skaynum 9f10345076 Merge PR #4840 from @skaynum - Add new rules related to MySQL daemon and potential phishing attempts ...

new: Uncommon File Creation By Mysql Daemon Process
new: Potential Suspicious Browser Launch From Document Reader Process
 
---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

2024-05-27 16:48:54 +02:00

..

builtin

Merge PR #4850 from @frack113 - Cleanup rule conditions to align with standard

2024-05-13 12:10:33 +02:00

create_remote_thread

Merge PR #4756 from @benmontour - Update Remote Thread Creation In Uncommon Target Image

2024-03-07 00:01:03 +01:00

create_stream_hash

Merge PR #4841 from @nasbench - Promote older rules status from experimental to test

2024-05-02 10:34:25 +02:00

dns_query

Merge PR #4863 from @deFr0ggy - Add network connection counterpart rule for cloudflare tunnels

2024-05-27 13:10:06 +02:00

driver_load

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

file

Merge PR #4840 from @skaynum - Add new rules related to MySQL daemon and potential phishing attempts

2024-05-27 16:48:54 +02:00

image_load

Merge PR #4818 from @swachchhanda000 - Add Potentially Suspicious Child Process Of KeyScrambler.exe

2024-05-13 13:48:35 +02:00

network_connection

Merge PR #4863 from @deFr0ggy - Add network connection counterpart rule for cloudflare tunnels

2024-05-27 13:10:06 +02:00

pipe_created

Merge PR #4690 from @tr0mb1r - filter Websense named pipe

2024-01-29 11:50:59 +01:00

powershell

Merge PR #4859 from @vburov - Update casing of Win32_ShadowCopy for multiple rules

2024-05-27 14:33:46 +02:00

process_access

Merge PR #4862 from @frack113 - Add Uncommon Process Access Rights For Target Image

2024-05-27 14:23:52 +02:00

process_creation

Merge PR #4840 from @skaynum - Add new rules related to MySQL daemon and potential phishing attempts

2024-05-27 16:48:54 +02:00

process_tampering

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

raw_access_thread

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

registry

Merge PR #4844 from @frack113 - Update UAC based rules

2024-05-10 13:39:30 +02:00

sysmon

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

wmi_event

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00