Kamran Saifullah 2fcf250978 Merge PR #4863 from @deFr0ggy - Add network connection counterpart rule for cloudflare tunnels ...

update: Cloudflared Tunnels Related DNS Requests - Update description and related field
new: Network Connection Initiated To Cloudflared Tunnels Domains
 
---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

2024-05-27 13:10:06 +02:00

..

net_connection_win_addinutil.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_certutil_initiated_connection.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_cloudflared_communication.yml

Merge PR #4863 from @deFr0ggy - Add network connection counterpart rule for cloudflare tunnels

2024-05-27 13:10:06 +02:00

net_connection_win_dialer_initiated_connection.yml

Merge PR #4834 from @CertainlyP - Add Outbound Network Connection Initiated By Microsoft Dialer

2024-04-29 12:54:38 +02:00

net_connection_win_dllhost_non_local_ip.yml

Merge PR #4765 from @frack113 - Update additional rules to use the cidr modifier

2024-03-13 14:51:21 +01:00

net_connection_win_domain_mega_nz.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_domain_ngrok_tunnel.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_domain_ngrok.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_eqnedt.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_imewdbld.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_msiexec_http.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_notepad.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_notion_api_susp_communication.yml

Merge PR #4745 from @nasbench - Promote older rules status from experimental to test

2024-03-01 15:38:35 +01:00

net_connection_win_office_outbound_non_local_ip.yml

Merge PR #4765 from @frack113 - Update additional rules to use the cidr modifier

2024-03-13 14:51:21 +01:00

net_connection_win_office_uncommon_ports.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_python.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_rdp_outbound_over_non_standard_tools.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_rdp_reverse_tunnel.yml

Merge PR #4765 from @frack113 - Update additional rules to use the cidr modifier

2024-03-13 14:51:21 +01:00

net_connection_win_rdp_to_http.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_regasm_network_activity.yml

Merge PR #4829 from @frack113 - Add Network Connection Initiated By RegAsm.EXE

2024-04-25 16:31:56 +02:00

net_connection_win_regsvr32_network_activity.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_rundll32_net_connections.yml

Merge PR #4765 from @frack113 - Update additional rules to use the cidr modifier

2024-03-13 14:51:21 +01:00

net_connection_win_script_wan.yml

Merge PR #4765 from @frack113 - Update additional rules to use the cidr modifier

2024-03-13 14:51:21 +01:00

net_connection_win_script.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_silenttrinity_stager_msbuild_activity.yml

Order yaml field

2022-10-26 09:42:26 +02:00

net_connection_win_susp_binary_no_cmdline.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_susp_cmstp.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_susp_crypto_mining_pools.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_susp_dead_drop_resolvers.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_susp_devtunnel_connection.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_susp_dropbox_api.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_susp_external_ip_lookup.yml

Merge PR #4780 from @xiangchen96 - Minor fix for ip lookup rules

2024-03-22 12:24:22 +01:00

net_connection_win_susp_file_sharing_domains_susp_folders.yml

Merge PR #4754 from @qasimqlf - Update ATT&CK mapping for multiple rules

2024-03-06 17:33:49 +01:00

net_connection_win_susp_google_api_non_browser_access.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_susp_malware_callback_port.yml

Merge PR #4765 from @frack113 - Update additional rules to use the cidr modifier

2024-03-13 14:51:21 +01:00

net_connection_win_susp_malware_callback_ports_uncommon.yml

Merge PR #4765 from @frack113 - Update additional rules to use the cidr modifier

2024-03-13 14:51:21 +01:00

net_connection_win_susp_outbound_kerberos_connection.yml

Merge PR #4771 from @frack113 - Fix false positive found in testing

2024-03-18 12:00:59 +01:00

net_connection_win_susp_outbound_mobsync_connection.yml

Merge PR #4765 from @frack113 - Update additional rules to use the cidr modifier

2024-03-13 14:51:21 +01:00

net_connection_win_susp_outbound_smtp_connections.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

net_connection_win_susp_prog_location_network_connection.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

net_connection_win_susp_remote_powershell_session.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_telegram_api_non_browser_access.yml

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

net_connection_win_vscode_tunnel_connection.yml

Merge PR #4580 from @deFr0ggy - Update VsCode/DevTunnels Communication Related Rules

2023-11-20 13:22:15 +01:00

net_connection_win_winlogon_net_connections.yml

Merge PR #4765 from @frack113 - Update additional rules to use the cidr modifier

2024-03-13 14:51:21 +01:00

net_connection_win_wordpad_uncommon_ports.yml

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

net_connection_win_wuauclt_network_connection.yml

Merge PR #4783 from @nasbench - Update registry rules logic and fix some false positives

2024-03-26 13:28:49 +01:00