Florian Roth 811ed59e27 fix: FPs with Aurora and THOR

2022-03-20 16:18:18 +01:00

..

proc_access_win_cmstp_execution_by_access.yml

Name Normalization

2022-02-27 10:58:14 +01:00

proc_access_win_cobaltstrike_bof_injection_pattern.yml

Name Normalization

2022-02-27 10:58:14 +01:00

proc_access_win_cred_dump_lsass_access.yml

Merge branch 'master' into aurora-false-positive-fixing

2022-03-07 15:40:42 +01:00

proc_access_win_direct_syscall_ntopenprocess.yml

Name Normalization

2022-02-27 10:58:14 +01:00

proc_access_win_in_memory_assembly_execution.yml

fix: sadly still too many fps with this rule

2022-03-16 15:21:27 +01:00

proc_access_win_invoke_phantom.yml

Name Normalization

2022-02-27 10:58:14 +01:00

proc_access_win_lazagne_cred_dump_lsass_access.yml

Name Normalization

2022-02-27 10:58:14 +01:00

proc_access_win_littlecorporal_generated_maldoc.yml

Name Normalization

2022-02-27 10:58:14 +01:00

proc_access_win_load_undocumented_autoelevated_com_interface.yml

Name Normalization

2022-02-27 10:58:14 +01:00

proc_access_win_lsass_dump_comsvcs_dll.yml

Name Normalization

2022-02-27 10:58:14 +01:00

proc_access_win_lsass_memdump_evasion.yml

Name Normalization

2022-02-27 10:58:14 +01:00

proc_access_win_lsass_memdump_indicators.yml

Name Normalization

2022-02-27 10:58:14 +01:00

proc_access_win_lsass_memdump.yml

fix: FPs with Aurora and THOR

2022-03-20 16:18:18 +01:00

proc_access_win_malware_verclsid_shellcode.yml

Name Normalization

2022-02-27 10:58:14 +01:00

proc_access_win_mimikatz_trough_winrm.yml

Name Normalization

2022-02-27 10:58:14 +01:00

proc_access_win_pypykatz_cred_dump_lsass_access.yml

Name Normalization

2022-02-27 10:58:14 +01:00

proc_access_win_rare_proc_access_lsass.yml

docs: adjusted description

2022-03-13 23:30:44 +01:00

proc_access_win_susp_proc_access_lsass_susp_source.yml

Merge branch 'master' into aurora-false-positive-fixing

2022-03-07 15:40:42 +01:00

proc_access_win_susp_proc_access_lsass.yml

Merge branch 'master' into rule-devel

2022-03-14 11:38:44 +01:00

proc_access_win_svchost_cred_dump.yml

Name Normalization

2022-02-27 10:58:14 +01:00

proc_access_win_uac_bypass_wow64_logger.yml

Name Normalization

2022-02-27 10:58:14 +01:00