Nasreddine Bencherchali d2575eff64 fix: fp with lsass access rule ...

- Add new filters
- Reorder and rename some filter for clarity

2023-01-25 13:08:20 +01:00

..

proc_access_win_cmstp_execution_by_access.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_cobaltstrike_bof_injection_pattern.yml

fix: remove unneeded double backslash escape (#3844)

2022-12-31 08:32:46 +01:00

proc_access_win_cred_dump_lsass_access.yml

fix: fp with lsass access rule

2023-01-25 13:08:20 +01:00

proc_access_win_direct_syscall_ntopenprocess.yml

fix: enhance selection

2022-12-29 17:14:21 +01:00

proc_access_win_hack_sysmonente.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_handlekatz_lsass_access.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_invoke_patchingapi.yml

fix: fp with invoke patchingapi rule

2023-01-25 12:54:29 +01:00

proc_access_win_invoke_phantom.yml

Fix FP

2022-11-01 01:05:42 +01:00

proc_access_win_lazagne_cred_dump_lsass_access.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_littlecorporal_generated_maldoc.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_load_undocumented_autoelevated_com_interface.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_lsass_dump_comsvcs_dll.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_access_win_lsass_memdump_evasion.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_lsass_memdump_indicators.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_lsass_memdump.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_lsass_werfault.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_access_win_malware_verclsid_shellcode.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_mimikatz_trough_winrm.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_pypykatz_cred_dump_lsass_access.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_access_win_rare_proc_access_lsass.yml

fix: FPs noticed with Aurora

2022-11-13 20:26:03 +01:00

proc_access_win_shellcode_inject_msf_empire.yml

feat: filename test enhancements (#3812)

2022-12-23 09:25:16 +01:00

proc_access_win_susp_proc_access_lsass_susp_source.yml

Fix FP

2022-11-01 01:05:42 +01:00

proc_access_win_susp_proc_access_lsass.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_susp_seclogon.yml

feat: filename test enhancements (#3812)

2022-12-23 09:25:16 +01:00

proc_access_win_svchost_cred_dump.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_access_win_uac_bypass_wow64_logger.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_access_win_winapi_in_powershell_credentials_dumping.yml

feat: filename test enhancements (#3812)

2022-12-23 09:25:16 +01:00