fornotes d4cb9fde6f Merge PR #4906 from @fornotes - Update and add new dll sideloading rules ...

update: Potential System DLL Sideloading From Non System Locations - Add new entries to increase coverage
new: Potential DLL Sideloading Of DbgModel.DLL
new: Potential DLL Sideloading Of MpSvc.DLL
new: Potential DLL Sideloading Of MsCorSvc.DLL 

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

2024-07-11 12:57:37 +02:00

..

builtin

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

create_remote_thread

Merge PR #4756 from @benmontour - Update Remote Thread Creation In Uncommon Target Image

2024-03-07 00:01:03 +01:00

create_stream_hash

Merge PR #4841 from @nasbench - Promote older rules status from experimental to test

2024-05-02 10:34:25 +02:00

dns_query

Update Rules (#4872)

2024-06-25 11:26:45 +02:00

driver_load

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

file

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

image_load

Merge PR #4906 from @fornotes - Update and add new dll sideloading rules

2024-07-11 12:57:37 +02:00

network_connection

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

pipe_created

Merge PR #4891 from @nasbench - Promote older rules status from experimental to test

2024-07-01 10:42:32 +02:00

powershell

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

process_access

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

process_creation

Merge PR #4912 from @nasbench - update pySigma-validators-sigmahq to version 0.7.0 and sigma_cli_conf.yml

2024-07-11 11:24:01 +02:00

process_tampering

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

raw_access_thread

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

registry

Merge PR #4831 from @swachchhanda000 - Add Kapeka backdoor related Sigma rules

2024-07-04 00:17:47 +02:00

sysmon

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02 12:00:11 +02:00

wmi_event

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00