Nate Guagenti 878df636e2 Update zeek_dns_suspicious_zbit_flag.yml ...

add MX, common mail server query type to exclusion list.

2022-02-24 14:57:24 -05:00

..

cisco/aaa

remove invalid tag

2022-01-19 18:23:30 +01:00

zeek

Update zeek_dns_suspicious_zbit_flag.yml

2022-02-24 14:57:24 -05:00

net_apt_equationgroup_c2.yml

refactor: change all " of them" expressions

2022-01-11 10:59:57 +01:00

net_dns_c2_detection.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_firewall_high_dns_bytes_out.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_firewall_high_dns_requests_rate.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_high_dns_bytes_out.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_high_dns_requests_rate.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_high_null_records_requests_rate.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_high_txt_records_requests_rate.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_mal_dns_cobaltstrike.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_pua_cryptocoin_mining_xmr.yml

Update net_pua_cryptocoin_mining_xmr.yml

2021-11-20 19:20:07 +01:00

net_susp_dns_b64_queries.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_susp_dns_txt_exec_strings.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_susp_network_scan_by_ip.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

net_susp_network_scan_by_port.yml

split global net_susp_network_scan.yml

2021-09-21 19:47:28 +02:00

net_susp_telegram_api.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_wannacry_killswitch_domain.yml

Change status for old rules

2021-11-27 11:33:14 +01:00