Florian Roth 968f0ae11f Merge pull request #3508 from SigmaHQ/aurora-false-positive-fixing ...

fix: FPs noticed with Aurora

2022-09-18 13:24:07 +02:00

..

posh_pm_alternate_powershell_hosts.yml

Merge pull request #3508 from SigmaHQ/aurora-false-positive-fixing

2022-09-18 13:24:07 +02:00

posh_pm_bad_opsec_artifacts.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

posh_pm_clear_powershell_history.yml

chore: test rules: check for all modifier with single item

2022-05-11 11:06:09 +02:00

posh_pm_decompress_commands.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_pm_get_addbaccount.yml

chore: test rules: capitalization on FP list entries

2022-05-09 16:07:44 +02:00

posh_pm_get_clipboard.yml

Removed related field

2022-06-21 11:43:18 +01:00

posh_pm_invoke_obfuscation_clip.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00

posh_pm_invoke_obfuscation_obfuscated_iex.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

posh_pm_invoke_obfuscation_stdin.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00

posh_pm_invoke_obfuscation_var.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00

posh_pm_invoke_obfuscation_via_compress.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_pm_invoke_obfuscation_via_rundll.yml

Refactor regex

2022-03-08 19:07:37 +01:00

posh_pm_invoke_obfuscation_via_stdin.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00

posh_pm_invoke_obfuscation_via_use_clip.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00

posh_pm_invoke_obfuscation_via_use_mhsta.yml

Refactor regex

2022-03-07 19:08:30 +01:00

posh_pm_invoke_obfuscation_via_use_rundll32.yml

Refactor regex

2022-03-08 19:07:37 +01:00

posh_pm_invoke_obfuscation_via_var.yml

Add missing definition fields and references

2022-07-07 19:13:01 +01:00

posh_pm_powercat.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

posh_pm_remote_powershell_session.yml

fix: FPs

2022-06-20 12:52:23 +02:00

posh_pm_susp_ad_group_reco.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

posh_pm_susp_athremotefxvgpudisablementcommand.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

posh_pm_susp_download.yml

Renamed suspicious in filenames to susp

2022-05-19 09:37:04 +02:00

posh_pm_susp_get_nettcpconnection.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

posh_pm_susp_invocation_generic.yml

Add missing definition fields and references

2022-07-07 19:13:01 +01:00

posh_pm_susp_invocation_specific.yml

Add missing definition fields and references

2022-07-07 19:13:01 +01:00

posh_pm_susp_local_group_reco.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

posh_pm_susp_reset_computermachinepassword.yml

Add missing definition fields and references

2022-07-07 19:13:01 +01:00

posh_pm_susp_smb_share_reco.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

posh_pm_susp_zip_compress.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

posh_pm_syncappvpublishingserver_exe.yml

Add missing definition fields and references

2022-07-07 19:13:01 +01:00