023-11-20 13:22:15 +01:00

net_connection_win_winlogon_net_connections.yml

Update net_connection_win_winlogon_net_connections.yml

2023-04-28 16:39:04 +02:00

net_connection_win_wuauclt_network_connection.yml

Merge PR #4575 from @fukusuket - Fix typo in the selection name

2023-11-17 15:25:24 +01:00