Swachchhanda Shrawan Poudel c5b881019a Merge PR #5777 from @swachchhanda000 - feat: more edrfreeze rules ...

new: WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze
new: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
new: Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
new: Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze
update: Hacktool - EDR-Freeze Execution - add more coverage
---------

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

2025-12-10 15:29:38 +01:00

..

proc_access_win_cmstp_execution_by_access.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_access_win_hktl_generic_access.yml

Merge PR #5027 from @nasbench - Promote older rules status from experimental to test

2024-10-01 14:56:09 +02:00

proc_access_win_hktl_handlekatz_lsass_access.yml

Merge PR #5380 from @david-syk - Update MITRE ATT&CK tags 2nd batch

2025-04-25 21:01:12 +02:00

proc_access_win_hktl_littlecorporal_generated_maldoc.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

proc_access_win_hktl_sysmonente.yml

Merge PR #5451 from @frack113 - chore: cleanup metadata

2025-06-04 13:33:36 +02:00

proc_access_win_lsass_dump_comsvcs_dll.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_access_win_lsass_dump_keyword_image.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_access_win_lsass_memdump.yml

Merge PR #5149 from @nasbench - Promote older rules status from experimental to test

2025-01-06 15:36:19 +01:00

proc_access_win_lsass_python_based_tool.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_access_win_lsass_remote_access_trough_winrm.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_access_win_lsass_seclogon_access.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_access_win_lsass_susp_access_flag.yml

Merge PR #5027 from @nasbench - Promote older rules status from experimental to test

2024-10-01 14:56:09 +02:00

proc_access_win_lsass_werfault.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_access_win_lsass_whitelisted_process_names.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_access_win_susp_all_access_uncommon_target.yml

Merge PR #5249 from @nasbench - Promote older rules status from experimental to test

2025-04-17 00:41:35 +02:00

proc_access_win_susp_dbgcore_dbghelp_load.yml

Merge PR #5777 from @swachchhanda000 - feat: more edrfreeze rules

2025-12-10 15:29:38 +01:00

proc_access_win_susp_direct_ntopenprocess_call.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

proc_access_win_svchost_credential_dumping.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

proc_access_win_svchost_susp_access_request.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_access_win_uac_bypass_editionupgrademanagerobj.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_access_win_uac_bypass_wow64_logger.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_access_win_werfaultsecure_msmpeng_access.yml

Merge PR #5777 from @swachchhanda000 - feat: more edrfreeze rules

2025-12-10 15:29:38 +01:00