frack113 7922becd0b Fix FP new install

2022-03-04 16:53:30 +01:00

..

registry_event_abusing_windows_telemetry_for_persistence.yml

Add setvalue for Details

2022-01-13 16:28:29 +01:00

registry_event_add_local_hidden_user.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_add_port_monitor.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_apt_chafer_mar18.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

registry_event_apt_leviathan.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_apt_oceanlotus_registry.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_apt_pandemic.yml

split sysmon_apt_pandemic

2021-09-12 09:42:11 +02:00

registry_event_asep_reg_keys_modification_classes.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_asep_reg_keys_modification_common.yml

Fix FP new install

2022-03-04 16:53:30 +01:00

registry_event_asep_reg_keys_modification_currentcontrolset.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_asep_reg_keys_modification_currentversion_nt.yml

OfficeClickToRun FP

2022-03-03 19:45:03 +01:00

registry_event_asep_reg_keys_modification_currentversion.yml

Fix FP new install

2022-03-04 16:53:30 +01:00

registry_event_asep_reg_keys_modification_internet_explorer.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_asep_reg_keys_modification_office.yml

OfficeClickToRun FP

2022-03-03 19:45:03 +01:00

registry_event_asep_reg_keys_modification_session_manager.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_asep_reg_keys_modification_system_scripts.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_asep_reg_keys_modification_winsock2.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_asep_reg_keys_modification_wow6432node_classes.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_asep_reg_keys_modification_wow6432node_currentversion.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_asep_reg_keys_modification_wow6432node.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_asep_reg_keys_modification.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_blackbyte_ransomware.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_bypass_uac_using_delegateexecute.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_bypass_uac_using_eventviewer.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_bypass_uac_using_silentcleanup_task.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_bypass_via_wsreset.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_change_rdp_port.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_change_security_zones.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_chrome_extension.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_cmstp_execution_by_registry.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_cobaltstrike_service_installs.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_comhijack_sdclt.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_crashdump_disabled.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_cve_2020_1048.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_cve_2021_31979_cve_2021_33771_exploits.yml

Add cve tags

2021-10-25 18:14:03 +02:00

registry_event_defender_disabled.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

registry_event_defender_exclusions.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

registry_event_defender_realtime_protection_disabled.yml

Create new rule for detecting Microsfot Defender Tampering via Registry

2021-10-18 10:07:44 +04:00

registry_event_dhcp_calloutdll.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_disable_administrative_share.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_disable_defender_firewall.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_disable_microsoft_office_security_features.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_disable_security_events_logging_adding_reg_key_minint.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_disable_uac_registry.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_disable_wdigest_credential_guard.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_disabled_exploit_guard_net_protection_on_ms_defender.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_disabled_pua_protection_on_microsoft_defender.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_disabled_tamper_protection_on_microsoft_defender.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_dns_over_https_enabled.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_dns_serverlevelplugindll.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

registry_event_enabling_cor_profiler_env_variables.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_esentutl_volume_shadow_copy_service_keys.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_etw_disabled.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_file_association_exefile.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_hack_wce_reg.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_hidden_extention.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_hybridconnectionmgr_svc_installation.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_ie_persistence.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_logon_scripts_userinitmprlogonscript_reg.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_mal_adwind.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

registry_event_mal_azorult.yml

Order rules

2022-01-20 22:06:55 +01:00

registry_event_mal_blue_mockingbird.yml

Order rules

2022-01-20 22:06:55 +01:00

registry_event_mal_flowcloud.yml

Order rules

2022-01-20 22:06:55 +01:00

registry_event_mal_netwire.yml

Order rules

2022-01-20 22:06:55 +01:00

registry_event_mal_ursnif.yml

Order rules

2022-01-20 22:06:55 +01:00

registry_event_mimikatz_printernightmare.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_modify_screensaver_binary_path.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_mstsc_history_cleared.yml

refactor: change all " of them" expressions

2022-01-11 10:59:57 +01:00

registry_event_narrator_feedback_persistance.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_net_ntlm_downgrade.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

registry_event_new_application_appcompat.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_new_dll_added_to_appcertdlls_registry_key.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_new_dll_added_to_appinit_dlls_registry_key.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_office_enable_dde.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_office_security.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_office_test_regadd.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_office_vsto_persistence.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_outlook_c2_registry_key.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_outlook_registry_todaypage.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_outlook_registry_webview.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_outlook_security.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_persistence_key_linking.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_persistence_recycle_bin.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_persistence_search_order.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_persistence.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_portproxy_registry_key.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_powershell_as_service.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_rdp_registry_modification.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_rdp_settings_hijack.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_redmimicry_winnti_reg.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_removal_amsi_registry_key.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_removal_com_hijacking_registry_key.yml

Fix FP new install

2022-03-04 16:53:30 +01:00

registry_event_runkey_winekey.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_runonce_persistence.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_set_servicedll.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_shell_open_keys_manipulation.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_shim_databases_persistence.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_silentprocessexit_lsass.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_silentprocessexit.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_ssp_added_lsa_config.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_stickykey_like_backdoor.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

registry_event_susp_atbroker_change.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_susp_download_run_key.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_susp_lsass_dll_load.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_susp_mic_cam_access.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_susp_printer_driver.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_susp_reg_persist_explorer_run.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_susp_run_key_img_folder.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_susp_service_installed.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_suspicious_keyboard_layout_load.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_sysinternals_eula_accepted.yml

split sysinternals eula and uac bypass

2021-09-12 09:38:05 +02:00

registry_event_sysinternals_sdelete_registry_keys.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_taskcache_entry.yml

Fix Windows11-Office FP

2022-03-03 15:20:53 +01:00

registry_event_telemetry_persistence.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_trust_record_modification.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_uac_bypass_eventvwr.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

registry_event_uac_bypass_sdclt.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_uac_bypass_winsat.yml

Add setvalue for Details

2022-01-13 16:28:29 +01:00

registry_event_uac_bypass_wmp.yml

Add setvalue for Details

2022-01-13 16:28:29 +01:00

registry_event_vbs_payload_stored.yml

Fix FP new install

2022-03-04 16:53:30 +01:00

registry_event_wab_dllpath_reg_change.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_wdigest_enable_uselogoncredential.yml

Name Normalization

2022-02-27 10:58:14 +01:00

registry_event_winlogon_notify_key.yml

Name Normalization

2022-02-27 10:58:14 +01:00