frack113 221f479825 Windows Redcannay T1069.001

2021-12-12 12:15:27 +01:00

..

powershell_alternate_powershell_hosts.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_bad_opsec_artifacts.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_clear_powershell_history.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_decompress_commands.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_get_clipboard.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_invoke_obfuscation_clip.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_invoke_obfuscation_obfuscated_iex.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_invoke_obfuscation_stdin.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_invoke_obfuscation_var.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_invoke_obfuscation_via_compress.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_invoke_obfuscation_via_rundll.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_invoke_obfuscation_via_stdin.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_invoke_obfuscation_via_use_clip.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_invoke_obfuscation_via_use_mhsta.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_invoke_obfuscation_via_use_rundll32.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_invoke_obfuscation_via_var.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_pm_susp_get_nettcpconnection.yml

Windows T1049 RedCannary

2021-12-11 09:38:20 +01:00

powershell_pm_suspicious_local_group_reco.yml

Windows Redcannay T1069.001

2021-12-12 12:15:27 +01:00

powershell_powercat.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_remote_powershell_session.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_susp_athremotefxvgpudisablementcommand.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_susp_zip_compress.yml

Change to category: ps_module

2021-10-16 08:05:15 +02:00

powershell_suspicious_download_in_contextinfo.yml

cleanup list

2021-10-18 14:52:35 +02:00

powershell_suspicious_invocation_generic_in_contextinfo.yml

feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*'

2021-12-02 14:47:39 +01:00

powershell_suspicious_invocation_specific_in_contextinfo.yml

add ps_module version

2021-10-18 14:12:52 +02:00

powershell_syncappvpublishingserver_exe_in_contextinfo.yml

Missing status in rules (#2284)

2021-11-19 22:32:26 +01:00