SILJAEUROPA a7fc610b70 Merge PR #4452 from @SILJAEUROPA - Add New Rules To AddInUtil Potential Abuse ...

new: Network Connection Initiated By AddinUtil.EXE
new: Suspicious AddinUtil.EXE CommandLine Execution
new: Uncommon Child Process Of AddinUtil.EXE
new: Uncommon AddinUtil.EXE CommandLine Execution
new: AddinUtil.EXE Execution From Uncommon Directory

---------

Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

2023-10-05 13:07:50 +02:00

..

net_connection_win_addinutil.yml

Merge PR #4452 from @SILJAEUROPA - Add New Rules To AddInUtil Potential Abuse

2023-10-05 13:07:50 +02:00

net_connection_win_binary_susp_com.yml

feat: update rules using file sharing domains

2023-08-17 13:39:59 +02:00

net_connection_win_certutil_initiated_connection.yml

feat: update multiple rules

2023-04-18 18:08:08 +02:00

net_connection_win_crypto_mining_pools.yml

feat: update multiple rules

2023-04-18 18:08:08 +02:00

net_connection_win_dead_drop_resolvers.yml

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

net_connection_win_dfsvc_uncommon_ports.yml

feat: update clickonce rules

2023-06-12 23:52:40 +02:00

net_connection_win_dllhost_net_connections.yml

fix: filter fp found in testing

2023-01-20 11:39:08 +01:00

net_connection_win_eqnedt.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

net_connection_win_excel_outbound_network_connection.yml

Fix

2022-11-03 09:39:48 +01:00

net_connection_win_google_api_non_browser_access.yml

feat: new rule net_connection_win_google_api_non_browser_access.yml (#4212)

2023-05-03 10:32:28 +02:00

net_connection_win_hh.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

net_connection_win_imewdbld.yml

change status to test

2023-01-27 06:48:34 +01:00

net_connection_win_malware_backconnect_ports.yml

feat: add new rules related to coldsteel

2023-05-02 19:02:53 +02:00

net_connection_win_mega_nz.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

net_connection_win_msiexec.yml

change status to test

2023-01-27 06:48:34 +01:00

net_connection_win_ngrok_io.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

net_connection_win_ngrok_tunnel.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

net_connection_win_notepad_network_connection.yml

Order yaml field

2022-10-26 09:42:26 +02:00

net_connection_win_notion_api_susp_communication.yml

fix: filter names and title

2023-05-09 20:54:55 +02:00

net_connection_win_office_susp_ports.yml

fix: typo

2023-07-17 13:57:27 +02:00

net_connection_win_powershell_network_connection.yml

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

net_connection_win_python.yml

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

net_connection_win_rdp_outbound_over_non_standard_tools.yml

fix: FPs found in different environments

2023-04-20 09:48:47 +02:00

net_connection_win_rdp_reverse_tunnel.yml

fix: broken single item lists

2022-12-08 16:23:58 +01:00

net_connection_win_rdp_to_http.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

net_connection_win_reddit_api_non_browser_access.yml

fix: update hostname field

2023-04-19 16:16:06 +02:00

net_connection_win_regsvr32_network_activity.yml

Merge PR #4427 from @nasbench - Multiple Fixes & Enhancements

2023-10-04 19:06:57 +02:00

net_connection_win_remote_powershell_session_network.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

net_connection_win_rundll32_net_connections.yml

fix: FPs with cloudapp

2023-02-05 11:14:05 +01:00

net_connection_win_script_wan.yml

Order yaml field

2022-10-26 09:42:26 +02:00

net_connection_win_script.yml

Order yaml field

2022-10-26 09:42:26 +02:00

net_connection_win_silenttrinity_stager_msbuild_activity.yml

Order yaml field

2022-10-26 09:42:26 +02:00

net_connection_win_susp_binary_no_cmdline.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

net_connection_win_susp_cmstp.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

net_connection_win_susp_dropbox_api.yml

Merge PR #4392 from @tjgeorgen - Update MITRE Tags

2023-08-28 16:53:27 +02:00

net_connection_win_susp_epmap.yml

Merge PR #4462 From @phantinuss - Fix FP With Unknown Process

2023-09-28 11:13:34 +02:00

net_connection_win_susp_external_ip_lookup.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

net_connection_win_susp_outbound_kerberos_connection.yml

fix: remove kerberos generic filters

2023-01-31 22:18:32 +01:00

net_connection_win_susp_outbound_mobsync_connection.yml

Order yaml field

2022-10-26 09:42:26 +02:00

net_connection_win_susp_outbound_smtp_connections.yml

Order yaml field

2022-10-26 09:42:26 +02:00

net_connection_win_susp_prog_location_network_connection.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

net_connection_win_telegram_api_non_browser_access.yml

feat: add new rules related to small sieve

2023-05-19 02:34:01 +02:00

net_connection_win_winlogon_net_connections.yml

Update net_connection_win_winlogon_net_connections.yml

2023-04-28 16:39:04 +02:00

net_connection_win_wuauclt_network_connection.yml

fix: filter fp found in testing

2023-01-20 11:39:08 +01:00