frack113 ee67779811 Windows T1049 RedCannary

2021-12-11 09:38:20 +01:00

..

powershell_classic_alternate_powershell_hosts.yml

change to category: ps_classic_*

2021-10-16 08:26:51 +02:00

powershell_classic_powercat.yml

change to category: ps_classic_*

2021-10-16 08:26:51 +02:00

powershell_classic_remote_powershell_session.yml

change to category: ps_classic_*

2021-10-16 08:26:51 +02:00

powershell_classic_susp_athremotefxvgpudisablementcommand.yml

order powershell_classic

2021-10-07 07:40:53 +02:00

powershell_classic_susp_zip_compress.yml

order powershell_classic

2021-10-07 07:40:53 +02:00

powershell_classic_suspicious_download.yml

change to category: ps_classic_*

2021-10-16 08:26:51 +02:00

powershell_delete_volume_shadow_copies.yml

change to category: ps_classic_*

2021-10-16 08:26:51 +02:00

powershell_downgrade_attack.yml

change to category: ps_classic_*

2021-10-16 08:26:51 +02:00

powershell_exe_calling_ps.yml

change to category: ps_classic_*

2021-10-16 08:26:51 +02:00

powershell_pc_susp_get_nettcpconnection.yml

Windows T1049 RedCannary

2021-12-11 09:38:20 +01:00

powershell_renamed_powershell.yml

change to category: ps_classic_*

2021-10-16 08:26:51 +02:00

powershell_tamper_with_windows_defender.yml

change to category: ps_classic_*

2021-10-16 08:26:51 +02:00

powershell_wsman_com_provider_no_powershell.yml

order powershell_classic

2021-10-07 07:40:53 +02:00

powershell_xor_commandline.yml

change to category: ps_classic_*

2021-10-16 08:26:51 +02:00