Florian Roth 1661c61147 Merge pull request #2250 from securepeacock/patch-5 ...

Create sysmon_excel_outbound_network_connection.yml

2021-11-12 13:05:02 +01:00

..

silenttrinity_stager_msbuild_activity.yml

fix detection

2021-11-10 19:40:10 +01:00

sysmon_dllhost_net_connections.yml

Update sysmon_dllhost_net_connections.yml

2020-10-15 16:19:43 -03:00

sysmon_excel_outbound_network_connection.yml

Update sysmon_excel_outbound_network_connection.yml

2021-11-11 21:57:44 -05:00

sysmon_malware_backconnect_ports.yml

Update sysmon_malware_backconnect_ports.yml

2020-10-15 16:20:27 -03:00

sysmon_notepad_network_connection.yml

Update sysmon_notepad_network_connection.yml

2020-10-15 16:21:38 -03:00

sysmon_powershell_network_connection.yml

Merge branch 'master' into master

2021-07-11 00:32:55 +02:00

sysmon_rdp_reverse_tunnel.yml

Correct cast-sensitive Key "DestinationIp"

2021-05-11 10:49:10 +02:00

sysmon_regsvr32_network_activity.yml

Remove unneeded EventID

2021-10-04 21:25:57 +02:00

sysmon_remote_powershell_session_network.yml

Update sysmon_remote_powershell_session_network.yml

2021-07-03 14:25:55 +08:00

sysmon_rundll32_net_connections.yml

Update sysmon_rundll32_net_connections.yml

2020-10-15 16:24:38 -03:00

sysmon_susp_prog_location_network_connection.yml

add missing tags

2021-09-01 12:54:21 +02:00

sysmon_susp_rdp.yml

adding additional allow for dns service (domain controllers)

2021-11-10 17:09:15 +00:00

sysmon_suspicious_outbound_kerberos_connection.yml

added missing ATT&CK v6.3 IDs with comments and removed unnecessary "modified" attributes

2020-08-25 23:51:22 +00:00

sysmon_win_binary_github_com.yml

Remove additional backslash

2020-11-20 00:52:54 -03:00

sysmon_win_binary_susp_com.yml

Remove additional backslash

2020-11-20 00:53:13 -03:00

sysmon_wuauclt_network_connection.yml

Fixes&improvements

2021-04-08 01:06:40 +02:00

win_net_crypto_mining.yml

rules: crypto coin mining

2021-10-26 08:52:07 +02:00